last executing test programs: 5m31.438927537s ago: executing program 1 (id=478): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) close(r0) getsockopt$WPAN_SECURITY_LEVEL(r1, 0x1000000, 0x2, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)={0x2, 0x0, [{0x4000, 0x1000, &(0x7f0000001600)=""/4096}, {0x0, 0x0, 0x0}]}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x100a, 0x1}) getpriority(0x0, 0xffffffffffffffff) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xe000, 0x7, &(0x7f0000ff2000/0xe000)=nil) r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x1a9101) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f0000000100)=""/169) socket$netlink(0x10, 0x3, 0x13) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x1}) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) 5m31.351212089s ago: executing program 1 (id=480): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_getevents(r2, 0x7, 0x3, &(0x7f0000000240)=[{}, {}, {}], &(0x7f00000002c0)={0x0, 0x3938700}) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) mount$cgroup2(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='memory_localevents,']) (async) mount$cgroup2(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='memory_localevents,']) io_submit(r2, 0x1, &(0x7f0000000300)=[&(0x7f0000002240)={0x0, 0x0, 0x8, 0x0, 0x0, r1, 0x0, 0x0, 0x3d95}]) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$HIDIOCGFIELDINFO(r3, 0xc038480a, &(0x7f0000000040)={0x1, 0x200, 0x7, 0x1, 0x73, 0x4, 0x3, 0xffffffff, 0x5, 0x6, 0x57, 0x3, 0xe, 0x8}) openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x0, 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x0, 0x0) copy_file_range(r4, 0x0, r4, 0x0, 0x1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x100000d, 0x12, r5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getpid() (async) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) (async) sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) ioctl$F2FS_IOC_FLUSH_DEVICE(r0, 0x4008f50a, &(0x7f0000000340)={0x5, 0x2}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, 0x0, 0x0) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) (async) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) (async) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000140)='./file0\x00', 0x1, 0x0) clock_adjtime(0x0, &(0x7f00000000c0)={0x800, 0xffff, 0x4, 0x100000001, 0x9, 0xfffffffffffffffd, 0xf, 0x4, 0x7, 0x1, 0x2, 0x5, 0x1000, 0x8000, 0x4, 0x9, 0x6, 0x5, 0x1000, 0x9, 0x3, 0x6, 0x7, 0x2, 0x10000, 0x2}) personality(0x5400004) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x4) (async) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x4) 5m31.137956062s ago: executing program 1 (id=483): creat(&(0x7f0000001380)='./file0\x00', 0x4) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x90) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x4, 0xc, 0x0, 0x5, 0xff, 0x1f, 0x0, 0x10000}, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x9}, {0x0, 0x0, 0x3c, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}]}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x1, 0x0, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') lseek(r3, 0xffffff7f00000000, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x7, 0x7fc00100}]}) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async, rerun: 64) r4 = socket$inet(0x2, 0x3, 0x4) (rerun: 64) sendmmsg$inet(r4, &(0x7f0000000440)=[{{&(0x7f00000001c0)={0x2, 0x4e20, @local}, 0x10, 0x0, 0x0, &(0x7f00000003c0)=ANY=[], 0x28}}], 0x1, 0x40) (async) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r6, 0x1, 0x2a, &(0x7f0000000400)=0x3ff, 0x4) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f00000001c0)=[@increfs_done={0x40106308, 0x3}, @release, @clear_death={0x400c630f, 0x1}, @increfs, @acquire_done, @register_looper], 0x9e, 0x0, &(0x7f0000000240)="eecc86dbb0abfd4ab4dbd44163a2eb5fb844c42a169cbef02db74109889d3e9c22409eb5837be2949bb9c26f4b4aa77165226c5535d386c0bdc21cc8f44a8e8228979eb08060f0b1fbcecafa56cdd80ff7506a386e3d296b820e29d59fcc6b3b22bc99a499d9a1f7bbae5234d00c3f97096627cc80131c8924534bcd178a2f86844a1ff26305c2861c1294b76288d1fb710e8eead0eb5999ce3af89817f5"}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000e00)=[@clear_death={0x400c6313}], 0x0, 0x0, 0x0}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000100)={'vxcan1\x00', 0x2912}) (async, rerun: 64) ioctl$TUNSETNOCSUM(r8, 0x400454cc, 0xffffffffffffffff) (async, rerun: 64) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setlease(r9, 0x400, 0x0) 5m31.119692642s ago: executing program 1 (id=484): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/resume', 0x8002, 0x10) write$cgroup_pid(r1, 0x0, 0x0) r2 = epoll_create(0x4) epoll_pwait(r2, &(0x7f0000000280)=[{}], 0x1, 0x8, &(0x7f0000000380)={[0x4]}, 0x8) openat$cgroup_procs(r1, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='net/igmp\x00') read$FUSE(r5, &(0x7f0000004200)={0x2020}, 0x2020) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) r6 = openat$cgroup_procs(r3, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f00000001c0), 0x12) mkdir(&(0x7f0000000100)='./cgroup\x00', 0x136) r7 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) openat(r7, &(0x7f0000000040)='./cgroup\x00', 0x40000, 0x35) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) lsm_list_modules(0x0, &(0x7f0000000040), 0x0) ioctl$BTRFS_IOC_SEND(r0, 0x40489426, 0x0) 5m31.076519163s ago: executing program 1 (id=485): r0 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000100)=0xe, 0x80000) setsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000000180)={0xf, "06089f"}, 0x6) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000008d000000900300"/24]) syz_usb_connect(0x3, 0x3d, &(0x7f00000003c0)=ANY=[@ANYRES32=r0], 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200047fd, &(0x7f00000001c0)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$sock_int(r1, 0x1, 0x4, &(0x7f0000000b80)=0x2, 0x4) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_mreq(r5, 0x29, 0x13, 0x0, &(0x7f0000000280)) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r6, 0x401054d5, &(0x7f0000000480)={0x2, &(0x7f00000004c0)=[{0x2d, 0x0, 0x2}, {}]}) sendto$inet(r1, &(0x7f0000000740)="17fd8757270b23b5f2d12809a7b93d036023c20509d8d2b6d053b8944677c9d2ead3a8885db1d0bb7ec41c2f7d0604a4ed85f38d68f1813bb86c018a3c7139394bfecfee022378ce51bdc51590e0d0478f1c9d6d7a791512beb6cf73dcb86832cbe9c8a69532c088e59fdad44cd4a8ee00ed352d14e2ca413fa6d5c2377825b22b01d64fd9897acd4d7010ffff0000000000000ade8e2debdefc6dbd83a9c32eaa02d8c19fd73340054ef04a9799e1e4a3e1eb462a5f3f40312a7586fea68bf35d000e6bb666307ed85c77d20a2afc5a8d50a8db7e19825e7d54358e9377ea30027ab7c80746049c4aa2da53fac7e9940188b47402f4", 0x59a, 0x140080c0, 0x0, 0x20) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) dup2(r6, r7) r8 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f00000000c0)=0x11) close_range(r7, 0xffffffffffffffff, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f0000000600)={0x14, &(0x7f0000000300)=ANY=[@ANYBLOB="000d7e0000007e08803fbf237a74e7113ff106cd680820432c625a81278e042006114adbdcbe6e6d59ed3a656f0d3516f7d8dc9e31459fc154745844f42605703e6474c7312df8957752ca658d94030bb3fc922bda72aaa48fef697b4679c39029275570e3187d5d563a6c8d480795763dab1ce177b42bb42ebc35eda080ec974b068637"], &(0x7f0000000200)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000840)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="4014eb000000cf63e38f9a3b87c308e505fab8a42d4b60b55060ac21a3953cdfb568524fe79329dc7d5eabc83f35bb0269552ab0f576d2dd6033e7b2798c3a68dbb3559b118f7f18f96d453c82e24c9932b5de23b1446f56a8e9c9a1d29548426b9b1d799dfe3edb91f3f74f3a6153f0c441a0b664262f43f1e07eea55a2c7b123a4118fcc2a369a47463bc997058b4c53fe643d7f51a918ea87f327b0b28d16b97936fde50d889c64036def0b9ffb6cd5643cbe38fbcae03dff62659b9202c898c44ac4d57276924be2240c66084cde68454beaca2c22175849f4f9f0302de192e134633854fe14e76706bba6d1e1f204"], &(0x7f0000000240)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x5a}, &(0x7f0000000440)={0x20, 0x80, 0x1c, {0x6, 0x5, 0x7, 0x81, 0x0, 0x6, 0x7, 0xb, 0x2, 0x9, 0x2, 0x3ff}}, &(0x7f00000008c0)={0x20, 0x85, 0x4, 0x4}, &(0x7f0000000640)={0x20, 0x83, 0x2}, &(0x7f0000000680)={0x20, 0x87, 0x2}, &(0x7f00000006c0)={0x20, 0x89, 0x2}}) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r9, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'tunl0\x00', 0x0}) sendto$packet(r9, 0x0, 0x0, 0x40005, &(0x7f00000002c0)={0x11, 0x86dd, r10, 0x1, 0x0, 0x6, @local}, 0x14) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r11, 0xae03, 0xbb) 5m30.954305235s ago: executing program 1 (id=487): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000005c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x10}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/custom0\x00', 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x3a) sendmmsg$inet6(r1, &(0x7f0000000080)=[{{&(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x12}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000100)="a0002883781ecc0e", 0x8}], 0x1}}], 0x1, 0x4) syz_usb_connect(0x6, 0x3b8, &(0x7f0000000ac0)={{0x12, 0x1, 0x200, 0x51, 0x5b, 0x18, 0x40, 0x7aa, 0x1, 0xa01b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3a6, 0x2, 0x1, 0xda, 0x18, 0x7, [{{0x9, 0x4, 0xb, 0x5f, 0x3, 0x8c, 0x5a, 0x17, 0x10, [], [{{0x9, 0x5, 0xc, 0x8, 0x8, 0x52, 0x7, 0x80, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x7d, 0x4016}]}}, {{0x9, 0x5, 0x3, 0x8, 0x20, 0x0, 0xf, 0x80, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x7, 0x81}]}}, {{0x9, 0x5, 0x0, 0x0, 0x10, 0x7, 0x4, 0xb, [@generic={0x70, 0x0, "abafd4e6376bd9b9c4a6331c9a526112ca5a32d29c6c4527c32bff3cbc6bef0d61990de2615109b49f27c234e5afcff42c1bc41a57a198eb5c7353614028f884f53cec097d630da1942d9780cba6dc31fda5d2fa06e77bc4b91adaa1f691c62401d2092eb1aac9ff7423294ec565"}, @generic={0x4d, 0xf, "62a961fcb32b0974ff709581e31fd03e463de42ff0f8b98bca32e67f7f24cf2c0f27029f4bf94908a667b6fc584a443cd014264da32f39728dd6485a3b28b40c58041f787fd3673302a729"}]}}]}}, {{0x9, 0x4, 0x9f, 0x1, 0x6, 0x16, 0xbf, 0x40, 0x9, [@cdc_ecm={{0x5}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x3, 0x4, 0x6, 0x3}, [@obex={0x5, 0x24, 0x15, 0xb78}, @call_mgmt={0x5, 0x24, 0x1, 0x2, 0x7c}, @dmm={0x7, 0x24, 0x14, 0xfff9, 0x3}, @dmm={0x7, 0x24, 0x14, 0x3, 0x245e}, @mbim={0xc, 0x24, 0x1b, 0x0, 0x0, 0x9, 0x2, 0x753, 0x7}]}], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x6, 0x81, 0x1}}, {{0x9, 0x5, 0x2, 0x10, 0x200, 0x7, 0x61, 0x0, [@generic={0xff, 0x22, "41d73691a5a51e1b2bb43adcdc95e7f1def7d2d7a0a6feb0e4434b6eed3d05f1007f1284c3520ba27b889f5e7b1c6824fc5e2bd9b5caa2dd52fe183c25b521a6b1d888b592963f23e3e864d3aec103e6827c002fb04d81216704e744504d36a24823595bae547d1e3092a0f3005ddf5278a971de5cf5665b62ebbe58d7edeb4a9fbc5e1b1fd4bb52d61ac636625224a1b6df3a06d1eebb4a1033ecac03450425d0765077449d680bfd8154ddadd8b7edf28940d22116ff55ba79c1900a3f3ee3170378bd662b61f695f2cee6aaf9bfb131423931578fa0157cb65717c2289899a0d35c57a393e93a8d4e8e8e560f62d32f25899082ae130506c1e871b3"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x20, 0x8, 0x6, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x81, 0x5}]}}, {{0x9, 0x5, 0xd, 0x0, 0x3ff, 0x4, 0x0, 0x6, [@generic={0x37, 0x22, "a3af5b2dcae6efb496c9da274d1a64518a8f72616899116b64e235a70aa3afbd17a34a24b882968b1ad2381c12e67987649eafb76f"}, @generic={0x22, 0x0, "a3bbe6025d1c57ba350294a702119843eb978dacaa04ac11437b43bb56441a35"}]}}, {{0x9, 0x5, 0xc, 0x4, 0x20, 0x8, 0x9d, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x5, 0x8}, @generic={0xce, 0xf, "57f57125a83663086fab6a4c4303b1e74a886a826d2d754065580d60af9354cf95ced43dca9a226e0868fa1177f87965eb42f172d39f588d4ee6d17db6a8780a90cd44bbc92d38b261b0710cfc76768862abac399df00913728f76a59c44ba8371e084d00614c84cde664c141e1d95b2fe36e6a0bb194e678cd7d986f2c0f97ee119eef66d006cccf338807d3fc94e3efd80024a5bb40d48b0a260a15aeeb911f587888b99e4bcdf65f21b02ec3e0e328c883581401d9e598589e0af1b70f75ab7b64db4e920f87e2ecdd08e"}]}}, {{0x9, 0x5, 0x8, 0xc, 0x10, 0x7b, 0xb, 0x7}}]}}]}}]}}, &(0x7f00000006c0)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x300, 0x6, 0xc, 0x45, 0xff}, 0x5, &(0x7f0000000240)={0x5, 0xf, 0x5}, 0x7, [{0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x860}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x427}}, {0x80, &(0x7f00000003c0)=@string={0x80, 0x3, "bbc7c70a6c448508bdb48a398983a4292608764c5cbfb8afdd6770858f23044f7e75fd035e8f4102c6edc3538d39b1fb444c0cfa47aca75bca04f32bd31192d3b3b3f68fa44afaf26c53d5078f49277ee9025f92b031bf04a5d02b2333e9daaeec13fb781dae418d83b86d0d5bcdb37ec4687cb5c70ee0db964e72a7b78b"}}, {0x16, &(0x7f0000000440)=@string={0x16, 0x3, "99c2e77eeafb645170e453286daa7458403e09d5"}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x420}}, {0x69, &(0x7f0000000740)=ANY=[@ANYBLOB="690312e380585f004e797f03a8aa840e68250912add299480e183d58d0f56d48b321ff8c7298822108cb389cdffafddf1a5a723f73dc9859148dbed8c53884bac6e18ac664f937a2ff56b80462c0b15db78676098c116ef1f22754adf4c264f85e545a801f6c1f2f6c1f22f708516f4575267922a5b3450f5796f2e64887f193fea63b81ccc31a7531fe8afbcfacb46c2f48045a741170408e6491dd7b47f85bc1c766928800e441856961dc14af15d0eb11f4225ce68aeb8c81020ece1aa04b63af9d7a0be99602fa3126cf39a22967287057776f1e3c187b68bf9d7d094aa3b69b2dd889ba5d84b570a98e1dd4d211a5b1216709fe77d8aef5f8f2e108c63112359366b89fc36c8125a05cd3bc"]}, {0x87, &(0x7f0000000600)=@string={0x87, 0x3, "e974a72bc529c2fc8a85e40ec4257d4811e9703197f77251f2a6573fe718757527ac610bce3bac4f09f1743ad8c21c7db179823aad04b4bb799748fb68df66107e4d18feadb2f404e34b4f6c7b8b18f1bda1b81ffe1791825b78a32dc3b71e69b540332a7f5fb2997f2ee496be785fb7615886c93a9e578033932d2b296b90a428bcece6a1"}}]}) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000002c0)=""/100, 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) fremovexattr(r3, &(0x7f00000001c0)=@known='system.sockprotoname\x00') ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f00000009c0)=""/251, 0x0, 0x4}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$BTRFS_IOC_DEFRAG(r1, 0x50009402, 0x0) ioctl$VHOST_SET_LOG_BASE(r2, 0x4008af04, &(0x7f0000000200)=0x0) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0x10, 0x100800) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x201008, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f0000000040)=0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs/binder0\x00', 0x2, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCGSOFTCAR(r5, 0x5416, &(0x7f0000001100)) 5m30.937432595s ago: executing program 32 (id=487): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000005c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x10}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/custom0\x00', 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x3a) sendmmsg$inet6(r1, &(0x7f0000000080)=[{{&(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x12}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000100)="a0002883781ecc0e", 0x8}], 0x1}}], 0x1, 0x4) syz_usb_connect(0x6, 0x3b8, &(0x7f0000000ac0)={{0x12, 0x1, 0x200, 0x51, 0x5b, 0x18, 0x40, 0x7aa, 0x1, 0xa01b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3a6, 0x2, 0x1, 0xda, 0x18, 0x7, [{{0x9, 0x4, 0xb, 0x5f, 0x3, 0x8c, 0x5a, 0x17, 0x10, [], [{{0x9, 0x5, 0xc, 0x8, 0x8, 0x52, 0x7, 0x80, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x7d, 0x4016}]}}, {{0x9, 0x5, 0x3, 0x8, 0x20, 0x0, 0xf, 0x80, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x7, 0x81}]}}, {{0x9, 0x5, 0x0, 0x0, 0x10, 0x7, 0x4, 0xb, [@generic={0x70, 0x0, "abafd4e6376bd9b9c4a6331c9a526112ca5a32d29c6c4527c32bff3cbc6bef0d61990de2615109b49f27c234e5afcff42c1bc41a57a198eb5c7353614028f884f53cec097d630da1942d9780cba6dc31fda5d2fa06e77bc4b91adaa1f691c62401d2092eb1aac9ff7423294ec565"}, @generic={0x4d, 0xf, "62a961fcb32b0974ff709581e31fd03e463de42ff0f8b98bca32e67f7f24cf2c0f27029f4bf94908a667b6fc584a443cd014264da32f39728dd6485a3b28b40c58041f787fd3673302a729"}]}}]}}, {{0x9, 0x4, 0x9f, 0x1, 0x6, 0x16, 0xbf, 0x40, 0x9, [@cdc_ecm={{0x5}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x3, 0x4, 0x6, 0x3}, [@obex={0x5, 0x24, 0x15, 0xb78}, @call_mgmt={0x5, 0x24, 0x1, 0x2, 0x7c}, @dmm={0x7, 0x24, 0x14, 0xfff9, 0x3}, @dmm={0x7, 0x24, 0x14, 0x3, 0x245e}, @mbim={0xc, 0x24, 0x1b, 0x0, 0x0, 0x9, 0x2, 0x753, 0x7}]}], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x6, 0x81, 0x1}}, {{0x9, 0x5, 0x2, 0x10, 0x200, 0x7, 0x61, 0x0, [@generic={0xff, 0x22, "41d73691a5a51e1b2bb43adcdc95e7f1def7d2d7a0a6feb0e4434b6eed3d05f1007f1284c3520ba27b889f5e7b1c6824fc5e2bd9b5caa2dd52fe183c25b521a6b1d888b592963f23e3e864d3aec103e6827c002fb04d81216704e744504d36a24823595bae547d1e3092a0f3005ddf5278a971de5cf5665b62ebbe58d7edeb4a9fbc5e1b1fd4bb52d61ac636625224a1b6df3a06d1eebb4a1033ecac03450425d0765077449d680bfd8154ddadd8b7edf28940d22116ff55ba79c1900a3f3ee3170378bd662b61f695f2cee6aaf9bfb131423931578fa0157cb65717c2289899a0d35c57a393e93a8d4e8e8e560f62d32f25899082ae130506c1e871b3"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x20, 0x8, 0x6, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x81, 0x5}]}}, {{0x9, 0x5, 0xd, 0x0, 0x3ff, 0x4, 0x0, 0x6, [@generic={0x37, 0x22, "a3af5b2dcae6efb496c9da274d1a64518a8f72616899116b64e235a70aa3afbd17a34a24b882968b1ad2381c12e67987649eafb76f"}, @generic={0x22, 0x0, "a3bbe6025d1c57ba350294a702119843eb978dacaa04ac11437b43bb56441a35"}]}}, {{0x9, 0x5, 0xc, 0x4, 0x20, 0x8, 0x9d, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x5, 0x8}, @generic={0xce, 0xf, "57f57125a83663086fab6a4c4303b1e74a886a826d2d754065580d60af9354cf95ced43dca9a226e0868fa1177f87965eb42f172d39f588d4ee6d17db6a8780a90cd44bbc92d38b261b0710cfc76768862abac399df00913728f76a59c44ba8371e084d00614c84cde664c141e1d95b2fe36e6a0bb194e678cd7d986f2c0f97ee119eef66d006cccf338807d3fc94e3efd80024a5bb40d48b0a260a15aeeb911f587888b99e4bcdf65f21b02ec3e0e328c883581401d9e598589e0af1b70f75ab7b64db4e920f87e2ecdd08e"}]}}, {{0x9, 0x5, 0x8, 0xc, 0x10, 0x7b, 0xb, 0x7}}]}}]}}]}}, &(0x7f00000006c0)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x300, 0x6, 0xc, 0x45, 0xff}, 0x5, &(0x7f0000000240)={0x5, 0xf, 0x5}, 0x7, [{0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x860}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x427}}, {0x80, &(0x7f00000003c0)=@string={0x80, 0x3, "bbc7c70a6c448508bdb48a398983a4292608764c5cbfb8afdd6770858f23044f7e75fd035e8f4102c6edc3538d39b1fb444c0cfa47aca75bca04f32bd31192d3b3b3f68fa44afaf26c53d5078f49277ee9025f92b031bf04a5d02b2333e9daaeec13fb781dae418d83b86d0d5bcdb37ec4687cb5c70ee0db964e72a7b78b"}}, {0x16, &(0x7f0000000440)=@string={0x16, 0x3, "99c2e77eeafb645170e453286daa7458403e09d5"}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x420}}, {0x69, &(0x7f0000000740)=ANY=[@ANYBLOB="690312e380585f004e797f03a8aa840e68250912add299480e183d58d0f56d48b321ff8c7298822108cb389cdffafddf1a5a723f73dc9859148dbed8c53884bac6e18ac664f937a2ff56b80462c0b15db78676098c116ef1f22754adf4c264f85e545a801f6c1f2f6c1f22f708516f4575267922a5b3450f5796f2e64887f193fea63b81ccc31a7531fe8afbcfacb46c2f48045a741170408e6491dd7b47f85bc1c766928800e441856961dc14af15d0eb11f4225ce68aeb8c81020ece1aa04b63af9d7a0be99602fa3126cf39a22967287057776f1e3c187b68bf9d7d094aa3b69b2dd889ba5d84b570a98e1dd4d211a5b1216709fe77d8aef5f8f2e108c63112359366b89fc36c8125a05cd3bc"]}, {0x87, &(0x7f0000000600)=@string={0x87, 0x3, "e974a72bc529c2fc8a85e40ec4257d4811e9703197f77251f2a6573fe718757527ac610bce3bac4f09f1743ad8c21c7db179823aad04b4bb799748fb68df66107e4d18feadb2f404e34b4f6c7b8b18f1bda1b81ffe1791825b78a32dc3b71e69b540332a7f5fb2997f2ee496be785fb7615886c93a9e578033932d2b296b90a428bcece6a1"}}]}) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000002c0)=""/100, 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) fremovexattr(r3, &(0x7f00000001c0)=@known='system.sockprotoname\x00') ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f00000009c0)=""/251, 0x0, 0x4}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$BTRFS_IOC_DEFRAG(r1, 0x50009402, 0x0) ioctl$VHOST_SET_LOG_BASE(r2, 0x4008af04, &(0x7f0000000200)=0x0) accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0x10, 0x100800) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x201008, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f0000000040)=0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f00000004c0)='./binderfs/binder0\x00', 0x2, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCGSOFTCAR(r5, 0x5416, &(0x7f0000001100)) 4m58.472954906s ago: executing program 3 (id=1142): socketpair(0x18, 0x6, 0x4, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x8800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_X86_SET_MCE(r3, 0x4040ae9e, &(0x7f0000000080)={0x7c00000000000000, 0x4000, 0x7, 0x0, 0x16}) (async, rerun: 64) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (rerun: 64) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) (async) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r4, 0xfffffffffffffffc) (async, rerun: 32) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, 0xfffffffffffffffc, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) (async, rerun: 32) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000140)={0x1ff, 0x3, 0x87000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) (async) r5 = syz_usb_connect$uac1(0x0, 0xe8, &(0x7f0000000180)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xd6, 0x3, 0x1, 0x7f, 0x60, 0x5, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x1, 0x33}, [@extension_unit={0xa, 0x24, 0x8, 0x4, 0x9, 0xa, "f29370"}, @extension_unit={0xc, 0x24, 0x8, 0x2, 0xfffe, 0x8, "dcb906a96c"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x6, 0x8, 0x3}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x2, 0x1, 0x34, 0x25}, @format_type_i_discrete={0x10, 0x24, 0x2, 0x1, 0xa2, 0x3, 0xfc, 0x2, "e78f8f78a5fd3c8a"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x5, 0x10, 0xb4, {0x7, 0x25, 0x1, 0x2, 0x4, 0x2c77}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xf, 0x24, 0x2, 0x1, 0xff, 0x3, 0x8, 0x6, "442acb999e7581"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x1, 0x1, 0x5, 0x3, "fdf1", "17"}, @format_type_i_discrete={0x9, 0x24, 0x2, 0x1, 0xa1, 0x1, 0x7, 0x40, "0f"}, @format_type_i_discrete={0xf, 0x24, 0x2, 0x1, 0x7, 0x5, 0xc, 0x1, "98a621b41b4e6d"}, @as_header={0x7, 0x24, 0x1, 0x9, 0x6, 0x6}, @format_type_i_discrete={0x9, 0x24, 0x2, 0x1, 0x9, 0x4, 0x1, 0x5, '$'}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x5b, 0xff, 0x6, {0x7, 0x25, 0x1, 0x80, 0x80, 0x4}}}}}}}]}}, &(0x7f0000000680)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x110, 0x0, 0x7, 0x6, 0x8, 0x7}, 0xd3, &(0x7f0000000340)={0x5, 0xf, 0xd3, 0x4, [@generic={0xad, 0x10, 0x2, "1702955c57be1d40e1aa1a00a8b46e75cedd19b9f375755e6621dffa7d2148daa609481e25ea63477f138adab2fb676a9bfb9febbe0f25a3022223292b6129242ce1afce029a6d39fc9a392a22c10c57efd02fd5538e1065658345c73b0141006003cc2eed6d04e72bc2acc9d0f7dd5d03079a556d0d41b8bdad04f27ec5df173802512414a696866622ee5e0d2d69f0fe1000bc7fd692122992856784c69ec9bbc3df70bb9ece0a97ee"}, @wireless={0xb, 0x10, 0x1, 0x8, 0x3, 0x5, 0xd, 0x8001, 0x3}, @wireless={0xb, 0x10, 0x1, 0x2, 0x50, 0x5, 0xc2, 0x0, 0x2}, @wireless={0xb, 0x10, 0x1, 0x4, 0xd0, 0x8, 0x6, 0x1, 0x3}]}, 0x5, [{0xb9, &(0x7f0000000440)=@string={0xb9, 0x3, "4e469a4ad70f8b2fd7ee860c24bbf969e7b46b5d703a05e7bfbe66ef343e0783a8529f78432ef7a878717afeb01ef8a1501bc94231a6865575d0e7cf9ecaba47cd3c2a2bb65ad3d29f3004b18b116d8780d3f686e38946a36800f7c6fe8ea39192df63ecc3193632e9be1e58f71cff80a8d58a9169278411cbbede14995f0955af0b9a89f4fdffea16ceb90cc44ce82f0bc3f7f1d7b1c952ee96e587ebe4e78e0ba089904878ef2aa511b6c2e3ca288d4cdbba2b64c7d6"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x380a}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x1001}}, {0xb, &(0x7f0000000600)=@string={0xb, 0x3, "54e7e45fe20bdeff82"}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0xc1a}}]}) syz_usb_control_io$uac1(r5, &(0x7f0000000840)={0x14, &(0x7f0000000700)={0x0, 0x5, 0x63, {0x63, 0x1, "311ec886332c79312d763785c11b8176aebddc28168e5c7735aa462eaf6b1fde92c6d468dded132974647a6878a073b4669279fdc3c356fe919c42c1d6861469b03a7f045dfa7ef2c99b5e42c69380225d2e9f5ce6e749dbc9d7ec17c67a306410"}}, &(0x7f0000000780)={0x0, 0x3, 0x95, @string={0x95, 0x3, "8dd9e7e8df323184aa3e413586ce069ba0ad2afd2c97a676f9a806b37204912423a7ad5da52cff185f87fc4459f4f6160e2827f2520fb83aef15aeeebf130dbe3e18668df7c3b3f3c54ca1c7cfe1f42cbd145ea2563c4d7cb59edca34817cdae1d8a3c09fb35a126efb336d6fd570e02b5d2e487a863deede3bdea2e5a3428becb2bd99e31537f99169d4c9c756e56c3be2741"}}}, &(0x7f0000000ac0)={0x44, &(0x7f0000000880)={0x0, 0x17, 0x50, "1d637e33b3c35ff4c13cd393f201b607096fdbcdce0d0845d5e97351d5cca2ed4e0081b5f60dcd395c776743a03a0d5f13f5e24804c88c67668a3fab7b2374168151660b8db7dbb9c401604aee067cd5"}, &(0x7f0000000900)={0x0, 0xa, 0x1, 0x96}, &(0x7f0000000940)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000980)={0x20, 0x81, 0x1, 'q'}, &(0x7f00000009c0)={0x20, 0x82, 0x2, "bf5b"}, &(0x7f0000000a00)={0x20, 0x83, 0x3, "0203e7"}, &(0x7f0000000a40)={0x20, 0x84, 0x3, "306b80"}, &(0x7f0000000a80)={0x20, 0x85, 0x3, "05f8cb"}}) (async) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) 4m58.415515707s ago: executing program 3 (id=1143): r0 = creat(&(0x7f0000001380)='./file0\x00', 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000100)=0xc) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='msdos\x00', 0x8000, 0x0) 4m58.348930748s ago: executing program 3 (id=1144): syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/devices\x00', 0x0, 0x0) (async) socket$packet(0x11, 0x2, 0x300) (async) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) (async) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23, 0x1, @remote, 0x401}, 0x1c) (async) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) getpid() r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x54c, 0x5c4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000200)={0x24, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0x4, "7738e21f"}]}}, 0x0}, 0x0) (async) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000440)={{0x4000, 0x0, 0x43cb, 0x8}, 'syz0\x00', 0x22}) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder1\x00', 0x0, 0x0) (async) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='fd\x00') fchdir(r3) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000024c0)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000080)=@abs={0x1, 0x30}, 0x6e, 0x0}}], 0x2, 0xe0) ioctl$UI_DEV_CREATE(r1, 0x5501) write$uinput_user_dev(r1, &(0x7f0000001940)={'syz0\x00', {0x7, 0x5, 0x7, 0x4}, 0x15, [0x2, 0x4, 0x7, 0x80, 0x9, 0x7, 0x1, 0x9, 0x8, 0x8, 0x80, 0x2, 0x0, 0x3, 0x9, 0x6, 0xa1, 0x1, 0x3, 0x8, 0x40, 0x3, 0xffff, 0xf, 0x101, 0x805, 0x6, 0x0, 0x1, 0x4, 0x40000006, 0x0, 0x6, 0x5, 0x9, 0x877, 0x5, 0x7, 0xf17, 0x870b, 0x10, 0xae, 0x1, 0x8, 0x4, 0xffffffee, 0x7fe0000, 0x200, 0x9, 0xc, 0x80000000, 0x54, 0x7, 0x2, 0x54c2, 0x7, 0x643e1dbc, 0x3d3, 0xeb2, 0xc, 0x10000, 0x1, 0x9f8b, 0x8], [0x4, 0x6, 0x7fffffff, 0xffffffff, 0x4, 0x1, 0x1, 0x6, 0x1, 0x6, 0x80000000, 0x3, 0x0, 0x4033, 0x6, 0x0, 0x8, 0x1, 0x0, 0x4, 0x2, 0x7, 0x1, 0x9, 0x2, 0x10, 0x100, 0x5, 0x8, 0xc, 0x1, 0x41, 0x6, 0x3, 0xfffffffe, 0x6, 0xf23, 0xe, 0x69, 0x9, 0x0, 0xfffffffb, 0x5, 0x4e5, 0x8, 0x401, 0x7ff, 0x7d, 0x1, 0x4, 0x2, 0xd218, 0xce, 0x6a8, 0x5d52cbeb, 0x5, 0x4, 0xfffffffd, 0x80, 0xc0, 0x7, 0x5, 0x2, 0x6], [0x10001, 0x4, 0x3, 0x7, 0x3, 0x6, 0x5, 0x2, 0x7ff, 0x7, 0x7, 0x9, 0xffff, 0x3, 0x0, 0x3, 0x5, 0x1, 0x7, 0x1, 0x4, 0x1, 0x0, 0x7, 0xb, 0x6, 0x6, 0x66c2, 0x200008, 0x81, 0x1, 0xe4b6, 0x0, 0x0, 0x3, 0x8aa541a, 0x0, 0x16, 0x5, 0x20, 0x10, 0x6, 0x8001, 0x400, 0x7, 0x8, 0x7, 0xf68, 0x8000, 0x4, 0x2, 0x2, 0x8000, 0x7f, 0x7, 0x80, 0x2685, 0x9, 0x6, 0x7fffffff, 0x8000, 0x7a, 0x3ff, 0xc], [0x9, 0x3, 0x7ff, 0xe, 0x4000007f, 0x10, 0x6, 0x10000cd9, 0x2, 0x5, 0x10001, 0x3, 0x4, 0x8001, 0x1000, 0x40, 0x0, 0x5, 0x3ff, 0xa13, 0x1ff, 0x0, 0x2, 0x0, 0x2, 0xa9, 0x6, 0x0, 0x1, 0x7, 0x2, 0x1, 0x7, 0xb735, 0x0, 0xc78, 0x1, 0x888, 0x1, 0xdd9, 0x1ff, 0x0, 0x7f, 0x0, 0x9, 0x9, 0x3, 0x8, 0x9, 0xfffffff1, 0xfffffffa, 0x6, 0xffffff86, 0x7, 0x1, 0xffffffff, 0x6, 0x7f, 0x6, 0x2, 0x1000, 0x1, 0x7fff, 0x81]}, 0x45c) (async) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000000) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x8b, 0xfffa}, 0x1d, [0x7fff, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x3, 0x108, 0x6, 0x40, 0x39cc191a, 0x5f, 0x10009, 0x5, 0xffff2d37, 0xffffff01, 0xa6, 0x3, 0x0, 0x5, 0x4, 0x8, 0x4, 0x3c5b, 0x1, 0x3, 0x9, 0x1, 0x1f461e2c, 0x1, 0xe660, 0x4, 0x7, 0x101, 0x7fff, 0x4c74, 0x80000000, 0x4242, 0x3, 0xe, 0x0, 0x71, 0xfffffff8, 0x7, 0x0, 0x0, 0xd, 0x7, 0x8f, 0x6, 0x80000001, 0x4, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x5, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x134, 0x7ffe, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0x100, 0x2c2, 0x6c9, 0x9, 0x6, 0x3, 0x1, 0x7, 0x5, 0x0, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x4, 0x8000, 0x4009, 0x400, 0x5, 0x800, 0x5, 0xff, 0x5, 0x5, 0x5f31, 0x404, 0x0, 0x2, 0x5, 0x10a, 0x4, 0x9, 0x0, 0x800, 0x6, 0xb, 0x8000, 0x1, 0xfe000000, 0xff7f, 0x2, 0x7f, 0x9, 0x2, 0xffffffff, 0x9, 0x1, 0x7, 0x3, 0x9, 0x8c93690, 0x42, 0x2], [0x400, 0x4, 0x0, 0x5, 0xfffffffe, 0x105, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x1056, 0x80000003, 0x9, 0x3e7, 0x49, 0x3, 0x2, 0x2, 0x800f38, 0x25, 0x4, 0x6d01, 0x5, 0x38, 0x800003, 0x101, 0x80, 0x2, 0xd, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0xac8, 0xc0, 0xfffffffe, 0x3, 0x7ff, 0x7ffffff9, 0x1, 0x1, 0x10001, 0x0, 0x1a, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0x63], [0x8, 0xbb32, 0x1, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1f7, 0x2, 0xf58, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7ffe, 0x8, 0x200a620, 0x404, 0x5, 0x1, 0x2, 0x800014c, 0x60a7, 0xe, 0x6, 0x2, 0x80000000, 0x5, 0x8, 0xc8, 0xee1, 0xfffff000, 0xffff, 0x2, 0x7f, 0x100, 0x9602, 0x7, 0x2, 0x4, 0x2, 0x1, 0x10080, 0x5, 0x8, 0x30b1d693, 0xa1f, 0x8, 0x7ff, 0x2, 0x6c1b, 0x0, 0x4, 0x0, 0xa, 0x400001, 0x40200, 0xffbf2441, 0xfff]}, 0x45c) (async) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 4m58.348332248s ago: executing program 3 (id=1145): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x41c2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file7\x00', 0x4) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffe) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000000)=@req3={0x7816, 0x4, 0x0, 0x7fffffff, 0x801ff, 0x1, 0x1}, 0x1c) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, 0x0) ioctl$FS_IOC_GETVERSION(r2, 0x80082103, 0x0) recvmmsg$unix(r1, &(0x7f0000004100)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000380)=""/115, 0x73}], 0x1}}], 0x1, 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) unlink(&(0x7f00000000c0)='./file0\x00') mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x5, 0x2010, r0, 0x1f0bf000) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000000)='/dev/ashmem\x00') 4m57.455734711s ago: executing program 3 (id=1163): read$FUSE(0xffffffffffffffff, &(0x7f00000041c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x90, 0x0, 0x2, {0x3, 0x0, 0x5, 0x5, 0x0, 0x1000, {0x0, 0x0, 0x20, 0xde45, 0xf9, 0x0, 0x0, 0x0, 0x7, 0x2000, 0x2, r0, 0x0, 0x4}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000300)) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fstat(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=@migrate={0xcc, 0x21, 0x1, 0x40000000, 0x0, {{@in6=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x4, 0x0, 0xfffe, 0xa, 0x0, 0x0, 0x32, 0x0, r2}}, [@migrate={0x50, 0x11, [{@in6=@private2, @in=@multicast2, @in=@private=0xa010100, @in6=@local, 0x3c, 0x0, 0x0, 0xfffffffd, 0xa, 0x2}]}, @user_kmaddress={0x2c, 0x13, {@in=@dev={0xac, 0x14, 0x14, 0x19}, @in6=@local}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x10}, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000380)={0x4c, 0x0, &(0x7f00000003c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000001c0)={@flat=@binder={0x73622a85, 0x1, 0x2}, @flat=@handle={0x73682a85, 0xa, 0x3}, @fd={0x66642a85, 0x0, r4}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) 4m57.384484042s ago: executing program 3 (id=1165): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r0, 0x1, 0x13, 0x0, &(0x7f0000002400)) io_submit(0x0, 0x0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r1, 0x2000) r2 = syz_clone(0x8100000, &(0x7f0000000280)="39725e69380836b9684c681ae7f7388c4a9196713a25a20dda0dbacdfffe243f429b7521b1cfedae1fdeedf825a7460259619e290725c72eac4cd749c45cdb9748bab6fb8e67df6666af3d2bf2691b5a8699a1ff059b5fa3a0ebd2e0a07b1df611f327a03167ef84aa8a35387504eee15d2e215a7819ff098a41fc65aa87826a65c9f57d1d2bf51b90723988817fdd657d8ee2d1de501e86008a1522f9b561aaad6e6aa7ff838b035574f3935c125238485923c58c097d360ffb16f649e5514fd480de2b4e8c", 0xc6, &(0x7f00000000c0), &(0x7f0000000180), &(0x7f0000000380)="4993232f5eec82074858c2c1adb747bd31ed342754c7c050867cd88ffa2de7833c48962eb5540897a295d687577a9d5edced0ad93d0c6b02e272734e81d33efd36e94dbdf922fd249099064fd4e089a76586dfd1374dbf3854e1c3378d9843921eda47a5bf332df127220869bb00020021a2c30554455c39012acd07c012b7c72d5f5385c2a58d4c0f2de61f03701b0b7ce144aae11cc3d617fd57bd3c335fb8b04796691b983f3417b5f663ead8508080aec006e4c0be6c40b1a991b484e1240b5fc749f567a394578c9474caa1315718da4e5c8df12e5f12a4050e03331bb08a82c1dee5c762806d1a6f5b3f684118da") capset(&(0x7f0000000040)={0x0, r2}, &(0x7f00000001c0)={0x0, 0x5, 0x0, 0x0, 0x4}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r4, 0x89f6, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0x10, 0x0, 0x2, 0x0, 0xb152, 0x1, 0x1ff, 0x0, 0x5}}) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_int(r6, 0x0, 0xb, 0x0, &(0x7f00000008c0)) socket$netlink(0x10, 0x3, 0x9) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r9 = dup2(r5, r3) getsockopt$inet6_int(r9, 0x29, 0xc9, 0x0, 0x0) r10 = dup(r8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x18814, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r10}, 0x2c, {[{@cache_readahead}], [], 0x6b}}) lsm_list_modules(0x0, &(0x7f0000000040), 0x0) 4m57.350573493s ago: executing program 33 (id=1165): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001980)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r0, 0x1, 0x13, 0x0, &(0x7f0000002400)) io_submit(0x0, 0x0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r1, 0x2000) r2 = syz_clone(0x8100000, &(0x7f0000000280)="39725e69380836b9684c681ae7f7388c4a9196713a25a20dda0dbacdfffe243f429b7521b1cfedae1fdeedf825a7460259619e290725c72eac4cd749c45cdb9748bab6fb8e67df6666af3d2bf2691b5a8699a1ff059b5fa3a0ebd2e0a07b1df611f327a03167ef84aa8a35387504eee15d2e215a7819ff098a41fc65aa87826a65c9f57d1d2bf51b90723988817fdd657d8ee2d1de501e86008a1522f9b561aaad6e6aa7ff838b035574f3935c125238485923c58c097d360ffb16f649e5514fd480de2b4e8c", 0xc6, &(0x7f00000000c0), &(0x7f0000000180), &(0x7f0000000380)="4993232f5eec82074858c2c1adb747bd31ed342754c7c050867cd88ffa2de7833c48962eb5540897a295d687577a9d5edced0ad93d0c6b02e272734e81d33efd36e94dbdf922fd249099064fd4e089a76586dfd1374dbf3854e1c3378d9843921eda47a5bf332df127220869bb00020021a2c30554455c39012acd07c012b7c72d5f5385c2a58d4c0f2de61f03701b0b7ce144aae11cc3d617fd57bd3c335fb8b04796691b983f3417b5f663ead8508080aec006e4c0be6c40b1a991b484e1240b5fc749f567a394578c9474caa1315718da4e5c8df12e5f12a4050e03331bb08a82c1dee5c762806d1a6f5b3f684118da") capset(&(0x7f0000000040)={0x0, r2}, &(0x7f00000001c0)={0x0, 0x5, 0x0, 0x0, 0x4}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r4, 0x89f6, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0x10, 0x0, 0x2, 0x0, 0xb152, 0x1, 0x1ff, 0x0, 0x5}}) r5 = creat(&(0x7f0000000240)='./file0\x00', 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_int(r6, 0x0, 0xb, 0x0, &(0x7f00000008c0)) socket$netlink(0x10, 0x3, 0x9) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r9 = dup2(r5, r3) getsockopt$inet6_int(r9, 0x29, 0xc9, 0x0, 0x0) r10 = dup(r8) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x18814, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r10}, 0x2c, {[{@cache_readahead}], [], 0x6b}}) lsm_list_modules(0x0, &(0x7f0000000040), 0x0) 3m17.68696125s ago: executing program 4 (id=3022): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000080)={0x0, 0x10000000000000, 0x1000, 0x0, 0x3}, 0x20) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/netlink\x00') read$FUSE(r3, &(0x7f0000004200)={0x2020}, 0x2020) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) ioctl$KVM_PPC_ALLOCATE_HTAB(r3, 0xc004aea7, &(0x7f0000000080)=0x2) write$cgroup_pid(r4, &(0x7f00000001c0), 0x12) mkdir(&(0x7f0000000100)='./cgroup\x00', 0x136) r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) openat(r5, &(0x7f0000000040)='./cgroup\x00', 0x40000, 0x35) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) lsm_list_modules(0x0, &(0x7f0000000040), 0x0) ioctl$BTRFS_IOC_SEND(r0, 0x40489426, 0x0) 3m17.458973583s ago: executing program 4 (id=3025): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000001180)='cpuset.sched_relax_domain_level\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000280)=ANY=[@ANYRESHEX=r0, @ANYBLOB="7068a1609232f389d3b312d14ff68881a7519f7eda6031c430a66df3cc292d82", @ANYRES32=r1, @ANYRESOCT=r0], 0x27) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) ioctl$BLKRESETZONE(r2, 0x40101283, &(0x7f0000000180)={0xdeb1, 0x1000}) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000080)=0x0) getresuid(&(0x7f00000000c0)=0x0, &(0x7f0000000100), &(0x7f0000000140)) setreuid(r3, r4) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000040)={0x101ff, 0x1, 0x100000, 0x1000, &(0x7f000026b000/0x1000)=nil}) ioctl$IOC_PR_RESERVE(r2, 0x401070c9, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1, 0x22052, r2, 0xfffff000) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000240), 0x202040, 0x0) 3m17.443876704s ago: executing program 4 (id=3026): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0xa, 0x2}) mmap$binder(&(0x7f00000c0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x10}], 0x5b, 0x0, 0x0}) 3m17.387019524s ago: executing program 4 (id=3027): ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000080)={'syz0\x00', {}, 0x0, [0x0, 0x3, 0x403, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x10000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0xfffffff8, 0x3, 0x0, 0x79, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x47, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffc], [0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x351e, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x8], [0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x804, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0x100000]}, 0x45c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x3265a) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000200)={'macsec0\x00', &(0x7f0000000100)=@ethtool_cmd={0x26, 0x488, 0x6ec8, 0x2, 0x4, 0x8, 0xd, 0x6, 0x4, 0x8, 0x7, 0xfff, 0x101, 0xff, 0x3, 0x10, [0x0, 0x99]}}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') write$selinux_load(0xffffffffffffffff, 0x0, 0x2046) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b100a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) read$FUSE(r4, &(0x7f0000000f00)={0x2020}, 0x2020) r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000240)='asymmetric\x00', &(0x7f0000000180)=@keyring) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000280)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7, 0x1, 0x2, 0x4, 0x4, 0x8}, 0x20) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r6 = timerfd_create(0x9, 0x0) timerfd_settime(r6, 0x1, &(0x7f0000007000)={{}, {0x0, 0x989680}}, 0x0) timerfd_gettime(r6, &(0x7f0000000040)) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r1, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000580)={&(0x7f0000002f40)={0x142c, 0x0, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@ETHTOOL_A_PRIVFLAGS_FLAGS={0xc, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x8}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x1c0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x7d, 0x5, "ddcfc4db0699170e7d7a5bb76dd34d82e8d5073fc5e2469ff9d301025d634887da00c71d9d37ad2025fdcebd170d9ce0f2975a37514054fae0e833411b9308a9f3cb410099abf4eb66d3f6c0086f0c03fb9b54b6b4e96a684773bc4e71f267627b322670644c81972641ae273f5b867b39e0ef8f0f6410c8ae"}, @ETHTOOL_A_BITSET_BITS={0xac, 0x3, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '\'&(\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x87}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, ':\x00'}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, '+(%!\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xffffffff}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '\\.\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfffffffa}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8000}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x974}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x4}, @ETHTOOL_A_BITSET_MASK={0x22, 0x5, "b4096e445c49eadf3f0dee0721fc8685eaa17b436028dd522f68cd4174f1"}, @ETHTOOL_A_BITSET_BITS={0x64, 0x3, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x11, 0x2, '\xc3)\x14:@]^-*]}{\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5d7112cf}, @ETHTOOL_A_BITSET_BIT_NAME={0x11, 0x2, '/dev/rnullb0\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1000}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '&&$\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x10f0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x101}, @ETHTOOL_A_BITSET_VALUE={0x79, 0x4, "397093c3da42755c2dd0544723ea2e626c89d70a5a30bd6f5e53339a733b51401b658247b89d561a8ae71394e0bd3ce2d03e401111944afbd6ea67bd651e0958f581ce5fe6c4ac09493975e33179606d823c6488aa466e37033688c5b8b1087ead19b787195cd8bf3fafe3725c2a5effe68de0807a"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1000}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xca6}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x9}, @ETHTOOL_A_BITSET_BITS={0x3c, 0x3, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '-\'-)&,].\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xcb1}]}]}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x101}, @ETHTOOL_A_BITSET_MASK={0x1004, 0x5, "d316042337df95712e012b55bf02f3d49be9a90cb79ee89b15f152305db51cb6ba20632f79e70f1a4377100ab5358a59b565062523a7a4537890f7c0171597b24c5b41406b6e3f0059676fa3fa75bb55204bb29f4b4bba9591e8b75c3a919de2a679c11f4ddbf70497c6264be0e03c36695dfea5a25f0f6a33afe21c3269420d64e112b6535aeaf16fa1e648c6ba29655ac8d4f161203c57bf0320ce01909c91f8b3e17b6f2b012e7d7412a61d6024d2227085efb7889086b687cc70c7a98da5236fa02a3d3d6b7e10ed2337a6d4417f172492a9ba9e9841891f800a58c8367b8c1ad5c307b9d82550c1ab3094e7c3c05a37e7e27adc2bf217413ef88f890f65f88f74bf9d17c6e7b6dd5c2c40b46980c3c31da554a8db6075338b8a798518db7dc6e6ddbf5c509964f82f09c509b99d202358757e6b5f10a299378db820a5182a8784f6b0e1dd781cc95ca3e45e0b283f0cffb679db0103da9bdccbd1cac903780b79140bd422c5efc2a527bb8dc53756e2cb023bb25d3ebc341d41d5c7f4d1162699e075e09f207cc7fadef31cd0ff7383ea6aacd42949d8334df09200300c97d42942749e84c402057158d138196249a9bb5f2988e38947da4dd2e6cd43972e4cce85d6446910000578c0c0b1f0fe0bd92e93883fa869cb1b7d63192e6b5dd0f0b295d123669e1cbc4c0413577f462adb07707fca02b4d43da961c2f86ee5ab742a3e9fcfe990eba82de7320ea115cb12c43de6180dab4892d8579473a70986ee851c0c4607902240a91a2d2ea41a76616f51395b569215f7175444e7dfec6043fad914bb8d1ffee02ae5c89925939dc3f6644eaf60912745dc48673455df3f432f37960f4d2f0406f09ccec49f64ec221731b2f47037b742f303dcd7437f58ba1145e94acda0b5cd3ed3766021aa371c4bbd881a3418b0738711f38bcf1d5ab5c455d8ecd582b147d747654e5650584974748d2e3316acb961abe96f1bc0dc0bc8083a208d7a506e252db22303adf42df270e4e5af9cc0e222aa2902be55e01d9082ee7231180ab263441e4294c525a4e213b50e7b25a13d8a4e94b0e977f90b56769c80f88029e7e4c6c2e6ca91563163e1c730559f17b719f591bfb4c4856c3c017a51971d986bca7f2cd5f3bf2e199840bba48790afa24a01e264a930344b25760a1281a653c128ac3b07a83a23482674b53fada4603dd8b96ed7fe1e231283937c1497176f83721cfcd1b419a25de984df726fc36390906a21e69f1c2bd300d68e038ed42fe74bb80c967564a2b02f90b1495a6f39ed5bf7f41b794c31bb12fc9e659250e10c166b70ffb30f2a5a6c3e31daefaf1d8e12a8122e51cf5bd25e7f48aff423d852e11c39aea771a2a70e04bb985e49af6eb0fbf4a7f419d48d0e675183052b64bac015c7fa0232d9ca873c5617bc094b58a2f6454e4f2c9a4ee656b239d37d2b13965c86ae123321b56b7fff800a3f5a76b9cb93067ef9dd24b63925304156a58f78daa682bebf9eb3ffc44123ba623916cfe4ae9732c3b0e0ae69642143a44cfca65e5962aad30b3cbca4400dc755e4fd23eaa5aaed53ae4e86c6449fcf994d8e240ac80fedca31e84f69ac89c0dfaa47db0690a4da3b082879f5cae60291040caabe98c501167e9a243932e596a4cb473b8f9fec82d5a89d8a444b3e68595064d223911aaf1610271f60acfff6b996bd557ea0c5dff3525991024d7f0af4b50e2ae16db2933ef173041074b8e7ac65cc56bdf37d2eff2cb4edf74e88381417ee41265b16522b361f4a9681859cb69eebccb4a196185de79d2060292c996d5023a008449b9fa8760ec27485e6507f378cbf7fcba16eee3eeabea5a08cfa5aae80a36cee97b37227cf959a1fd5cd0138c83aa2dd65d89edc2e35ee36723bc4149d5aed26425d586892f46477df47e4e2d74a3b0e43daa3df62b25925388df13dc8c3e5d1703b4484112f4ef69a3ee7516783b6ca7cd472376deacaba44a7594b75c607dc83640954a06935995277b2344e0e8c2241f53662a4112f4cb38ce965f4f476974726a61dce123f83f9e3c996281d40fa8f38d32993bb9b754317653d09da524f54df81503bde7174bd436d8446794cc80ccfbf11f1499314028c1793b184635468e1d1af5b449e41a9f8710173e53542d46283e6491ce9fb14d67ec2b5573cb354a542b753dc523a18dcb7fc63cbb337966afb7bd48e0b237a0928d218a9f92e731310964cee7a3dfed6aac85e7c9813e2b087003537e61e240031bbf9de019ddf98b168636b8c05f27b871db7939f3c766ff8a64fe9a69e4a5d72f87833d0e92076fb594ae2b2d92f78e867f69357eb506a19683a4b557f37f0e477ca412a38893b722637322bee74a6e06f1a59749f0f4614e9030acd56ddf7c4aedaad68efcd1501721f48523c140970e788df9921859bd4f4a49456de53923157bb33e650e85a6abb79fd68253523c2ad18106af72a90e7aaca31a958774e477a2e051112c9234e5a362b7b78aaa7585fce41244fd63e8a6e3aa090ddaa0349d6d496764ff2eb73ab06aac8e9f1ce6d3c1834f7029248f89b495629d1440c91c627443866cad45b6e80e503c40a266ff428d69d765d723fc484443d027613ee980a85d7af650de7a74bcbb96bbada9f1d87ae7f98b53d7f4f89c394b89f60cbaabdbfd83bdc1fe50669c36e8deeca95feb8f8ff72570fb5e518f0823ed48a27680b6281ef9ec291e8fdd56a2a4c3829acb16c1e90102718a15b25699d2a39bb7dca0880b7fc67aea7dd6882ad9dc2d99bf815bbabc970f46324786e8bca054639aa6eb0095cc91fe623f28af01d3be498db72fe63245a91d7a543b8accc8e6e387420eced5b33e58714ffcbfbcf29829689bb285308ff85f26b65772f04940d4d5345d96c757d5b5880792489c0739a72f314910688c5150667a21f0c01570c76166b844ce11498347abacbe614b191d83f730c45358ae64db713f9055122b921798c2a06582f229b092386e7fbe815617e40c7ac12e9f330c335c6ce42399d5575c462d43ef7f5d22bdbfead94575c2f7670f66ea5d79ab99574e6e996179daea8b127728568a601d3922d81157e5385e5a47564a025c3c620e4f48f2b7ef4238ab209fe28c2907c0ce72a5c18b15773116945f727f40efe908407cd0b10ba52cec9ffdc21c4ca3e45d7519e04b26c3ccd0259017375325a327871c2e101b2aed906aa879f9780c90ad0322d53acfe8992e9bffc34701de891e156a8f394d85d43f1aaf5690971a53bbea28c38757b952cec665f074a7200ecd758771cf1cb55a5da657961f2808e04cfc7552fc40524868162aeddc8bf6265231342355c2cbfde5186d66983e41d79338ba4adaa8188639ddb0144e29d5c3b990030ea44bee9f7f58fba988595fadb8b1eb89caf75b68a6cc6f51c36933e2955ac42ba261d8373afd6c14301461a9f9839f10f060cc685452784e4c42d2a461094a49403165e0abd53db7187cd0e92d950af6acb9c7cd1094bbe3ba8111940a1a0cabce45c1432e9a521160cfb77c1ff11f698a00f734ace3b57ebd6a9e22ec71525282b1a789f4ff1f7c3045e30309da3befa0aad641af796bbaeb738dcee736d5c670f2ac89112a0bb64e317fb51148ff46acc2fd173fe9d73665d6d961da9496c917faf2604ddf6c329273195f277c876b3008aa6c8a43d8ad4f3ca26d2bc7c93e49efc7945726fbde2c24fd361301ee36cb8f2b57a06a48ed5ef765082f1629039baf7d4cd3c0a517fa03a1ed65f23c1a384b6b2fd89fb187fad8cfc9cfb972010a8258c210eb9a80ab46a0df9f43bc1f44bff5cf780f50c4b294efe2e989e8a14c8288552b04b80b3075f364dccf7908ca964959ed26965c565b8904358a792e80821114034dd89b5307a3df43e4e34211913d38529574af9b1c690eca8e8a80d354fb7247141c0bf91d87d745c492aa47cb0ff1c14b3911d86cb7e15242cce3def2e381624f5bf7e3f3345c419cf860ebe823b32d70ac7b072e1a87f58e19a04241ffe9a72dbbf37309cb26d6f474d1efebc7c295dde69395b82630e6439a97765af63ad732bdc2155bcd4f704eacf40e2278e62046fa42effabe1b5b8d81277441535a625fb0d984794b10e257d9b05b45023c1349c129bf1a027f62ed73fb36eda5c8c63035d0b003b90cc6450c7e415cdab0d83bd9670ca16cf300c36701d200bddae7d565e903046c831b93d4b3495518b232eb1906251639ad04dfde2d44a925c8a2e8c02ea5a5f931b621044415dbeab7e0729f9bf486fa492a181085b3f9d87835ceb9a4b3fcc6528259af8af1afcd4fc4cf62585edbc1f8d0900dd2ebbdabbbc6ff02419ea955d5865d39799d96bff4161e33167905973e664e48c6a6bd2b524d7f821d4abeaa3a7914e793b139869ccd6c9c696e113ca7a8395707839765bcb1b55a26e988cb300b22334b425cac95b442eda945a32aa48656051de6aabb9a103c0d38745fafcf545ac42dfa61588344498616b05ddb15b57920e1ab4db5401b8f8c539cd87939fbea58a403d15a300caedd850d5270d4d48f73565e08e121e7d419f58c09d78ff4ff0a32910d586e3520c2b4e0680c9b9944976052b6a1fc82e7f30319d7039f9f30fa1678bfc90e585460caf7656fc8eb38220ec66e9e0b937b033ae29556998ce6375535a9b9507796836c49a3dfafec6b0aec0d7a04e8448cdaa2ce42309ec859a8d879250788d26d5b589d17bd8b6fff7bc9fbaeaac331eeb9962e2cd4db2349905a67e3f58df7c21f1d29a3bd74b90395caf8acabdda0d9789586f5e8727c3ae39ec293993707fad73293a16a1d72d806023e25de1ee5103ad19c89ff6c418eb6f0f61a5dd90abca704569ed7a54d7e0b067fea4b0fa0f03d09207b84b21a2a4b10cd63104b1df213120bc3095f8d8681df0efa1c3162ba70f2d0caa1e12371837178c6ff0178e216f9f03a25330d86167e73e457cabdf60a473e2b88eef36304f2a564f2c5364401b22d2c56768d133c21042e789f3e9e3520ceb072260df7a6636ba12f76377ce20fdc4f98676cf3e80965e3849125ed8f8670b626fb43b12e4431262c47c36d92ffb907ff357e9686ed719eedaa61a29c00fe965973ac643381a5e6668b45d18aae2d18660ef333cf5444305c2b4ca176d319f0064fde588e977ab5fc70ad1331c76148eec9128a1dcf4c6e4f60360a4c65ebe976e06abc41a398fe29f43d1826b3d723b855ba8a556dae216cab589cc9f1b300c950ba3501bc4ff677187c4d699b1a5d232cfb6131dea8332fd1f068190c9ad6f31481b0c1d42bab9fc0744063b6960b7f3837289f7a2c34610f4d761a8b599009898dd1a400efdc67ac04340ccaa519413e581444b0406aa51e44b297ae8a96564260d5b73ff25e5e853e1c1332733f9546b5814df47c4cd3174a51627e19b3df9d5667268906ce41b9c1f8926fee7d51b04feb11810ae312af2fc670acd6cc979e7668bcff9d4aad460ed26d93666e5f44abde7309f033e20a06490c6d4383a1e2e52a9904fe0d90d3c1c01db086f9afe2bad9449c017fae310d77b60019a1e7b722bb5286f453f721dd8162e97d9974d6efe6864d5243b16be2e6ae44e0bc0eebaf5ad4bd5193af546d67b9f3a57075826450000a68ebc427f1f4e2f08102cfaf67defff462417a27ccc7aaacae04e475ec87b3000a09ba84d0bf2200308567b0b6fe1995847a0d6bbbf47a712a314556f798d813eb2aec18ac314d2d4629cb5b68a335121350a5c30067d4a36193f"}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x118, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x40}, @ETHTOOL_A_BITSET_VALUE={0x30, 0x4, "6cb6b5e4bf9515b62b83ef6ed136cd5aa6d6e890fafdc3fd08b675c552344edc6e60da848f321789dc92d332"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x8}, @ETHTOOL_A_BITSET_BITS={0xd4, 0x3, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, '+{^-#[}\x00'}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x33}]}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xa8f}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x13, 0x2, 'key_or_keyring:'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, ',{+#\x00'}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xc816}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xfffffff8}]}, {0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1499}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x57c37cc9}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, 'syz'}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x10, 0x2, '^$.#$,/).-*\x00'}]}]}]}]}, 0x142c}, 0x1, 0x0, 0x0, 0x24000000}, 0x804) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) sendfile(r0, r0, 0x0, 0x7ffff000) 3m16.503437548s ago: executing program 4 (id=3044): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@flat, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/10, 0xa}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0xbc, 0x0, &(0x7f00000002c0)="92d855e4f7b5ba19c5c906553c45b74e6cbdff74288d0867a79cd0e51cf71bf82b4b3ac1d684e8fea9f4cc7a6f29b1170745aa55aa895fc41a0bc493bf73c3488bd3f6e3e80ad5797f12ef7b431087ce83074ee7eeaf39f30453a5305ce0c97ef0e90a4bc6aab1e9e064fe43873ef36dd057cb757dee4ff3d36144289836ebbcab03f05a4e3318ce1e68c4c164c7cede8a6315e4227dd95e25f5fc62267caad1b968cba9eed1e7c606e48e3906ff68dee5c175023ba9b24f12c305a2"}) (async) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) shutdown(r1, 0x0) (async) read(r1, &(0x7f0000001340)=""/153, 0x99) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) pipe2(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80080) bind$pptp(r3, &(0x7f0000000400)={0x18, 0x2, {0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x1e) (async, rerun: 64) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (rerun: 64) r5 = dup(r4) setsockopt$inet_IP_IPSEC_POLICY(r5, 0x0, 0x10, &(0x7f0000000b80)={{{@in=@loopback, @in=@multicast2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffe}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {{@in=@multicast2}, 0x0, @in=@loopback}}, 0xe8) (async) prlimit64(0x0, 0x7, &(0x7f0000000300), 0x0) sendmmsg$unix(r2, &(0x7f0000005400)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)='+', 0x1}], 0x1, &(0x7f0000000880)=ANY=[@ANYRES64=0x0], 0x18}}], 0x1, 0x11) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000000), 0x4) setsockopt$inet6_tcp_TLS_TX(r6, 0x6, 0x1, &(0x7f0000000040)=@ccm_128={{0x303}, "56d10e10a79fee68", "ea9ac2748bdae5448838b66150a6f2f6", "92148099", "e514090beb6517b3"}, 0x28) 3m16.351961839s ago: executing program 4 (id=3045): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder0\x00', 0x6, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001200010a000000000000000007"], 0x14}}, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'vxcan1\x00', 0x0}) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r3, &(0x7f00000000c0)={0x1d, r4}, 0x10) sendto$packet(r1, &(0x7f0000000800)="15ae2ae4271457897324e5a016da2aca81294dc01247337a20551083fd41bee844037b72768cd92d60559841d532c433dddea251775525f7886065ffc3225b2021c883e50d2e35eb4fe238a3bccb840fbb5e559ebd6777ea52abfdb4677f8082ebb63a17d0eb4b5eda6b205e6bc106130795592a58beea9826f5b826a352966fc8a1827ae60a15e17abac0f8e4b1c2656853b44b7d7dc5bfec7fb3011959c4dc9aa74fd98cb97f9904d8aa1d03cec864e33ad29fff33ce969eacc0d015360277eaaf849e00f6819e36b993cff2c94d0ab93df3db772a50ede1b62b0b0b0d7f5216a0b157bdc6f3825e6a6b8304a898", 0xef, 0x4000084, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000780)=[{{&(0x7f0000000040)={0x2, 0x4e21, @remote}, 0x10, 0x0}}, {{&(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000300)="e710936e150986e09312e27ace3dc9b8f81a28ece7c4bc2a125f4e5920f012d2fff61a4b1ae0f0313199a36f73f0f5a61681b3381ba7c2c1dbb56d8d842c35a1ef8a45c643d06039e67ae03bb544d05f65e6ed0f071907ac58231df8efafc291154951ee5f06daa74c49e3c637cbd2d47b9b97c5a21092b1e8cf34f445afc20035b0fc6e1fe338dd07c991eab1762213b60e2a567764a038c78ad9c95b51a9e76167c71f4c663d4f38fdefc41bef94e6cf01ea62ecd4418353e9dbfeba243d8789f5fd41d10c2bd88370e8f8ebf207625ac35684c0f86a34a2a1c6e21a4fc3de45c9bab393f714c8169f311439af39", 0xef}, {&(0x7f0000000400)="9fc8b944354e147660b3546fec3b3e142b068fce1c53d1211ea4047b4a042f19761d51c5696eae302599c420da8c8c3016ce0d5cf050f840ba6861edc7db897084a448486d8aa5cbc89a51690635c313cc7e4639f6b02926f4bbc5e099e718474e3eb0595ff77b7df8831085f976aacf163a027e33c646b15f4ca32407ca892595", 0x81}], 0x2, &(0x7f0000000500)=[@ip_retopts={{0x114, 0x0, 0x7, {[@noop, @timestamp_addr={0x44, 0x1c, 0xf3, 0x1, 0xe, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x80000000}, {@dev={0xac, 0x14, 0x14, 0x20}, 0xa}]}, @ssrr={0x89, 0x1f, 0x8b, [@remote, @loopback, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @private=0xa010101, @remote]}, @end, @generic={0xc6, 0x2}, @cipso={0x86, 0x8, 0x3, [{0x2, 0x2}]}, @lsrr={0x83, 0x2b, 0x90, [@empty, @rand_addr=0x64010100, @remote, @local, @remote, @loopback, @dev={0xac, 0x14, 0x14, 0x39}, @multicast2, @multicast2, @remote]}, @cipso={0x86, 0x66, 0x0, [{0x2, 0xd, "03d9700dc49a42cf70d8d5"}, {0x5, 0xe, "14db3107f754508822d362eb"}, {0x0, 0x10, "fa3a5319ab07c3dc268fcf43edc5"}, {0x7, 0x9, "1fd080f8abb564"}, {0x5, 0x8, "c6c1da3ef290"}, {0x2, 0xf, "26950b7f3cb5f706c1a470afa9"}, {0x5, 0xf, "9f4cdb1daca1676c4d005d42ec"}, {0x7, 0x6, "8d56da17"}]}, @ssrr={0x89, 0x2b, 0xf2, [@rand_addr=0x64010100, @multicast1, @multicast2, @dev={0xac, 0x14, 0x14, 0x23}, @rand_addr=0x64010101, @local, @local, @multicast1, @local, @local]}]}}}, @ip_retopts={{0x88, 0x0, 0x7, {[@cipso={0x86, 0x2e, 0x0, [{0x3, 0x8, "c0ba92fef797"}, {0x1, 0x12, "03497689ac385f9f060fc570cb191666"}, {0x7, 0x3, "e4"}, {0x0, 0xb, "4eaf3d4684370348b6"}]}, @timestamp_addr={0x44, 0x14, 0x81, 0x1, 0x7, [{@loopback, 0x6}, {@multicast2, 0x2}]}, @cipso={0x86, 0x14, 0x3, [{0x2, 0xe, "656024e9bf9cb3b4ce82e5aa"}]}, @timestamp={0x44, 0x20, 0xbe, 0x0, 0x7, [0x1000, 0x9, 0x1, 0x200, 0x7, 0x3, 0x9]}]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xf7}}, @ip_tos_u8={{0x11}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x10}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @empty, @remote}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xf7}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @multicast1, @dev={0xac, 0x14, 0x14, 0x25}}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x8e}}], 0x270}}], 0x2, 0x240040c4) socket$pptp(0x18, 0x1, 0x2) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000240)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x32}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x20000000029}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1}}, &(0x7f00000004c0)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 3m16.253589701s ago: executing program 34 (id=3045): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder0\x00', 0x6, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001200010a000000000000000007"], 0x14}}, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'vxcan1\x00', 0x0}) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r3, &(0x7f00000000c0)={0x1d, r4}, 0x10) sendto$packet(r1, &(0x7f0000000800)="15ae2ae4271457897324e5a016da2aca81294dc01247337a20551083fd41bee844037b72768cd92d60559841d532c433dddea251775525f7886065ffc3225b2021c883e50d2e35eb4fe238a3bccb840fbb5e559ebd6777ea52abfdb4677f8082ebb63a17d0eb4b5eda6b205e6bc106130795592a58beea9826f5b826a352966fc8a1827ae60a15e17abac0f8e4b1c2656853b44b7d7dc5bfec7fb3011959c4dc9aa74fd98cb97f9904d8aa1d03cec864e33ad29fff33ce969eacc0d015360277eaaf849e00f6819e36b993cff2c94d0ab93df3db772a50ede1b62b0b0b0d7f5216a0b157bdc6f3825e6a6b8304a898", 0xef, 0x4000084, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000780)=[{{&(0x7f0000000040)={0x2, 0x4e21, @remote}, 0x10, 0x0}}, {{&(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000300)="e710936e150986e09312e27ace3dc9b8f81a28ece7c4bc2a125f4e5920f012d2fff61a4b1ae0f0313199a36f73f0f5a61681b3381ba7c2c1dbb56d8d842c35a1ef8a45c643d06039e67ae03bb544d05f65e6ed0f071907ac58231df8efafc291154951ee5f06daa74c49e3c637cbd2d47b9b97c5a21092b1e8cf34f445afc20035b0fc6e1fe338dd07c991eab1762213b60e2a567764a038c78ad9c95b51a9e76167c71f4c663d4f38fdefc41bef94e6cf01ea62ecd4418353e9dbfeba243d8789f5fd41d10c2bd88370e8f8ebf207625ac35684c0f86a34a2a1c6e21a4fc3de45c9bab393f714c8169f311439af39", 0xef}, {&(0x7f0000000400)="9fc8b944354e147660b3546fec3b3e142b068fce1c53d1211ea4047b4a042f19761d51c5696eae302599c420da8c8c3016ce0d5cf050f840ba6861edc7db897084a448486d8aa5cbc89a51690635c313cc7e4639f6b02926f4bbc5e099e718474e3eb0595ff77b7df8831085f976aacf163a027e33c646b15f4ca32407ca892595", 0x81}], 0x2, &(0x7f0000000500)=[@ip_retopts={{0x114, 0x0, 0x7, {[@noop, @timestamp_addr={0x44, 0x1c, 0xf3, 0x1, 0xe, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x80000000}, {@dev={0xac, 0x14, 0x14, 0x20}, 0xa}]}, @ssrr={0x89, 0x1f, 0x8b, [@remote, @loopback, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @private=0xa010101, @remote]}, @end, @generic={0xc6, 0x2}, @cipso={0x86, 0x8, 0x3, [{0x2, 0x2}]}, @lsrr={0x83, 0x2b, 0x90, [@empty, @rand_addr=0x64010100, @remote, @local, @remote, @loopback, @dev={0xac, 0x14, 0x14, 0x39}, @multicast2, @multicast2, @remote]}, @cipso={0x86, 0x66, 0x0, [{0x2, 0xd, "03d9700dc49a42cf70d8d5"}, {0x5, 0xe, "14db3107f754508822d362eb"}, {0x0, 0x10, "fa3a5319ab07c3dc268fcf43edc5"}, {0x7, 0x9, "1fd080f8abb564"}, {0x5, 0x8, "c6c1da3ef290"}, {0x2, 0xf, "26950b7f3cb5f706c1a470afa9"}, {0x5, 0xf, "9f4cdb1daca1676c4d005d42ec"}, {0x7, 0x6, "8d56da17"}]}, @ssrr={0x89, 0x2b, 0xf2, [@rand_addr=0x64010100, @multicast1, @multicast2, @dev={0xac, 0x14, 0x14, 0x23}, @rand_addr=0x64010101, @local, @local, @multicast1, @local, @local]}]}}}, @ip_retopts={{0x88, 0x0, 0x7, {[@cipso={0x86, 0x2e, 0x0, [{0x3, 0x8, "c0ba92fef797"}, {0x1, 0x12, "03497689ac385f9f060fc570cb191666"}, {0x7, 0x3, "e4"}, {0x0, 0xb, "4eaf3d4684370348b6"}]}, @timestamp_addr={0x44, 0x14, 0x81, 0x1, 0x7, [{@loopback, 0x6}, {@multicast2, 0x2}]}, @cipso={0x86, 0x14, 0x3, [{0x2, 0xe, "656024e9bf9cb3b4ce82e5aa"}]}, @timestamp={0x44, 0x20, 0xbe, 0x0, 0x7, [0x1000, 0x9, 0x1, 0x200, 0x7, 0x3, 0x9]}]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xf7}}, @ip_tos_u8={{0x11}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x10}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @empty, @remote}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xf7}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @multicast1, @dev={0xac, 0x14, 0x14, 0x25}}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x8e}}], 0x270}}], 0x2, 0x240040c4) socket$pptp(0x18, 0x1, 0x2) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000240)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x32}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x20000000029}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1}}, &(0x7f00000004c0)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 59.651355266s ago: executing program 6 (id=5658): r0 = creat(&(0x7f0000000040)='./file0\x00', 0x8d) read$watch_queue(r0, &(0x7f0000000100)=""/239, 0xef) mount(&(0x7f0000000200)=@filename='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='securityfs\x00', 0x1880c0, 0x0) 59.635381186s ago: executing program 6 (id=5659): mkdir(&(0x7f0000000000)='./file0\x00', 0x2) mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f00000001c0), 0x800020, &(0x7f0000000180)={[{@huge_never}]}) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r0, &(0x7f0000000980)={0x2020, 0x0, 0x0, 0x0}, 0x2020) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) pipe(&(0x7f0000000100)) (async) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tee(r2, r3, 0xf3a, 0x0) setuid(r1) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x10, 0x0, &(0x7f0000000080)=[@request_death={0x400c630e, 0x1}], 0x54, 0x0, &(0x7f00000000c0)="6919204bc22118e2db702c25163ec3d764e7ffdfdaabb24897907168d83f5defe70ae849fdd11c9ca332005c5d8c5d0b3ead6eb03f6a4970cc6469acd39428b830db9fc113468654ed59f384c8fa24ae6a44749b"}) (async) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x10, 0x0, &(0x7f0000000080)=[@request_death={0x400c630e, 0x1}], 0x54, 0x0, &(0x7f00000000c0)="6919204bc22118e2db702c25163ec3d764e7ffdfdaabb24897907168d83f5defe70ae849fdd11c9ca332005c5d8c5d0b3ead6eb03f6a4970cc6469acd39428b830db9fc113468654ed59f384c8fa24ae6a44749b"}) 59.563470617s ago: executing program 6 (id=5660): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000780), 0x0, 0x0) getresgid(0x0, 0x0, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0x1ffc, 0x1, 0xf440, 0xffff, 0x16, "feff1aff01000400"}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$unix(0x1, 0x2, 0x0) bind$unix(r3, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r3, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000700), r1) sendmsg$IEEE802154_LIST_PHY(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x14, r4, 0x100, 0x70bd2b, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0xaf09550cf70da353}, 0x0) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs2\x00', &(0x7f00000000c0), 0x1000400, &(0x7f0000000240)=ANY=[]) 59.561504507s ago: executing program 6 (id=5661): close(0xffffffffffffffff) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="8c0100001300e9990100000001000000fc000000000000000000000000000000ac1e010100000000000000000000000000000000030000000a00303000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000900000000000000000000000000000000000000000000000000000000000000000000000000000001000100000000000000000000000000feffffffffffffff0000000000000000000000000000000000000000000000000001030000000000ac000700fc020000000000000000000000000000200100000000000000000000000000004e2300074e220c6a0a00e08000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="040000000000000000000000020000000000000000000000ff0000000000000000000000000000004d0000000000000009000000000000000000010000000000421a000000000000fcffffffffffffff0800000000000000060000000000000006000000b26b6e0001000002000000000c0015005a073500010000001c00040000004e234e200000ac1414aa00"/152], 0x18c}}, 0x20004010) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) (async) unshare(0x400) r1 = socket(0xa, 0x3, 0x3a) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) (async, rerun: 64) r3 = open$dir(&(0x7f0000000380)='./file0\x00', 0x400c0, 0x101) (rerun: 64) mkdirat(r3, &(0x7f00000003c0)='./file0\x00', 0x80) setsockopt$MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f00000000c0)={0x3, 0x0, 0x0, r2}, 0xc) setsockopt$MRT6_FLUSH(r1, 0x29, 0xd4, &(0x7f0000000080)=0xc, 0x4) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) getdents(r4, 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='debugfs\x00', 0x0, 0x0) (async) mkdir(&(0x7f0000000300)='./bus\x00', 0xc1) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000400)={[{@metacopy_on}, {@workdir={'workdir', 0x3d, './bus'}}, {@volatile}]}) (async) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) ioctl$TUNSETNOCSUM(r4, 0x400454c8, 0x0) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) (async, rerun: 64) umount2(&(0x7f0000000100)='./file0\x00', 0x0) (rerun: 64) r6 = syz_clone(0x144811, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r6, &(0x7f00000012c0)=[{&(0x7f0000000080)=""/152, 0x98}], 0x1, &(0x7f0000000000)=[{&(0x7f0000000200)=""/189, 0xbd}], 0x1, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/pids.max\x00', 0x0) r7 = syz_open_procfs(r6, &(0x7f00000001c0)='mounts\x00') clock_gettime(0x3, &(0x7f0000000040)) (async, rerun: 64) mount$binderfs(&(0x7f0000000140), &(0x7f0000000180)='./binderfs\x00', &(0x7f00000002c0), 0x44, &(0x7f0000000300)={[{@max={'max', 0x3d, 0x7fffffffffffffff}}], [{@appraise_type}]}) (async, rerun: 64) read$FUSE(r7, &(0x7f0000000980)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x160e) syz_open_procfs(r8, 0x0) 59.178457882s ago: executing program 6 (id=5665): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) bind$packet(r0, &(0x7f0000000100)={0x11, 0x19, 0x0, 0x1, 0x0, 0x6, @remote}, 0x14) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) ioctl$TUNSETOFFLOAD(r2, 0x400454ce, 0x1) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'pimreg\x00', 0x1}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000340)) clock_adjtime(0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x2) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_subtree(r3, &(0x7f0000000080), 0x2, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, 0x0, 0x0) connect$inet6(r5, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) stat(0x0, 0x0) rmdir(&(0x7f0000000140)='./cgroup/../file0\x00') r6 = dup(r4) read$usbmon(r6, &(0x7f0000000180)=""/107, 0x6b) 59.141978083s ago: executing program 6 (id=5667): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r4, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000440)="ea", 0x1}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="14"], 0x18, 0x81}, 0x4c800) setsockopt$sock_int(r5, 0x1, 0x22, &(0x7f0000000100)=0xfffffff9, 0x4) recvmmsg(r5, &(0x7f0000002380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2120, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) bind$netlink(r2, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfc, 0x4000000}, 0xc) close_range(r0, 0xffffffffffffffff, 0x0) 59.083406034s ago: executing program 35 (id=5667): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r4, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000440)="ea", 0x1}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="14"], 0x18, 0x81}, 0x4c800) setsockopt$sock_int(r5, 0x1, 0x22, &(0x7f0000000100)=0xfffffff9, 0x4) recvmmsg(r5, &(0x7f0000002380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2120, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) bind$netlink(r2, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfc, 0x4000000}, 0xc) close_range(r0, 0xffffffffffffffff, 0x0) 4.851284988s ago: executing program 0 (id=6258): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) (async) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x2000}}) (async) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x2000}}) close(r0) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', &(0x7f0000000140), 0xc802, &(0x7f0000000180)=ANY=[@ANYBLOB="646548cfd6a666636f6e7465", @ANYBLOB="e37e98641209e5c7eab7d5d458b3ab07849efe06cb6591092961688f5d0dc27e679869015238880d047b5e654f679182b1311406d8ae6453541b903f5bcc97ae70e023c19d92b15bdf22ba973a71c063cbddb4d5b7b9f0085da5c1ff5ba6ee39d4fddb3fa53ca58e9e346f5276130e5ee6607037861d4bf8b9a57004323f0ddeeb6d8f2bb31f489ecd159166f15d939ba7e0471f83abd4c8c493332d63cf289e5d2203f4a903a3be1c421c3c717ce3798c2bee131a42645beb0180969c79bbe9bc0b10b625689154d5b8a8f71c9187f6010e7b1305972e950c4a86a2a0bdeefa45f5296f18c684fdf76278ad7054a248c0155a7b4412bea31af9dde56e64b6dbb4504f0abd4b3280c2e065ba451f6d1e391141c4c989e48f8ab8caf139aab947213054fdddbce82b1f241023f17683cb4f6fd174a120852fdf12d02d2f505836001cc47d843844f4566df77ce308f3fa7abc60fc66f63e646c804da72117c66527308ca94ef56f9358392da8775a5c6746b1144e9e4a0802d943eee634ccbd3be38e89aa62190645e7a755684a87f052b26766ced96268004b9375a85897eedae190944ef7e1ac66e91f41752a66b88b337492a10bd6a360a7dd1c25a0a8eca1c22d046fe74da957d2d6cbcda7b2b341399b53b9853a8c0c819e96c35df23192e9f09a7d21271ef7721232a2148c0160adaad2d691990377a4d7bf1966955c8874b3992125539da3285ef70e97e8b077491a8fe0f3ba68ba4e73404ab634015f3b7ee3d6ff6622555f06b3cb9b15261af3dd645caf8f0866d4c1a572bed872da96e77a23f620594beadfe6a9dc64ba110b1762ff1eeab05e01d318db1605bfd779132172064bbd291b4154a65bcc1e4a042637580ee0ff99f4c0c98bb539d9c400afb2668626580d7e37a93d4ec64e6e6df7946259c76d5a6077e7b034e1366133d52903608abd4822062baf1a18fab9b895664c07e7ea090bab1f9c1c19a08c890fb338deb1654194172f9338ae07d30133648a8c334562fc43dbfe0cb5919eaec8c606d8cdd9592212048820f08ed973310f1d29f6f0e38aa53f96713c2a5e83b09f7bd9355820bac1143096490fe9b462c6b36389af88a4a8f4938853d26c8359d1b448850f3e73f76a5cdc3e2b026eb692e96e2efb2ea0e5a9548889106c0f1c4d7d22338cffc84c6e15c7602133f0f162bf36b5c37345c7c4540d933f6f615a211f4a516b733f678d5efa8424f8e9bad7ebfcebdb48e1e6338d501414407a59231514f70c1ebe05e4ba0139042934d12454870b56371f4e64d88ea6fd4f8b3175199a9dbbc3c758f4cab928dcb01e93d290f99fef29c870ad4cc7e17e22ea443eb542777b4243385396f67880e73e9d5d5282e7b33e8583fe645ff5eaeb618adec7a492782c0a52ab2586fd08440614979f6840ce24ed97ba5c200ecb6f6a077f07ffd55cda02cc1b69fd2ac85ed31552ab527d9500fdd7e6b4d982ead116b8d2ae000ce0815f70769c463b940b07d61356efd59190dc09bac84f0ed115f30934b3118d256d41d387bde08aeabd16e1f3df1626ab31d78765d5ab24e896e689128712d358ebd23dd65c3dbe0a8989f03b15d9b30cb9e67fb14492fbe35f77cd91d7511f403a4e95b1cea3762f081ddfb5d2a51d5de0e06378a29373149b10aff51a74e157401605f7413c48b70866ed3094044afcbd97df330ad078ff56c43f06d8dcb7c80a6b1c160918e52b8348229c4d9641106f030cc309cfcf3d8096f004e378dbf431762ec14c2aae6457e2f6ed388e11ecd9a4f102df07bc5e3c192f18f72a2688f02b1847d5751ac88404d05386efeadf6886216837829eb6516d874e305cb7be29172c6a1f63e056ec057b435fe1466fddc53a6f8351d8da43d4cdddeb24c82eb3a2e192dbb9dde8444602265daa0270b013806af9fa0be96d6db65dcd146e4666f3ecb7fb1eba0d9cf9ad3d7510c15cfd94c6d15faf0f2a8de35aa5849ae8f17fb051dc8e82befe511509b6ff054c4de11ff7ea3a58b4e33e246a5cd706311d262c4f783f02b4a6048c726e2bd037549d08db5a05d57cb71963880d7be56fbd3c24253d2e8ef471e9109c2a02c3b7ffaaf19eaa661e2d25a6dd6c38b144a260ce75e8c6c543d4f87152bb448befcf121380db064ff227fef089580f87d649d5b43198bbbb07e46d7dcfebbf119719505160d8640eb6f43cb3c9438695fd6a2d22a1d9b85faf0385f5efcbd9d01710f644ad1691ca144dccb877e442e7f15a72792f7060f5805a1ce1586b6d462cf2ed1b4a5d3eb2ea854c524bc50a263306dd737c2eea6723c26abc83bf61af4aa96e433dd9a1917e098c2455cb5c3e82f143bb6d0a62179a441b3164f6b094592b79ce886b1a2c9c53d3f15a4abdc88c2aba8eb5a7b5cbc54271fa20184973feb163f4ae92242463eb4b8d8e9ef981ff282227dadf3897c3df05400a9e9de72ff129a4bcd669d02a7253e8b6a1737c2104f14e40a36d4edd4d354385923eddcea2824031ed8b5938576f092048d6b86c470f2919781c4397aa2f64debaec13d2d3076c9465a28c34073a32bcd6c49cc96024bb6e77e27df4e27885d565911cd70eda312f65e3872fec841ce5f3af52ab0b426c736e62bb7879a4aeae641cd0f9de34176b315068b2df9635117063976db4e318339232b3cdb30951239f4cf910136f6394e4656d05da14d844d1efbe6609d38670a7f80472d5f6929f992a3d84f1ce09f6dd8db4f07587efff42e1d45c87de1bb01b47d40984981af381a767cbfcdbce0f1fa0afd6aeafdfb07ee55de2441756e1668e43df7188443bcc140a435b25b6edab3ee7a7ee6de89baf2337d02070daf69964ec8f28c469f26da178c96fe611462bdec502c08c5aade26a440febc9af90aa2d8e0edf5cfc7b8f74a6f0c1e41805737df1bf4fc393edeb35d1838f0f2b91d2943180a6f04bcee7d88853c80a155a18dd00aa1a8855f10d17d6be37dd4f19f62a265b285ed7d72a7f9e21be1fc2477abd55e277692e06beecf31ace9366af26ed584c205c6521d082fbb0bd0643f197a0e9a80a66d294a9354a643e36103d4d4415708bcf03a31da107cf5c4e809c01710d523e8d6e76e2811c98f76bfd7957d30e0e0c56df5b6d880dc749a32978eecd315956d6e3dffea8db6ea86f58fdf987c372416b339e122d30075187543083f70c4d6c96dd0f970b96fc861793c150c3d92cc31fd2de4c447c6349eff94510c5004062191eb3af352da384fe9cb9fcf6a30874baad72f75568f572e07741b5cf9179596dea9b751073ce12e8bef73d0b41d1c590cd318ad264c2ac34cb02fba2bea3d48ea7ed4164fa8d45174bb8c767bb4ee05d0ee830ebe67841780f3ca550637ecb317f20ade3ebe631e8383a64bd54ff12dc47e8f3d2bec6213a27cb52b2225f8753193ce66d4b5bd57974bbd31595cb208f3c3826c50c593e6f657620d47302f5a7b5f7526f4d1311c9c1eeffbcea87f7ed3cd293b37afbcc0ed62fcabf85eda5426750bf04f5c2aa61d7bbaba29be463a7fa832cf7b9eedd0b043d62668d9d8719af048ed1943adad7f8fb298869e243fe36763ad59087ca900e704e04b34eb4b31f14c020a10441649f148de5ce84d87c0da05b17002a7e520ebb59abcd52b8536b2b585438ad0dc9c2ddd0f8af02019ea8b7af8053cef4c9d66a3525b32f3fad2b7d54c2a28532862a6466e831e6673e81148fba2d6a73575d76968d6a7bdb3b0bf05274fad242f008ba69335e43dac8ac0e9453d3adca49eeabb8567da4c2a5c9331ec4554ed64dccf95f8433c850d32101146ec01465ead38d98d4c0af5376814a50fc8343378e885ba046309b60cc7fdf76f1900c32d4103bab549f61f025f3fabf87cd488e33befc1d220ca64a0a6438d2bab5b2c8ee536f5c944aa54b363ca3b8775cf725ee49518178d7186d8abdcda696a0f1885b74f96d36daa76fb17518f7566d87f3c80965435c13bfa5930e8c9dcde8eba76bdc8de2be3e255bbc5c0b483785a99ad64f07431d1e0ebeebf27d59895c893561f945d4dd451b98dfad3fc2467cdae6878a262d0f51764f128c77c1d125eb752ccc3b2a6628940086f2314abc5db16810105a6c3a95de3688ae0246bb6a6cb2b932bd8afbadb8b0c563221f0722e69589402bb6fa27423490d7540582860282a24fc79b1e280757f7c163650ffc062bb1a39bf45423a00d615eb1353675c5bc46cb2eab04c4fcccdfec2dc362d7c2f46a0f75f90054b23d380de6cd7d4eef83b5fe11af408194f963464aa51e158a2c3ca92684f15f6b34876f6269c4d19a668a646926f47accc02282103cf4a9b1ba4a4974b657bed194ab8409cb72523a96c9f7d325c94ab8020ce4ce919290924c7f2788307da3a2cc553f8903022663b59f13b26ed0bba5286eef804fedc436612d5d22cd3ebf891ace56e81552cd476af4f8d92be15d06296f264c9862d5674f14405a20f9eb01110d274d484be7dc0376cb6a053a8c4d32a1b407577e687836759602b639fdaf56597c12a273d616b06cf47651692967f05f0d2c16a808b989ad07b5afcd049046d90c501d9279705d89273a295fcffedc1952b1262f08b7b5c50035610a479fc479ee8180970fa20be215c7cb76a41658076c2bab22cb243c50ae5e95e308d2681b645bb966327b75ffc942fb44a1b3e2b6d1bf5fed080829efe605b0578fda993f02f802cd00db85cb86f5c855b9aef788a6439099bae06d55c615f5327094c36645b68847455880a0ee841c7b22eed809f9f8015ff94b51fef1952a45e92830e53b9617efde4c91d626ca59a8e62e3a90e74e3f82dac00f745a3c353fa0029938fcc31a804d7dd32ca223185f1e47be6e197084cdf482b3537e0f8724484a39241f0d90b3079eda2fbb6bdffc55968e04983f581f4dbd9e3b932185a3e079797cd7cefd3c937ee656e9311cd8620516380a560d7a43e2806de39474bf3d06878a1b986c909cbb70e8838b300ec3f864279b0e88a37ea42c4c0eccc1f3b9d9a62f5b71ae32254dc78c174a7cbdea60ca2a7ec96bb56c5e2c189bbe961ee5af15406707f6d4b2c54ef41d920a74535cba866cc55ad98ff54694407ff61c08f6e7056f73c0df883e956c66755577c76af70ab0ead59ed2719429c672767ce65776476c62bdd2fa60d6b6671789a412a94ab2f5778ac0a09997db4add22177a7adabf9ab2c091bd718a07487f067ff8a20f7e068d56aa129afcfab4d3a0bc02eb9dfdf71d72ab30aa21c705eddf43c970b829a56efb54ea68cb375188aa9f857065e4edad912666b8b19715be02e3a909e9a0c97031d3a4e39326b00a2a08da74123d8552a2f55647594bd8e9ce010d70a83c917317d508d23007ea39c42dbd1a51e13a3e815fb92e1020c26036eb5aa939b45c7219b7ecaefbce42c718814d3139d67a9b5ce525c9e75453c41d661dc1c868f28d37fe8b678a4f297e9d511417d5a907ed5c697c9bd85c5c0bf69a3360fe53311b968c03c58e44cbfc585e4a2f855c666951071947715e6cc2b71730c80d4807cb50c5da244fbdbc176e197fabe94dabf7458a9c26641dd01332dbc6710380022b4b7b712bc6501c3eb27714bb0855358ed59b02933aeb7ed14ec3aadaf496f5f97d6cf682a8125c2f33c96bfa56f4bfbc5edaa17b3ff202ab3190cdc0004c322c306ce7752d0bd44bfea3e64341e564e3f07f517710364ac969494f98e22cae0a209777099ad85a5f0d174c4694c84a22261f73e202eb73ca3619c44c1fea20", @ANYRES32=r0]) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) copy_file_range(r1, 0x0, r2, &(0x7f0000000080)=0x1, 0x9, 0x0) mknodat(r2, &(0x7f0000000000)='./file0\x00', 0x4, 0x6b) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r1, 0x4018f50b, &(0x7f00000000c0)={0x0, 0xb, 0x6}) 4.849016708s ago: executing program 7 (id=6259): ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) r0 = socket$inet(0x2, 0x2, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x24000880}, 0x8051) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x5dc}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r3, 0x29, 0x3e, 0x0, &(0x7f00007d0000)=0xfffffffffffffd42) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x4c, 0x0, &(0x7f00000003c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000001c0)={@flat=@binder={0x73622a85, 0x1, 0x2}, @flat=@handle={0x73682a85, 0xa, 0x3}, @fd}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) 4.848337408s ago: executing program 7 (id=6260): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') write$selinux_load(0xffffffffffffffff, 0x0, 0x2046) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000080)={0x0, 0x3}) setresuid(0x0, 0x0, 0x0) setrlimit(0x40000000000008, &(0x7f0000000000)) memfd_secret(0x80000) mmap(&(0x7f000076d000/0x4000)=nil, 0x4000, 0x3000003, 0x110, r0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f0000000440)=ANY=[@ANYBLOB="b0000000000000ab284dc9a94095f54e34f11a5a480d2115805745f8a24d"], 0xb0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r3]) read$FUSE(r0, &(0x7f0000000f00)={0x2020}, 0x2020) 4.749097479s ago: executing program 0 (id=6262): openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/locks\x00', 0x0, 0x0) mlockall(0x1) (async) r0 = syz_clone(0xa0001000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x3fd000, 0x0) (async) ptrace$setsig(0x4203, r0, 0x3, &(0x7f0000000080)={0x20, 0x3, 0x3}) (async) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x0) (async, rerun: 64) r3 = syz_clone(0xa0001000, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0) (rerun: 64) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x202480, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) (async) fadvise64(r1, 0x1003, 0x9, 0x5) (async) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0x5a051feb1f984a13, 0x202812, r1, 0x7dfff000) ptrace$setsig(0x4203, r3, 0x0, &(0x7f0000000140)={0x30, 0x2}) 4.67373532s ago: executing program 7 (id=6264): io_setup(0x7, &(0x7f0000000080)=0x0) io_pgetevents(r0, 0x3, 0x3, &(0x7f00000000c0)=[{}, {}, {}], &(0x7f0000000180), &(0x7f0000000200)={&(0x7f00000001c0)={[0x5]}, 0x8}) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) (async) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000100)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000280)=ANY=[@ANYRESDEC, @ANYBLOB='E'], 0x31) r3 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x280, 0x0) ioctl$ASHMEM_SET_SIZE(r3, 0x40087703, 0x8000) (async) ioctl$ASHMEM_SET_PROT_MASK(r3, 0x40087705, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140"], 0x0) r4 = socket$netlink(0x10, 0x3, 0xe) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) (async) clock_adjtime(0x0, &(0x7f0000000080)={0x5, 0x8, 0x0, 0x7, 0x0, 0x4a1, 0x5, 0xfffffffffffffffc, 0x123e, 0x4, 0x4ad48b4b, 0x0, 0x9, 0x0, 0x5, 0x746, 0x200000008, 0x7ebb, 0x0, 0x6d, 0x10000, 0x6, 0x6, 0x8001, 0x4, 0x4}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x60303, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) (async) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4400ae8f, &(0x7f0000000000)=@x86={0x0, 0x40, 0x81, 0x0, 0xf43f, 0xb, 0x49, 0x7, 0x2, 0xfb, 0x3, 0xa4, 0x0, 0x4, 0x6bd, 0x2, 0x8, 0x1, 0x7, '\x00', 0x2, 0x5}) (async) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000008, 0x12, r3, 0x4d75d000) 4.210760668s ago: executing program 0 (id=6269): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r1, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000300) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) read(r0, 0x0, 0x0) 4.119244569s ago: executing program 0 (id=6270): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') lseek(r0, 0x401, 0x2) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000380), 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r4, 0x909, 0x20000000, 0x0, {{}, {0x0, 0x4107}, {0x4c, 0x18, {0x60, @link='broadcast-link\x00'}}}}, 0x68}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x34, r4, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {}, {0x18, 0x17, {0x1e, 0x8, @l2={'eth', 0x3a, 'ip6tnl0\x00'}}}}, [""]}, 0x34}, 0x1, 0x0, 0x0, 0x2040090}, 0x0) setresgid(0xffffffffffffffff, 0xee01, 0x0) setfsgid(0xee01) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x18, &(0x7f00000001c0)={@flat, @fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/10, 0xa}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, &(0x7f00000002c0)}) 4.106270179s ago: executing program 0 (id=6271): mount$bpf(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x400408, &(0x7f0000000cc0)=ANY=[@ANYBLOB='uid=', @ANYRESHEX=0xee00]) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a40)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x24000801}, 0x4000) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000010000000800050001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5420800050000000000900008808c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c640009801c000080060001000200000008000200ffffffff05000300030000001c000080060001000200000008000200ac141427050003"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x24000010) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000900)={0x4c, r3, 0x1, 0x0, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0x20, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'syz_D\x93\x95\x86'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}]}]}]}]}, 0x4c}}, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x43, 0x86, 0xa9, 0x8, 0xcde, 0x12, 0xf9a1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x3, 0x2, 0x80, 0x3, [{{0x9, 0x4, 0xfe, 0x9, 0x0, 0x62, 0xba, 0xaf, 0x9}}]}}]}}, &(0x7f0000000a00)={0x0, 0x0, 0x58, &(0x7f0000000500)=ANY=[@ANYBLOB="050f580003071002697319014110fbdc8f6a666929c949819284c0c24f9118a7e4bc13a94d1aea279d6e7fa8b0c236028134482d9c27feb241ee77793b1a851974813a81c2ab48590b100100a34e0800d4ec090000000000"]}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') lseek(r5, 0x10001, 0x0) r6 = syz_clone(0x25000000, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') read$FUSE(r7, &(0x7f0000000640)={0x2020}, 0x2020) r8 = socket$igmp6(0xa, 0x3, 0x3a) madvise(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x17) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) getsockopt$MRT6(r8, 0x3a, 0x1, 0x0, 0x0) syz_pidfd_open(r6, 0x0) syz_open_procfs(r6, &(0x7f0000000100)='net/if_inet6\x00') 1.836977533s ago: executing program 5 (id=6288): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000007d00)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="180000006a00"], 0x1c}], 0x1}, 0x4000080) mount$bpf(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x400408, &(0x7f0000000100)=ANY=[@ANYBLOB='uid=', @ANYRESHEX=0xee00, @ANYBLOB="95a00841e19456d8c93e922b54d094cefcb680cd25325f1a8539ac0b8549841596b9a3d3d159acc5f02d0c53c55e290818e499d9ab978c71f3d66f41dc5fb3971fddffe06cae0ae1adfa0b8cecc212c71a97584c16e1d28f28b30588a2494d73bf4236325de6d4353ab04888ee46ca157b1468c07f4848f12e87caf4b43bec8119073b34c43d97187773c202ce8eeb5b0b1fe0219e6180042320cedf", @ANYRESDEC, @ANYRES16, @ANYRESOCT=r0, @ANYRES16=r0, @ANYRESHEX=r0, @ANYRES8=r0]) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000200)=""/74, 0x328000, 0x1800}, 0x20) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') lseek(r2, 0x10001, 0x0) 1.802402853s ago: executing program 5 (id=6290): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs/binder1\x00', 0x0, 0x0) (async) sync() (async) sync() sync() sync() sync() (async) sync() sync() (async) sync() (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x53, 0x0, &(0x7f0000000400)="892a7863af87409b1b8fe4e183cc4e2c2eddca324f8c2a61fb078c81d7272d92b902bf051aacb6decd83ec368991a0d7599c3ce3f7bed9d8078ba649896475d964ddb0c6d4d498b0ef80a3f6170b75654851be"}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f00000001c0)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000880)={'filter\x00', 0x1002, 0x4, 0x3f0, 0x1f8, 0x0, 0xe8, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1f8}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @mac, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0xf, 0xffffffff}}}, {{@arp={@loopback, @multicast1, 0xff000000, 0x0, 0x6, 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x22}, {[0x0, 0x0, 0x0, 0x0, 0xff, 0xff]}}, {@empty, {[0x0, 0xff, 0x0, 0xff, 0x0, 0xff]}}, 0x6, 0x81, 0x1, 0x1, 0xd13, 0xe106, 'pimreg1\x00', 'veth1_virt_wifi\x00', {0xff}, {0xff}, 0x0, 0x4}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @mac=@random="3330cb30ca8a", @private=0xa010102, @broadcast}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) (async) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x2, &(0x7f0000000000)=[{0x3c, 0x6}, {0x6}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0xa, 0x2, 0x10}, @ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/12, 0xc, 0x2, 0xc}, @flat=@weak_binder={0x77622a85, 0xa, 0x44}}, &(0x7f0000000080)={0x0, 0x20, 0x48}}, 0x40}], 0x0, 0x0, 0x0}) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/custom1\x00', 0x800, 0x0) 1.555146307s ago: executing program 7 (id=6293): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x60341, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000180)={@mcast2, 0x3c631004, 0x0, 0x3, 0x0, 0x0, 0x547}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000040)={@private2={0xfc, 0x2, '\x00', 0x2}, 0x800, 0x0, 0x1, 0x8, 0x6109, 0x3}, 0x20) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, 0x0) 1.487107108s ago: executing program 5 (id=6294): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000240)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x32}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x20000000029}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1}}, &(0x7f00000004c0)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000a00), r2) sendmsg$ETHTOOL_MSG_COALESCE_GET(r2, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000002200)={0x18, r3, 0x317, 0x70bd2b, 0x25dfdbff, {}, [@HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x2400085c}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r4, 0x0, 0x2e, 0x0, 0x0) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) (async, rerun: 32) sendmmsg(r1, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000200)='$', 0x1}], 0x1, &(0x7f0000000280)=ANY=[], 0xf}}], 0x1, 0x4004804) (async, rerun: 32) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f00000001c0)={0x8000000000000000, 0x3, 0x5, 0xb18, 0x1, 0x0, [{0xd, 0x1, 0x1, '\x00', 0x600}]}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0xc0686611, &(0x7f0000000180)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) (async) ioctl$SNAPSHOT_ALLOC_SWAP_PAGE(0xffffffffffffffff, 0x80083314, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000500)={0x1ff, 0xc, 0xdddd0000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r5) sendmsg$IEEE802154_SET_MACPARAMS(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x20, r6, 0x52b, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4000) (async) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) setsockopt$sock_int(r1, 0x1, 0xb, &(0x7f0000000440)=0x1, 0x4) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) ioctl$BLKPG(r9, 0x1269, &(0x7f0000000000)={0x1, 0x0, 0x98, &(0x7f0000000080)={0xfffffffffffffffc, 0x1, 0x10}}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x3, &(0x7f0000000480)=0x6, 0x4) (async, rerun: 64) sendmsg$NFULNL_MSG_CONFIG(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000005b40)={0x1c, 0x1, 0x4, 0x5, 0x0, 0x0, {}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}]}, 0x1c}}, 0x2000004) (rerun: 64) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) (async) sendmsg$TIPC_NL_BEARER_SET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000300)={0x110, r7, 0x10, 0x70bd28, 0x24dfdbff, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x85f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffff06}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x4}]}, @TIPC_NLA_SOCK={0x10, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8}]}, @TIPC_NLA_PUBL={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2f}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xbd8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7fff}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x800}, 0xc0) 1.449272229s ago: executing program 7 (id=6295): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) preadv2(r0, &(0x7f0000000500)=[{&(0x7f0000000040)=""/218, 0xda}], 0x1, 0xa, 0x6, 0x15) (async) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x822b01) (async, rerun: 64) r2 = syz_genetlink_get_family_id$SEG6(0x0, 0xffffffffffffffff) (rerun: 64) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000640)={0x14, r2, 0x411, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x14}, 0x44080) (async) r3 = getpid() (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) (async) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x749}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000200)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) (async) mremap(&(0x7f00003cd000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f0000c9a000/0x2000)=nil) (async) close_range(r6, 0xffffffffffffffff, 0x0) (async, rerun: 64) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f00000001c0)={0x0, 0xc8, &(0x7f0000000700)="72c310ee3e73920d0dc3052d4ce181d032ecb02f301f57edab0edfadfeaea2dd697482893bd57292506e26d6633bb1b8806cce7544bbf1a5ead965eb492c8a669161dc927bce5be99deb47fd94fcf3112245ebbb4748baabf645ad4c18dbdace305ef2eedda0c9dc19e19da3ab7e7fc1d855f378e47f6618b7fd699daa0b552e1196c028d1431886d6ca137ecf2a6f26e1e5cfe12ab679c541c51252d8ea5edc670b5f37f59441175991adbe6bf68634d165df24576d7eaefc6de1cd5055e8fca8f57f1d815c9eee"}) (async, rerun: 64) write$char_usb(r1, &(0x7f0000000040)="e2", 0x12d8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) 1.37544504s ago: executing program 5 (id=6296): ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000100)={"b46474f815e8d5535f0887c44335cc824dc6121bc72a77f532ff5dad4d643a9cab29d2310e04be14eb26c0af4985fe45e3b3b0680b3ec92725d74b9716e0f7c3119a2c9a0ae65ff4772e2e12733cb013c4308fe40863480747c0a7ddb9361b1578015ca1bb2c1677ebae096f08345476f567443842946ed946434c75916d1db83fe305920de65bfaf9bd940672216846cb16b8ae67cd3affc61375381f91b3b9f1cc5e38cafe5239aee71dcd481fbe1ecd2547ffbaad4469a74697c28fb9beefa6a5d736712a55eb9110c2cf7964062ba8cbc1c038e84f0f5db7fc7053118bf5221e3efa6fc3edb5d0ca3cde7054dd0751a332520aa8478b1775d552c5cc24d3c2df9eb333e5ca3aa06c1c2cf8526714f5caff2f55b41976fc20b64f1fc61d5b44f50953582a1825d32130a31abfeafd1987317879e29ac51b93c9659e023fff3ddb5e39dd19cc3ef1d883c78b9e073d08a9197fb3717df238b9831831214b186693be9dd2568bb77272e80df5dfed03e8c467627bedfbd93359a9f79a3aa37e873dc1357b37b43d813ea85267b0dc8b1c4cc51bd985328833beb2679b7fb762555bbea2da936b36f8f1673fd5f606b2b6eb23b72bf947206e8dbfeb40ca6f265a3485c8446e0f0da652860b88328073d2282c14b48a7774e62754a968b60e92205e8fafcdd70a55c3c4d1a4821ff44e6e3681f15ae091262e3a3290a24d8ceae30ebbf9d24287bb8a5d73c608d47d287f9e716cf02b4796a83fb0c05e45b89de9ef8bce834e6d7a0be6e30d2c66cb6e640cb01898454ad361bc0701d8fe56113335ae6adec59300db04691cc4a689034272a8e086a32ce7061b4f79fa8afbb48a6ce4b62bdc44af013d78980457e1fa61eb9204818606f4c3b03c0f33cd2a841ac9bc2b73151a96e31ab99e6ec969b5f2c3edd5f9abc69845e487af992758ba445368da93dae1d44360d52a534a88276b8aaf349841d8a4788c60408618437c442308dbf70efeda2e54e9b9e4fe5f76997c9dcb945a26bd75748c85d19ca8b99264dce50580e8d4dbda401dad7df31e9a7a6a3a83bfbdfb5394abd581ac0824fbcd75d2f5205c0b7c9188e6f26bfd97734d9a20433f6cdba9d14a5f32a4d97a57f4603b21146fd1aebf082e863d463c224ad623c17d8043d3bf083f0322408dd6ead6915ac6a4222ab51480eb6e11a8913348219515170d9df90d72d7363bbda3e327d19f98c0a856f98076380e788e602e8a2ae0a1930786874dc21a2e99abda15f35457cf1dcb440c4b41350d0eda352aad7f57a0adc8a6914da06460635ed21c4c11cd1a8ec778064c9f62efba2927828b23f94b16619a5520731c2c40ab8583c9f2e73233d74b84f4877ce6b35bb1180300"}) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f00000000c0)=0x8004, 0x4) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580), 0x0, 0x0, 0x0, 0xea}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r3, &(0x7f00000000c0)={0x1d, r4}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=r2, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r2, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_GET_XCRS(r6, 0x8188aea6, &(0x7f00000024c0)={0x0, 0x6}) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000200)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000480)={0x10, 0x0, &(0x7f0000000000)=[@clear_death], 0x0, 0x0, 0x0}) syz_clone(0x80820200, &(0x7f0000000040)="34772173eab97314e22ae8208651d1b7189c78c0b455a068ca6c571eba4b85656fbacc7c504ee9ec372d8ecb08e31354c387b8516c61ba", 0x37, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000180)="3a55a0a47e5e81baf97cdbdf27771e8a4e99020a292889be65b372d504bfd731f20bd0023c0eca8e") 1.174857062s ago: executing program 7 (id=6297): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000001740)='./binderfs2/custom1\x00', 0x0, 0x0) r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x101, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x8241, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x60, 0x2, [{{0x9, 0x4, 0x0, 0x4, 0x1, 0x3, 0x1, 0x2, 0x3, {0x9, 0x21, 0x7, 0xf, 0x1, {0x22, 0x3f0}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x2, 0xd, 0x4}}}}}]}}]}}, &(0x7f0000000300)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x300, 0x63, 0x8, 0x0, 0xfb, 0x5}, 0x21, &(0x7f0000000080)=ANY=[@ANYBLOB="050f2100011c100a004403000000f0f422f000000000000000000000004f450a6d"], 0x2, [{0xbd, &(0x7f0000001840)=ANY=[@ANYBLOB="bd03b78d85329550423a1299e83689dadcd349fee0845852c977335ea8472e9db604d093ffdd2b5a9a0060cea12dc44ad2bc1526e9e4444082836ee7fcdad1b14112e071489cf41469fd1f65837f6358b89ff268e55892cada785c902718ec90f81b716fca4ae0d5c349cc5868b5dbd2d9bcaf164d2c947affd1782bd9435636de0d12275cf6595a4d39a2e69c79d34d928510e99fa95d568b079715324d73a79dd739c7055f8e2da54a0b287c6b6c64da46d995c06dbd3403182750a3", @ANYRESDEC=r0]}, {0xcc, &(0x7f0000000200)=@string={0xcc, 0x3, "ebdcf336142ac4f4c1de39956d89104e881db9d80dbc2d3f17f56f8f41c984a6e820de8fb99278b3cdf75ae90ce14ce5c3b8c652e126a56b290ce541f727760734ac5f557b4d08e19467c1726755206905c39de7ab1c459361b20d2845c51707fa07021e7a5bffdd6fd09a51648bb20d64b70614d5742da73a9e80507eb2f498b863ad5d989c41047a79ab84dd212b6f770b51e9bfb2815b5d8f6511d8f71ba49c550f30a3011293c94617a7f71d31354cbcf2915277d5d88f70105f255b3032c406835f8dc317cd22e0"}}]}) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000001580), 0x101000, 0x0) read$FUSE(r3, 0x0, 0x9) get_robust_list(r2, &(0x7f0000000100)=0x0, &(0x7f0000000140)) link(&(0x7f0000000400)='./file0\x00', &(0x7f00000015c0)='./file0\x00') r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000040)={'lo\x00', {0x2, 0x4e20, @remote}}) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000001080)='/sys/power/sync_on_suspend', 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f0000002c80)={0x30}, 0x30) pipe(&(0x7f0000000040)={0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r10, 0x1, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x2000000, 0x3, 0x0, r9, 0x0}]) r11 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={0x14, r11, 0x1, 0x70bd26, 0x0, {0x27}}, 0x14}}, 0x20040000) r13 = syz_genetlink_get_family_id$tipc(&(0x7f0000001640), r8) sendmsg$TIPC_CMD_GET_MAX_PORTS(r8, &(0x7f0000001700)={&(0x7f0000001600)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000016c0)={&(0x7f0000001680)={0x1c, r13, 0x400, 0x70bd2c, 0x25dfdbfc, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004a841}, 0x20000010) sendto$packet(r6, &(0x7f00000017c0)="057001e1a8803fe210d1918150e665d358dcb11169b779b63f1b3820a4812f7d312321142bb5caf382dc3bd7174e0070c64051a1dae81d9b2cbea933262f73d2529ec6f262389ee283eda7e16b780fe2675c992c771c0e39f2ead53c41691ab4c0c29e8b6c15bbfacea3", 0x6a, 0x4, &(0x7f0000000140)={0x11, 0x4, r7, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$inet_mreq(r4, 0x0, 0x24, &(0x7f0000000340)={@multicast1, @multicast2}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000440)=[@increfs], 0x1e, 0x0, 0x0}) r14 = socket$inet6(0xa, 0x3, 0x1) r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CONNECT(r15, &(0x7f0000001540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001500)={&(0x7f0000001480)=ANY=[@ANYBLOB="98d6e5e6", @ANYRES16=0x0, @ANYRESOCT=r1], 0x70}, 0x1, 0x0, 0x0, 0x20000000}, 0x8009) getsockopt$inet6_buf(r14, 0x29, 0x3d, &(0x7f0000000480)=""/4096, &(0x7f0000000380)=0x1000) 1.174484162s ago: executing program 5 (id=6298): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0xa2) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) mount$incfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x48030, &(0x7f0000000480)=ANY=[@ANYBLOB='rlog_pages=000400']) 1.100305964s ago: executing program 5 (id=6299): futex(&(0x7f0000000000)=0x2, 0x8, 0x1, 0x0, 0x0, 0x2) prlimit64(0x0, 0x2, &(0x7f0000000440)={0x6, 0x1000000000000000}, 0x0) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) getpid() r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r1, 0x6, 0x1a, 0x0, &(0x7f0000001080)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000f, 0x22052, r0, 0x2000) mount$binderfs(0x0, &(0x7f0000000580)='./binderfs\x00', 0x0, 0x4008024, &(0x7f0000000100)=ANY=[@ANYBLOB="7a746174733d676c6f62616c2c003695eb1f97d6ddad19ba7b5a69965a92938c86382f71dd9edf856338f04ece93c9fbf4c73374dfc4db4c8f13bd844231e1ad0b47332618cc2f80ee31ca2bcad28173c0f2f045dd5f2487ef3e77debaed780630f2308f349ce5cd59c4d9663064a0ce277b1c817bba2f03e3f8e51d1a69ebde40c55b642c4bc3af4fb71959e580ae8194d71443be1103c2ab4d37c723a02f80b31f4210d2da46b2529fa1e37c18718c83a87d70f9b4f677a1"]) r2 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x3fc, 0x5d8, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0xb1, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x101, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xc, 0x0, 0x80}}}}}]}}]}}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000000)) ioctl$PPPIOCSMRU1(r3, 0x40047452, &(0x7f0000000880)=0x9) syz_usb_control_io(r2, &(0x7f0000000340)={0x2c, &(0x7f0000000000)={0x40, 0x6, 0x5, {0x5, 0x11, "00f400"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) 1.065835625s ago: executing program 0 (id=6300): r0 = open(&(0x7f00000001c0)='./file1\x00', 0x14927e, 0x20) open$dir(&(0x7f0000000080)='./file1\x00', 0x4080, 0x80) syz_clone3(&(0x7f0000000340)={0x105480, &(0x7f00000000c0), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fallocate(r0, 0x0, 0x0, 0x1001f0) lseek(r0, 0x0, 0x4) r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x100000e, 0x11012, r1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket(0x2c, 0x1, 0x7) clock_adjtime(0x300000000000000, &(0x7f0000000000)={0xfffd, 0x4, 0xb0000000000, 0x3, 0x0, 0x0, 0xfffffffffffffffb, 0x0, 0x2000000000000000, 0x40000000000, 0x3b9ac9ff, 0x8000000000000001, 0x81, 0xffffffffffffffff, 0x2000000000000000, 0x5a6c101, 0x6, 0x1, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x201ff, 0x4}) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vfat\x00', 0x200000, 0x0) getsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000100)=0x401, &(0x7f0000000140)=0x4) 242.897536ms ago: executing program 2 (id=6302): syz_open_dev$evdev(&(0x7f0000000000), 0x51bf3295, 0x101040) (async) syz_open_dev$evdev(&(0x7f0000000000), 0x51bf3295, 0x101040) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x4, 0x5}, 0x0) fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) socket$tipc(0x1e, 0x8d766d350814cdfa, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) 227.199286ms ago: executing program 2 (id=6303): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) fadvise64(r0, 0xfffffffffffffbff, 0x9, 0x5) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0x5a051feb1e984a11, 0x202812, r0, 0x7dfff000) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r1, 0x0, 0x0, 0x280008c0, &(0x7f0000001080)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) (async) sendto$inet(r1, 0x0, 0x0, 0x280008c0, &(0x7f0000001080)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$setlease(r2, 0x400, 0x0) mmap(&(0x7f0000785000/0x4000)=nil, 0x4000, 0x8, 0x11, r0, 0x3d7c3000) (async) mmap(&(0x7f0000785000/0x4000)=nil, 0x4000, 0x8, 0x11, r0, 0x3d7c3000) getsockopt$WPAN_SECURITY_LEVEL(r2, 0x0, 0x2, &(0x7f0000000000), &(0x7f0000000080)=0x4) 195.476697ms ago: executing program 2 (id=6304): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) write$selinux_load(r0, &(0x7f0000000000)={0xf97cff8c, 0x8, 'SE Linux', "79a413031fc007619cc2a25c749126cb43a1c463a36aeb7126c9c9435aa2b32268b091608e103fc1a5d738496954d6f9b102a1c57c86ffc9679d816c"}, 0x81) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x4000010, r2, 0x45829000) r3 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xffeffffffffffffc]}, 0x8) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffe000/0x2000)=nil) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000000)=""/142, 0x8e}, {&(0x7f00000000c0)=""/209, 0xd1}, {&(0x7f00000001c0)=""/186, 0xba}, {&(0x7f0000000280)=""/1, 0x1}, {&(0x7f00000002c0)=""/113, 0x71}, {&(0x7f0000000340)=""/190, 0xbe}, {&(0x7f0000000400)=""/47, 0x2f}, {&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000000440)=""/160, 0xa0}, {&(0x7f0000000500)=""/36, 0x24}], 0xa, 0x8, 0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$inet(0xffffffffffffffff, 0x0, 0x0) r4 = socket(0x10, 0x803, 0x0) sendto(r4, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f0000009800)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000002180)=""/4096, 0x1000}, {&(0x7f0000000500)=""/191, 0xbf}, {&(0x7f00000032c0)=""/246, 0xf6}, {&(0x7f00000033c0)=""/231, 0xe7}, {&(0x7f00000035c0)=""/76, 0x4c}, {&(0x7f0000000400)=""/241, 0xf1}, {&(0x7f0000000680)=""/148, 0x94}, {&(0x7f0000000780)=""/83, 0x53}, {&(0x7f0000000800)=""/127, 0x7f}], 0x9}, 0x81}, {{0x0, 0x0, 0x0}, 0x8}], 0x3, 0x2100, 0x0) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10, r5, 0x45809000) signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffc]}, 0x8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 99.520359ms ago: executing program 2 (id=6305): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000340)={[{0x122f, 0x3, 0x0, 0x0, 0x0, 0x4, 0xc, 0x0, 0x3, 0xff, 0x1f, 0x0, 0x10000}, {0x3, 0xfffe, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfd, 0x0, 0x9, 0x8}, {0x0, 0x0, 0x3c, 0x7, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x8}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 63.865059ms ago: executing program 2 (id=6306): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x585, 0x0, 0x2d}]}) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vfat\x00', 0x200000, 0x0) 0s ago: executing program 2 (id=6307): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0xa2) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) mount$incfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x48030, &(0x7f0000000480)=ANY=[@ANYBLOB='rlog_pages=0004000000000']) kernel console output (not intermixed with test programs): /8, error -71 [ 321.327115][ T10] usb 7-1: device descriptor read/8, error -71 [ 321.380089][T16856] SELinux: security_context_str_to_sid (unc_) failed with errno=-22 [ 321.404749][T16850] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 321.405040][T16850] rust_binder: Error while translating object. [ 321.411899][T16850] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 321.418299][T16850] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:52 [ 321.568592][ T306] usbhid 6-1:0.0: can't add hid device: -71 [ 321.583934][ T306] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 321.595949][ T306] usb 6-1: USB disconnect, device number 15 [ 321.597191][ T10] usb 7-1: new low-speed USB device number 14 using dummy_hcd [ 321.621848][T16867] rust_binder: Failed copying remainder into alloc: EFAULT [ 321.621869][T16867] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 321.629349][T16867] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 321.630722][ T10] usb 7-1: device descriptor read/8, error -71 [ 321.638017][T16867] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:362 [ 321.787000][ T10] usb 7-1: device descriptor read/8, error -71 [ 321.855626][T16876] rust_binder: Failed copying remainder into alloc: EFAULT [ 321.855648][T16876] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 321.863217][T16876] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 321.871640][T16876] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:371 [ 321.892378][T16879] binder: Unknown parameter '00000000000000000003' [ 321.916131][ T10] usb usb7-port1: unable to enumerate USB device [ 321.934756][T16883] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5567'. [ 322.010721][T16886] bpf: Bad value for 'uid' [ 322.082169][T16889] rust_binder: Write failure EINVAL in pid:383 [ 322.152353][T16908] binder: Bad value for 'max' [ 322.230893][T16916] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 322.242696][T16916] overlayfs: missing 'lowerdir' [ 322.498833][T16926] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 322.498863][T16926] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:56 [ 322.515881][ T422] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 322.551478][T16931] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 322.553012][T16931] rust_binder: Failed to allocate buffer. len:120, is_oneway:true [ 322.590065][T16935] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 322.693040][ T422] usb 6-1: New USB device found, idVendor=0b95, idProduct=772b, bcdDevice=a2.4c [ 322.702317][ T422] usb 6-1: New USB device strings: Mfr=24, Product=2, SerialNumber=3 [ 322.710546][ T422] usb 6-1: Product: syz [ 322.714908][ T422] usb 6-1: Manufacturer: syz [ 322.719567][ T422] usb 6-1: SerialNumber: syz [ 322.724843][ T422] usb 6-1: config 0 descriptor?? [ 322.866135][ T31] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 322.876962][T16939] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000040486312 not found [ 322.885267][T16939] rust_binder: Write failure EINVAL in pid:386 [ 323.017328][ T31] usb 7-1: unable to get BOS descriptor or descriptor too short [ 323.032386][ T31] usb 7-1: config 16 has an invalid interface number: 195 but max is 0 [ 323.041074][ T31] usb 7-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 323.051505][ T31] usb 7-1: config 16 has no interface number 0 [ 323.057928][ T31] usb 7-1: config 16 interface 195 altsetting 128 bulk endpoint 0xC has invalid maxpacket 1023 [ 323.068570][ T31] usb 7-1: config 16 interface 195 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 323.082229][ T31] usb 7-1: config 16 interface 195 has no altsetting 0 [ 323.090747][ T31] usb 7-1: New USB device found, idVendor=0421, idProduct=044d, bcdDevice=e6.ce [ 323.100025][ T31] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.108446][ T31] usb 7-1: Product: syz [ 323.112645][ T31] usb 7-1: Manufacturer: syz [ 323.117629][ T31] usb 7-1: SerialNumber: syz [ 323.124863][T16937] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 323.333773][ T422] asix 6-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 323.344465][ T31] usb 7-1: bad CDC descriptors [ 323.350856][ T31] usb 7-1: USB disconnect, device number 15 [ 323.405934][ T306] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 323.534229][ T422] asix 6-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 323.544307][ T422] asix 6-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 323.555068][ T422] asix 6-1:0.0: probe with driver asix failed with error -71 [ 323.563977][ T422] usb 6-1: USB disconnect, device number 16 [ 323.566983][ T306] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 323.580875][ T306] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 323.590733][ T306] usb 3-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 323.600028][ T306] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.608867][ T306] usb 3-1: config 0 descriptor?? [ 323.879005][T16955] SELinux: failed to load policy [ 323.884357][T16955] rust_binder: Write failure EFAULT in pid:70 [ 323.913095][T16960] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 324.040975][T16972] fuse: Bad value for 'fd' [ 324.116262][T16980] netlink: 'syz.5.5598': attribute type 27 has an invalid length. [ 324.139091][ T36] kauditd_printk_skb: 23 callbacks suppressed [ 324.139113][ T36] audit: type=1400 audit(2000000078.059:2449): avc: denied { write } for pid=16984 comm="syz.5.5599" name="usbmon9" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 324.220638][ T306] usbhid 3-1:0.0: can't add hid device: -71 [ 324.226798][ T306] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 324.235503][ T306] usb 3-1: USB disconnect, device number 100 [ 324.256165][T16994] fuse: Bad value for 'fd' [ 324.289094][T16999] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 324.289224][T16999] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 324.565912][ T422] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 324.611469][T17011] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 4200, limit: 4216, size: 18446744073709550742) [ 324.611492][T17011] rust_binder: Error while translating object. [ 324.624123][T17011] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 324.630580][T17011] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:89 [ 324.727024][ T422] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 324.747734][ T422] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 324.774737][ T422] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 324.788389][ T422] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 324.797653][ T422] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 324.810994][ T422] usb 6-1: config 0 descriptor?? [ 325.270280][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.278488][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.285951][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.293466][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.300900][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.308368][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.316166][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.323794][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.331252][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.338915][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.346393][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.353916][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.361382][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.369009][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.376447][ T422] plantronics 0003:047F:FFFF.0040: unknown main item tag 0x0 [ 325.384059][ T422] plantronics 0003:047F:FFFF.0040: No inputs registered, leaving [ 325.393197][ T422] plantronics 0003:047F:FFFF.0040: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 325.529051][T17028] can0: slcan on ttyS3. [ 325.576185][T17028] can0 (unregistered): slcan off ttyS3. [ 325.945919][ T527] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 326.096928][ T527] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 233, changing to 11 [ 326.108256][ T527] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8704, setting to 1024 [ 326.119387][ T527] usb 3-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 326.128570][ T527] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 326.137375][ T527] usb 3-1: config 0 descriptor?? [ 326.343954][T17054] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 326.352682][T17054] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 326.562427][ T527] isku 0003:1E7D:319C.0041: unknown main item tag 0x0 [ 326.569412][ T527] isku 0003:1E7D:319C.0041: item fetching failed at offset 6/7 [ 326.577312][ T527] isku 0003:1E7D:319C.0041: parse failed [ 326.582986][ T527] isku 0003:1E7D:319C.0041: probe with driver isku failed with error -22 [ 326.695870][ T422] usb 6-1: reset full-speed USB device number 17 using dummy_hcd [ 326.927129][ T9] usb 3-1: USB disconnect, device number 101 [ 327.408401][T17071] rust_binder: Error while translating object. [ 327.408442][T17071] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 327.414806][T17071] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:184 [ 327.439580][T17073] rust_binder: Write failure EFAULT in pid:186 [ 327.449262][T17073] rust_binder: Failed to allocate buffer. len:136, is_oneway:false [ 327.491695][T17080] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5623'. [ 327.509906][T17080] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 327.509939][T17080] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:415 [ 327.666395][ T10] usb 6-1: USB disconnect, device number 17 [ 327.755892][T17095] /dev/nullb0: Can't lookup blockdev [ 327.788221][T17099] netlink: 'syz.6.5629': attribute type 4 has an invalid length. [ 327.815930][ T10] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 327.895936][ T31] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 327.916003][T17104] fuse: Bad value for 'fd' [ 327.965869][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 327.972200][ T10] usb 6-1: config 1 has an invalid interface number: 4 but max is 2 [ 327.980671][ T10] usb 6-1: config 1 has no interface number 1 [ 327.988183][ T10] usb 6-1: too many endpoints for config 1 interface 4 altsetting 0: 249, using maximum allowed: 30 [ 327.999211][ T10] usb 6-1: config 1 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 249 [ 328.013842][ T10] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 328.023045][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 328.031314][ T10] usb 6-1: Product: syz [ 328.035482][ T10] usb 6-1: Manufacturer: syz [ 328.040117][ T10] usb 6-1: SerialNumber: syz [ 328.065886][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 328.072288][ T31] usb 3-1: config 6 has an invalid interface number: 47 but max is 0 [ 328.080570][ T31] usb 3-1: config 6 has no interface number 0 [ 328.086731][ T31] usb 3-1: config 6 interface 47 has no altsetting 0 [ 328.095053][ T31] usb 3-1: New USB device found, idVendor=04cb, idProduct=0100, bcdDevice= 5.1f [ 328.104244][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 328.112301][ T31] usb 3-1: Product: syz [ 328.116521][ T31] usb 3-1: Manufacturer: syz [ 328.121155][ T31] usb 3-1: SerialNumber: syz [ 328.256181][ T10] usb 6-1: 2:1 : no UAC_FORMAT_TYPE desc [ 328.267569][T17108] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 328.267607][T17108] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:122 [ 328.275409][ T10] usb 6-1: USB disconnect, device number 18 [ 328.330090][ T31] usb-storage 3-1:6.47: USB Mass Storage device detected [ 328.339645][ T31] usb-storage 3-1:6.47: Quirks match for vid 04cb pid 0100: 9 [ 328.347535][T17117] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:196 [ 328.362974][T17119] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 328.372569][T17119] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:124 [ 328.384457][ T31] usb 3-1: USB disconnect, device number 102 [ 328.489668][T17121] rust_binder: Error while translating object. [ 328.489700][T17121] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 328.496282][T17121] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:126 [ 328.520383][T17124] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 328.529754][T17124] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:129 [ 328.565319][T17128] netlink: 'syz.5.5638': attribute type 4 has an invalid length. [ 328.582810][T17128] netlink: 3657 bytes leftover after parsing attributes in process `syz.5.5638'. [ 328.909010][T17151] rust_binder: Write failure EFAULT in pid:431 [ 328.931482][T17153] rust_binder: Write failure EINVAL in pid:433 [ 329.075618][ T10] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 329.251128][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 329.262455][ T10] usb 6-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 329.282088][ T10] usb 6-1: config 0 interface 0 has no altsetting 0 [ 329.289372][ T10] usb 6-1: New USB device found, idVendor=5543, idProduct=0042, bcdDevice= 0.00 [ 329.303184][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.324502][ T10] usb 6-1: config 0 descriptor?? [ 329.413808][T17173] kvm: user requested TSC rate below hardware speed [ 329.744901][ T10] uclogic 0003:5543:0042.0042: unbalanced delimiter at end of report description [ 329.754325][ T10] uclogic 0003:5543:0042.0042: parse failed [ 329.760399][ T10] uclogic 0003:5543:0042.0042: probe with driver uclogic failed with error -22 [ 329.954327][T17141] fuse: Bad value for 'user_id' [ 329.959353][T17141] fuse: Bad value for 'user_id' [ 329.965655][ T10] usb 6-1: USB disconnect, device number 19 [ 330.248025][T17190] vcan0: entered allmulticast mode [ 330.253365][T17190] vcan0: left allmulticast mode [ 330.259042][T17190] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 330.267804][T17190] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 330.268891][T17191] binder: Bad value for 'max' [ 330.277092][T17190] overlayfs: missing 'lowerdir' [ 330.287309][T17191] binder: Bad value for 'max' [ 330.292143][T17191] binder: Bad value for 'max' [ 330.297006][T17191] binder: Bad value for 'max' [ 330.301848][T17191] binder: Bad value for 'max' [ 330.306707][T17191] binder: Bad value for 'max' [ 330.311572][T17191] binder: Bad value for 'max' [ 330.316404][T17191] binder: Bad value for 'max' [ 330.321212][T17191] binder: Bad value for 'max' [ 330.326139][T17191] binder: Bad value for 'max' [ 330.331047][T17191] binder: Bad value for 'max' [ 330.335947][T17191] binder: Bad value for 'max' [ 330.340810][T17191] binder: Bad value for 'max' [ 330.345624][T17191] binder: Bad value for 'max' [ 330.350404][T17191] binder: Bad value for 'max' [ 330.355233][T17191] binder: Bad value for 'max' [ 330.360027][T17191] binder: Bad value for 'max' [ 330.364776][T17191] binder: Bad value for 'max' [ 330.369611][T17191] binder: Bad value for 'max' [ 330.374398][T17191] binder: Bad value for 'max' [ 330.379315][T17191] binder: Bad value for 'max' [ 330.384163][T17191] binder: Bad value for 'max' [ 330.388980][T17191] binder: Bad value for 'max' [ 330.393768][T17191] binder: Bad value for 'max' [ 330.398584][T17191] binder: Bad value for 'max' [ 330.403379][T17191] binder: Bad value for 'max' [ 330.408206][T17191] binder: Bad value for 'max' [ 330.413175][T17191] binder: Bad value for 'max' [ 330.417993][T17191] binder: Bad value for 'max' [ 330.422773][T17191] binder: Bad value for 'max' [ 330.427750][T17191] binder: Bad value for 'max' [ 330.432637][T17191] binder: Bad value for 'max' [ 330.437520][T17191] binder: Bad value for 'max' [ 330.442414][T17191] binder: Bad value for 'max' [ 330.447186][T17191] binder: Bad value for 'max' [ 330.451990][T17191] binder: Bad value for 'max' [ 330.456779][T17191] binder: Bad value for 'max' [ 330.461602][T17191] binder: Bad value for 'max' [ 330.466375][T17191] binder: Bad value for 'max' [ 330.471181][T17191] binder: Bad value for 'max' [ 330.475999][T17191] binder: Bad value for 'max' [ 330.480810][T17191] binder: Bad value for 'max' [ 330.485570][T17191] binder: Bad value for 'max' [ 330.490363][T17191] binder: Bad value for 'max' [ 330.495154][T17191] binder: Bad value for 'max' [ 330.500042][T17191] binder: Bad value for 'max' [ 330.504802][T17191] binder: Bad value for 'max' [ 330.509568][T17191] binder: Bad value for 'max' [ 330.514590][T17191] binder: Bad value for 'max' [ 330.519463][T17191] binder: Bad value for 'max' [ 330.524316][T17191] binder: Bad value for 'max' [ 330.529150][T17191] binder: Bad value for 'max' [ 330.539786][T17191] binder: Bad value for 'max' [ 330.541485][T17194] rust_binder: Error while translating object. [ 330.544515][T17194] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 330.544679][T17191] binder: Bad value for 'max' [ 330.551201][T17191] binder: Bad value for 'max' [ 330.560837][T17194] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:144 [ 330.565500][T17191] binder: Bad value for 'max' [ 330.586155][T17191] binder: Bad value for 'max' [ 330.591040][T17191] binder: Bad value for 'max' [ 330.597025][T17191] binder: Bad value for 'max' [ 330.602042][T17191] binder: Bad value for 'max' [ 330.607067][T17191] binder: Bad value for 'max' [ 330.611957][T17191] binder: Bad value for 'max' [ 330.617071][T17191] binder: Bad value for 'max' [ 330.621964][T17191] binder: Bad value for 'max' [ 330.626931][T17191] binder: Bad value for 'max' [ 330.635248][T17202] binder: Unknown parameter '' [ 330.700860][T16803] bridge_slave_1: left allmulticast mode [ 330.706923][T16803] bridge_slave_1: left promiscuous mode [ 330.712993][T16803] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.721440][T16803] bridge_slave_0: left allmulticast mode [ 330.727296][T16803] bridge_slave_0: left promiscuous mode [ 330.733112][T16803] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.773947][ T36] audit: type=1400 audit(2000000084.638:2450): avc: denied { map } for pid=17203 comm="syz.5.5666" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 330.797639][T17207] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 330.797729][T17207] rust_binder: inc_ref_done called when no active inc_refs [ 330.804440][T17207] rust_binder: Write failure EINVAL in pid:154 [ 330.873840][T17208] bridge0: port 1(bridge_slave_0) entered blocking state [ 330.887348][T17208] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.894569][T17208] bridge_slave_0: entered allmulticast mode [ 330.901280][T17208] bridge_slave_0: entered promiscuous mode [ 330.908450][T16803] veth1_macvtap: left promiscuous mode [ 330.914153][T16803] veth0_vlan: left promiscuous mode [ 330.960587][T17208] bridge0: port 2(bridge_slave_1) entered blocking state [ 330.967805][T17208] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.975092][T17208] bridge_slave_1: entered allmulticast mode [ 330.981491][T17208] bridge_slave_1: entered promiscuous mode [ 331.035852][T17208] bridge0: port 2(bridge_slave_1) entered blocking state [ 331.042921][T17208] bridge0: port 2(bridge_slave_1) entered forwarding state [ 331.050359][T17208] bridge0: port 1(bridge_slave_0) entered blocking state [ 331.057615][T17208] bridge0: port 1(bridge_slave_0) entered forwarding state [ 331.079967][T16805] bridge0: port 1(bridge_slave_0) entered disabled state [ 331.087467][T16805] bridge0: port 2(bridge_slave_1) entered disabled state [ 331.097068][T16802] bridge0: port 1(bridge_slave_0) entered blocking state [ 331.104182][T16802] bridge0: port 1(bridge_slave_0) entered forwarding state [ 331.113318][T16805] bridge0: port 2(bridge_slave_1) entered blocking state [ 331.120403][T16805] bridge0: port 2(bridge_slave_1) entered forwarding state [ 331.147337][T17208] veth0_vlan: entered promiscuous mode [ 331.160045][T17208] veth1_macvtap: entered promiscuous mode [ 331.276912][T17216] netlink: 'syz.7.5669': attribute type 4 has an invalid length. [ 331.287130][T17216] netlink: 'syz.7.5669': attribute type 17 has an invalid length. [ 331.398636][T17220] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 331.398662][T17220] rust_binder: Read failure Err(EFAULT) in pid:9 [ 331.407257][T17220] netlink: 12 bytes leftover after parsing attributes in process `syz.7.5671'. [ 331.438636][T17227] rust_binder: Failed to allocate buffer. len:65376, is_oneway:true [ 331.438657][T17227] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 331.446760][T17227] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:14 [ 331.510514][T17232] rust_binder: Write failure EFAULT in pid:21 [ 331.520018][T17232] rust_binder: Read failure Err(EAGAIN) in pid:21 [ 331.526432][T17232] rust_binder: Write failure EINVAL in pid:21 [ 331.614156][T17240] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 331.722459][T17246] can0: slcan on ttyS3. [ 331.786840][T17245] can0 (unregistered): slcan off ttyS3. [ 331.913754][T16805] bridge_slave_1: left allmulticast mode [ 331.919477][T16805] bridge_slave_1: left promiscuous mode [ 331.925500][T16805] bridge0: port 2(bridge_slave_1) entered disabled state [ 331.935808][T16805] bridge_slave_0: left allmulticast mode [ 331.947174][T16805] bridge_slave_0: left promiscuous mode [ 331.952992][T16805] bridge0: port 1(bridge_slave_0) entered disabled state [ 332.062386][T17289] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 332.085769][T16805] tipc: Left network mode [ 332.091418][T16805] veth1_macvtap: left promiscuous mode [ 332.097373][T16805] veth0_vlan: left promiscuous mode [ 332.135532][ T31] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 332.289589][ T31] usb 6-1: Using ep0 maxpacket: 32 [ 332.363319][ T31] usb 6-1: unable to get BOS descriptor or descriptor too short [ 332.371075][ T31] usb 6-1: too many configurations: 246, using maximum allowed: 8 [ 332.379535][ T31] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 332.387382][ T31] usb 6-1: can't read configurations, error -71 [ 332.416166][T17296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 332.416198][T17296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 332.422683][T17296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 332.429400][T17296] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 332.519293][ T36] audit: type=1400 audit(2000000086.340:2451): avc: denied { connect } for pid=17304 comm="syz.7.5689" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 333.216642][T17335] input: syz1 as /devices/virtual/input/input48 [ 333.464365][ T36] audit: type=1400 audit(2000000087.266:2452): avc: denied { read } for pid=17348 comm="syz.7.5702" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 333.493699][ T36] audit: type=1400 audit(2000000087.266:2453): avc: denied { open } for pid=17348 comm="syz.7.5702" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 333.520652][T17349] rust_binder: Failed to allocate buffer. len:4224, is_oneway:false [ 333.528770][ T36] audit: type=1400 audit(2000000087.266:2454): avc: denied { ioctl } for pid=17348 comm="syz.7.5702" path="/dev/kvm" dev="devtmpfs" ino=13 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 333.566227][ T36] audit: type=1400 audit(2000000087.315:2455): avc: denied { ioctl } for pid=17348 comm="syz.7.5702" path="/dev/binderfs/binder0" dev="binder" ino=19 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 333.592793][ T36] audit: type=1400 audit(2000000087.315:2456): avc: denied { set_context_mgr } for pid=17348 comm="syz.7.5702" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 333.642367][ T36] audit: type=1400 audit(2000000087.315:2457): avc: denied { call } for pid=17348 comm="syz.7.5702" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 333.669846][ T36] audit: type=1400 audit(2000000087.363:2458): avc: denied { read write } for pid=17342 comm="syz.2.5700" name="binder1" dev="binder" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 333.710350][ T36] audit: type=1400 audit(2000000087.363:2459): avc: denied { open } for pid=17342 comm="syz.2.5700" path="/dev/binderfs/binder1" dev="binder" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 333.766810][T17362] fuse: Unknown parameter '000000000000000000040x000000000000000400000000000000000000' [ 333.862701][T17367] rust_binder: Write failure EINVAL in pid:465 [ 334.094587][ T10] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 334.258558][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 334.265154][ T10] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 334.273413][ T10] usb 6-1: config 0 has no interface number 0 [ 334.279624][ T10] usb 6-1: config 0 interface 184 has no altsetting 0 [ 334.288017][ T10] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 334.297547][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.305616][ T10] usb 6-1: Product: syz [ 334.309961][ T10] usb 6-1: Manufacturer: syz [ 334.314663][ T10] usb 6-1: SerialNumber: syz [ 334.324948][ T10] usb 6-1: config 0 descriptor?? [ 334.330786][ T10] smsc75xx v1.0.0 [ 334.334557][ T10] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 334.344787][ T10] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -22 [ 334.537174][ T10] usb 6-1: USB disconnect, device number 22 [ 334.820632][T17382] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5713'. [ 335.063586][T17389] binder: Bad value for 'max' [ 335.197853][T17406] input: syz1 as /devices/virtual/input/input50 [ 335.205866][T17406] rust_binder: Error while translating object. [ 335.205905][T17406] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 335.213040][T17406] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:220 [ 335.475769][ T31] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 335.640984][ T31] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 335.652092][ T31] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 335.661950][ T31] usb 6-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 335.671148][ T31] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.682586][ T31] usb 6-1: config 0 descriptor?? [ 335.719046][T17433] kvm: kvm [17432]: vcpu0, guest rIP: 0xfff0 Unhandled RDMSR(0x40000042) [ 335.894144][T17445] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 335.894185][T17445] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:229 [ 335.908701][ T31] usbhid 6-1:0.0: can't add hid device: -71 [ 335.924108][ T31] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 335.935050][ T31] usb 6-1: USB disconnect, device number 23 [ 335.968543][ T36] kauditd_printk_skb: 74 callbacks suppressed [ 335.968562][ T36] audit: type=1400 audit(2000000089.709:2534): avc: denied { ioctl } for pid=17458 comm="syz.5.5737" path="socket:[78204]" dev="sockfs" ino=78204 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 336.000313][ T36] audit: type=1400 audit(2000000089.709:2535): avc: denied { sys_module } for pid=17458 comm="syz.5.5737" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 336.011893][T17461] __vm_enough_memory: pid: 17461, comm: syz.5.5738, bytes: 70373039144960 not enough memory for the allocation [ 336.024813][ T36] audit: type=1400 audit(2000000089.709:2536): avc: denied { map } for pid=17458 comm="syz.5.5737" path="socket:[78205]" dev="sockfs" ino=78205 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 336.059812][ T36] audit: type=1400 audit(2000000089.709:2537): avc: denied { setattr } for pid=17458 comm="syz.5.5737" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 336.061391][T17463] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5739'. [ 336.096724][ T36] audit: type=1400 audit(2000000089.748:2538): avc: denied { map } for pid=17460 comm="syz.5.5738" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 336.120555][ T36] audit: type=1400 audit(2000000089.797:2539): avc: denied { write } for pid=17462 comm="syz.5.5739" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 336.141515][ T36] audit: type=1400 audit(2000000089.797:2540): avc: denied { nlmsg_write } for pid=17462 comm="syz.5.5739" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 336.171785][ T36] audit: type=1400 audit(2000000089.866:2541): avc: denied { create } for pid=17470 comm="syz.5.5741" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 336.192626][ T36] audit: type=1400 audit(2000000089.866:2542): avc: denied { bind } for pid=17470 comm="syz.5.5741" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 336.217948][ T36] audit: type=1400 audit(2000000089.866:2543): avc: denied { name_bind } for pid=17470 comm="syz.5.5741" src=622 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 336.385900][T17488] pim6reg1: entered promiscuous mode [ 336.391424][T17488] pim6reg1: entered allmulticast mode [ 336.612085][T17508] __vm_enough_memory: pid: 17508, comm: syz.0.5753, bytes: 70373039144960 not enough memory for the allocation [ 336.744361][T17518] tmpfs: Unknown parameter 'fsuuid' [ 337.148850][T17524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 337.159390][T17524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 337.384603][ T65] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 337.466209][T17529] binder: Bad value for 'max' [ 337.547640][ T65] usb 6-1: Using ep0 maxpacket: 32 [ 337.553950][ T65] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 337.564319][ T65] usb 6-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 337.573792][ T65] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.581796][T17539] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 337.581823][T17539] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 337.581841][T17539] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 337.581857][T17539] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 337.581871][T17539] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 337.581888][T17539] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 337.595416][T17539] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 337.601882][ T65] usb 6-1: config 0 descriptor?? [ 337.611902][T17539] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 337.648074][T17544] tipc: Enabled bearer , priority 0 [ 337.662669][T17544] tipc: Disabling bearer [ 337.697001][T17546] binder: Bad value for 'stats' [ 337.726899][T17551] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 337.726928][T17551] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 337.735537][T17551] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:511 [ 337.757366][T17554] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 337.766751][T17554] rust_binder: Read failure Err(EFAULT) in pid:514 [ 337.775860][T17554] rust_binder: Write failure EINVAL in pid:514 [ 337.795006][T17556] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 337.825620][ T31] hid-generic C98F:0003:0000.0043: unknown main item tag 0x0 [ 337.839876][ T31] hid-generic C98F:0003:0000.0043: unknown main item tag 0x0 [ 337.847931][ T31] hid-generic C98F:0003:0000.0043: hidraw0: HID v0.00 Device [syz0] on syz1 [ 337.874061][T17567] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 337.874087][T17567] rust_binder: Read failure Err(EFAULT) in pid:526 [ 337.874170][T17565] fido_id[17565]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 338.027528][ T65] magicmouse 0003:05AC:0265.0044: hidraw0: USB HID v0.00 Device [HID 05ac:0265] on usb-dummy_hcd.5-1/input0 [ 338.231337][ T306] usb 6-1: USB disconnect, device number 24 [ 338.372942][ T65] usb 3-1: new full-speed USB device number 103 using dummy_hcd [ 338.536818][ T65] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 338.556182][ T65] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 338.576597][ T65] usb 3-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 338.585993][ T65] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.596970][ T65] usb 3-1: config 0 descriptor?? [ 339.004014][ T422] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 339.014743][ T65] zydacron 0003:13EC:0006.0045: unknown main item tag 0x6 [ 339.022746][ T65] zydacron 0003:13EC:0006.0045: hidraw0: USB HID v0.00 Device [HID 13ec:0006] on usb-dummy_hcd.2-1/input0 [ 339.157757][ T422] usb 6-1: config 1 has an invalid descriptor of length 68, skipping remainder of the config [ 339.168126][ T422] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 339.177086][ T422] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 339.191328][ T422] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 339.200649][ T422] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.208970][ T422] usb 6-1: Product: syz [ 339.213141][ T422] usb 6-1: Manufacturer: syz [ 339.217793][ T422] usb 6-1: SerialNumber: syz [ 339.223287][T17582] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 339.233203][T17582] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 339.242283][T17582] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 339.251059][T17582] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 339.264347][ T65] usb 3-1: USB disconnect, device number 103 [ 339.429317][T17595] binder: Bad value for 'max' [ 339.437010][T17584] tipc: Started in network mode [ 339.442060][T17584] tipc: Node identity 42570e76db2b, cluster identity 4711 [ 339.449473][T17584] tipc: Enabled bearer , priority 0 [ 339.457413][ T422] cdc_ncm 6-1:1.0: CDC Union missing and no IAD found [ 339.464509][ T422] cdc_ncm 6-1:1.0: bind() failure [ 339.470348][T17584] tipc: Disabling bearer [ 339.471338][ T422] usb 6-1: USB disconnect, device number 25 [ 339.584110][T17598] netlink: 188 bytes leftover after parsing attributes in process `syz.2.5783'. [ 339.687383][T17611] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 339.944696][T17608] rust_binder: Failed to allocate buffer. len:65376, is_oneway:true [ 339.944793][T17608] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 340.044831][T17608] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:563 [ 340.127382][T17625] netlink: 'syz.5.5792': attribute type 4 has an invalid length. [ 340.194157][T17626] netlink: 'syz.5.5792': attribute type 4 has an invalid length. [ 340.209551][T17625] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 340.220738][T17625] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 340.359899][T17637] rust_binder: validate_parent_fixup: new_min_offset=56, sg_entry.length=0 [ 340.359930][T17637] rust_binder: Error while translating object. [ 340.368939][T17637] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 340.375246][T17637] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:571 [ 340.512174][T17651] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:579 [ 340.532507][T17653] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 340.541875][T17653] rust_binder: Read failure Err(EFAULT) in pid:581 [ 340.813535][ T9] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 340.977163][ T9] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 340.988801][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 340.999739][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 341.009543][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 341.022462][ T9] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 341.031538][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 341.040255][ T9] usb 3-1: config 0 descriptor?? [ 341.305210][T17661] rust_binder: Error while translating object. [ 341.305249][T17661] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 341.311698][T17661] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:271 [ 341.445570][T17667] netlink: 96 bytes leftover after parsing attributes in process `syz.5.5809'. [ 341.464051][T17668] netlink: 96 bytes leftover after parsing attributes in process `syz.5.5809'. [ 341.465105][ T9] plantronics 0003:047F:FFFF.0046: ignoring exceeding usage max [ 341.484198][ T9] plantronics 0003:047F:FFFF.0046: No inputs registered, leaving [ 341.496508][ T9] plantronics 0003:047F:FFFF.0046: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 341.672252][ T36] kauditd_printk_skb: 44 callbacks suppressed [ 341.672272][ T36] audit: type=1400 audit(2000000095.309:2588): avc: denied { remount } for pid=17678 comm="syz.5.5813" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 341.724243][ T36] audit: type=1326 audit(2000000095.358:2589): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=17682 comm="syz.5.5815" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f43bff8e929 code=0x0 [ 341.779390][T17685] rust_binder: Fixups oob 154 158 203 174 [ 341.779420][T17685] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EINVAL } [ 341.785245][T17685] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 341.795847][T17685] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:585 [ 341.797399][ T36] audit: type=1400 audit(2000000095.427:2590): avc: denied { associate } for pid=17682 comm="syz.5.5815" name="veth0_to_bond" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 342.645079][ T36] audit: type=1400 audit(2000000096.275:2591): avc: denied { append } for pid=17688 comm="syz.5.5817" name="binder1" dev="binder" ino=26 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 342.669170][T17689] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:297 [ 342.670736][T17690] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 342.761936][T17694] rust_binder: Error while translating object. [ 342.768643][T17694] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 342.775069][T17694] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:302 [ 342.799072][T17697] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 342.818184][T17697] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 343.035439][ T31] usb 6-1: new low-speed USB device number 27 using dummy_hcd [ 343.167228][ T31] usb 6-1: device descriptor read/64, error -71 [ 343.320837][T17702] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 3 [ 343.328182][T17702] rust_binder: Write failure EINVAL in pid:588 [ 343.403685][ T36] audit: type=1400 audit(2000000097.025:2592): avc: denied { append } for pid=17709 comm="syz.2.5824" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 343.432960][ T31] usb 6-1: device descriptor read/64, error -71 [ 343.557684][T17718] can0: slcan on ptm1. [ 343.565210][ T36] audit: type=1400 audit(2000000097.183:2593): avc: denied { read } for pid=148 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 343.587786][ T9] usb 3-1: USB disconnect, device number 104 [ 343.606895][ T36] audit: type=1400 audit(2000000097.202:2594): avc: denied { search } for pid=148 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 343.630086][ T36] audit: type=1400 audit(2000000097.202:2595): avc: denied { read } for pid=148 comm="dhcpcd" name="n29" dev="tmpfs" ino=7100 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 343.651997][ T36] audit: type=1400 audit(2000000097.202:2596): avc: denied { open } for pid=148 comm="dhcpcd" path="/run/udev/data/n29" dev="tmpfs" ino=7100 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 343.676274][ T36] audit: type=1400 audit(2000000097.202:2597): avc: denied { getattr } for pid=148 comm="dhcpcd" path="/run/udev/data/n29" dev="tmpfs" ino=7100 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 343.691718][T17717] can0 (unregistered): slcan off ptm1. [ 343.708897][ T31] usb 6-1: new low-speed USB device number 28 using dummy_hcd [ 343.774309][T17735] netlink: 64 bytes leftover after parsing attributes in process `syz.7.5828'. [ 343.856102][ T31] usb 6-1: device descriptor read/64, error -71 [ 344.099198][ T31] usb 6-1: device descriptor read/64, error -71 [ 344.210998][ T31] usb usb6-port1: attempt power cycle [ 344.275574][T17773] cgroup: fork rejected by pids controller in /syz2 [ 344.347095][T17815] input: syz1 as /devices/virtual/input/input52 [ 344.565006][ T31] usb 6-1: new low-speed USB device number 29 using dummy_hcd [ 344.586170][ T31] usb 6-1: device descriptor read/8, error -71 [ 344.666275][ T10] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 344.679602][ T9] hid-generic C98F:0003:0000.0047: unknown main item tag 0x0 [ 344.687158][ T9] hid-generic C98F:0003:0000.0047: unknown main item tag 0x0 [ 344.695051][ T9] hid-generic C98F:0003:0000.0047: hidraw0: HID v0.00 Device [syz0] on syz1 [ 344.716199][T17843] fido_id[17843]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 344.717792][ T31] usb 6-1: device descriptor read/8, error -71 [ 344.797841][ T10] usb 3-1: device descriptor read/64, error -71 [ 344.979896][ T31] usb 6-1: new low-speed USB device number 30 using dummy_hcd [ 345.001248][ T31] usb 6-1: device descriptor read/8, error -71 [ 345.050705][ T10] usb 3-1: device descriptor read/64, error -71 [ 345.132667][ T31] usb 6-1: device descriptor read/8, error -71 [ 345.243165][ T31] usb usb6-port1: unable to enumerate USB device [ 345.293644][ T10] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 345.425155][ T10] usb 3-1: device descriptor read/64, error -71 [ 345.671856][ T10] usb 3-1: device descriptor read/64, error -71 [ 345.789526][ T10] usb usb3-port1: attempt power cycle [ 345.915774][T17877] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 345.919843][T17878] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 345.926866][T17878] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 345.935780][T17878] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:308 [ 346.032792][T17884] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:314 [ 346.143158][ T10] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 346.184684][ T10] usb 3-1: device descriptor read/8, error -71 [ 346.222071][T17901] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5869'. [ 346.326330][ T10] usb 3-1: device descriptor read/8, error -71 [ 346.385829][ T31] usb 6-1: new low-speed USB device number 31 using dummy_hcd [ 346.520684][T17910] can0: slcan on ttyS3. [ 346.559137][ T31] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 8 [ 346.571533][T17910] can0 (unregistered): slcan off ttyS3. [ 346.578151][ T10] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 346.581468][ T31] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 346.616592][ T31] usb 6-1: New USB device found, idVendor=046d, idProduct=c71b, bcdDevice= 0.00 [ 346.627677][ T31] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.629560][ T10] usb 3-1: device descriptor read/8, error -71 [ 346.644702][ T31] usb 6-1: config 0 descriptor?? [ 346.678988][T17896] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 346.701312][T17918] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 3 [ 346.720408][T17918] rust_binder: Write failure EINVAL in pid:283 [ 346.781424][ T10] usb 3-1: device descriptor read/8, error -71 [ 346.834532][T17935] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 346.834700][T17935] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 346.901400][ T10] usb usb3-port1: unable to enumerate USB device [ 346.915889][ T36] kauditd_printk_skb: 23 callbacks suppressed [ 346.915910][ T36] audit: type=1400 audit(2000000100.484:2621): avc: denied { map } for pid=17947 comm="syz.0.5879" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 346.947792][ T31] usb 6-1: USB disconnect, device number 31 [ 346.975845][T17954] sit0: entered promiscuous mode [ 346.978695][ T36] audit: type=1400 audit(2000000100.484:2622): avc: denied { execute } for pid=17947 comm="syz.0.5879" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 346.989223][T17956] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:326 [ 347.008041][T17954] netlink: 'syz.0.5880': attribute type 1 has an invalid length. [ 347.025489][T17960] SELinux: security_context_str_to_sid (0x0000000000000004NAFwe:.b JOJx HID v0.00 Device [syz0] on syz1 [ 352.496532][T18176] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 352.517081][ T422] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 352.597320][ T422] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 352.642208][ T422] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 352.656509][ T422] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 352.673826][ T422] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 352.679019][T18173] fido_id[18173]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 352.702460][ T422] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.731651][ T422] usb 3-1: config 0 descriptor?? [ 353.187375][ T422] plantronics 0003:047F:FFFF.004A: ignoring exceeding usage max [ 353.199748][ T422] plantronics 0003:047F:FFFF.004A: No inputs registered, leaving [ 353.211238][ T422] plantronics 0003:047F:FFFF.004A: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 353.366834][ T9] usb 6-1: new low-speed USB device number 33 using dummy_hcd [ 353.447994][ T31] usb 3-1: USB disconnect, device number 110 [ 353.517677][ T9] usb 6-1: Invalid ep0 maxpacket: 32 [ 353.648575][ T9] usb 6-1: new low-speed USB device number 34 using dummy_hcd [ 353.799568][ T9] usb 6-1: Invalid ep0 maxpacket: 32 [ 353.805446][ T9] usb usb6-port1: attempt power cycle [ 353.995147][T18191] rust_binder: validate_parent_fixup: new_min_offset=56, sg_entry.length=0 [ 353.995178][T18191] rust_binder: Error while translating object. [ 354.003900][T18191] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 354.010098][T18191] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:749 [ 354.151912][ T9] usb 6-1: new low-speed USB device number 35 using dummy_hcd [ 354.183623][ T9] usb 6-1: Invalid ep0 maxpacket: 32 [ 354.203149][T18201] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 354.312984][ T9] usb 6-1: new low-speed USB device number 36 using dummy_hcd [ 354.335497][T18207] rust_binder: Write failure EINVAL in pid:765 [ 354.344784][ T9] usb 6-1: Invalid ep0 maxpacket: 32 [ 354.356474][ T9] usb usb6-port1: unable to enumerate USB device [ 354.642243][T18228] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 354.645968][T18228] rust_binder: Failed to allocate buffer. len:96, is_oneway:false [ 354.654565][T18228] rust_binder: Error while translating object. [ 354.662749][T18228] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 354.669271][T18228] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:786 [ 354.714811][T18230] rust_binder: Error while translating object. [ 354.724149][T18230] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 354.730607][T18230] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:788 [ 354.781217][T18232] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 354.799388][T18232] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.017460][ T9] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 355.051524][T16804] Bluetooth: hci0: Frame reassembly failed (-84) [ 355.181253][ T9] usb 3-1: config 1 interface 0 altsetting 100 bulk endpoint 0x82 has invalid maxpacket 32 [ 355.191690][ T9] usb 3-1: config 1 interface 0 altsetting 100 bulk endpoint 0x3 has invalid maxpacket 1023 [ 355.202523][ T9] usb 3-1: config 1 interface 0 has no altsetting 0 [ 355.212325][ T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 355.221727][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 355.229784][ T9] usb 3-1: Product: 嘂栂旻봃亵䟧 [ 355.235615][ T9] usb 3-1: Manufacturer: М [ 355.240170][ T9] usb 3-1: SerialNumber: 失锨汁씾豑畅珈튱薧䮟⑖릴ᰶﻧ궦꒼層ꦴꞳ뭱벁䁉╬콢⺻ꈼ༼ [ 355.255285][T18233] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 355.263009][T18233] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 355.678346][ T9] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -71 [ 355.698256][ T9] usb 3-1: USB disconnect, device number 111 [ 356.255298][T18239] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:362 [ 356.299087][T18243] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 356.350147][T18249] binder: Unknown parameter 'defcontext' [ 356.350991][T18250] input: syz1 as /devices/virtual/input/input54 [ 356.367918][T18249] binder: Unknown parameter 'defcontext' [ 356.538820][T18264] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5981'. [ 356.557246][T18267] rust_binder: Failed to allocate buffer. len:136, is_oneway:false [ 356.848203][ T10] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 357.009167][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 357.017393][ T10] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 357.029540][ T10] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 357.039719][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 357.046707][ T10] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 357.055789][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 357.065657][ T10] usb 3-1: config 0 descriptor?? [ 357.072421][ T36] kauditd_printk_skb: 858 callbacks suppressed [ 357.072441][ T36] audit: type=1400 audit(2000000110.576:4361): avc: denied { ioctl } for pid=18268 comm="syz.2.5983" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x550a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 357.105423][ T36] audit: type=1400 audit(2000000110.576:4362): avc: denied { ioctl } for pid=18268 comm="syz.2.5983" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5509 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 357.130493][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 357.137961][ T36] audit: type=1400 audit(2000000110.576:4363): avc: denied { ioctl } for pid=18268 comm="syz.2.5983" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5505 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 357.166775][ T36] audit: type=1400 audit(2000000110.576:4364): avc: denied { ioctl } for pid=18268 comm="syz.2.5983" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 357.193982][ T36] audit: type=1400 audit(2000000110.665:4365): avc: denied { read write } for pid=17208 comm="syz-executor" name="loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 357.219440][ T36] audit: type=1400 audit(2000000110.665:4366): avc: denied { read write open } for pid=17208 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 357.253548][ T36] audit: type=1400 audit(2000000110.665:4367): avc: denied { ioctl } for pid=17208 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=56 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 357.279820][ T36] audit: type=1400 audit(2000000110.755:4368): avc: denied { associate } for pid=18270 comm="syz.7.5984" name="pfkey" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 357.302369][ T36] audit: type=1400 audit(2000000110.785:4369): avc: denied { read } for pid=18270 comm="syz.7.5984" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 357.325882][ T36] audit: type=1400 audit(2000000110.785:4370): avc: denied { read open } for pid=18270 comm="syz.7.5984" path="/dev/uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 357.351404][T18271] input: syz1 as /devices/virtual/input/input55 [ 357.457737][T18280] tmpfs: Bad value for 'nr_inodes' [ 357.530494][T18269] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 357.542171][T18269] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 357.572687][T18269] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 112, limit: 128, size: 89) [ 357.572717][T18269] rust_binder: Error while translating object. [ 357.603576][T18269] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 357.610165][T18269] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:804 [ 357.642142][ T10] usbhid 3-1:0.0: can't add hid device: -71 [ 357.664828][ T10] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 357.674485][ T10] usb 3-1: USB disconnect, device number 112 [ 358.025446][T18299] rust_binder: Error while translating object. [ 358.025489][T18299] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 358.031961][T18299] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:256 [ 358.087142][T18301] rust_binder: Error while translating object. [ 358.096617][T18301] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 358.102948][T18301] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:258 [ 358.286107][T18312] fuse: Unknown parameter 'rootmode' [ 358.748077][ T10] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 358.901246][ T10] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 358.913137][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 358.924169][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 358.933959][ T10] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 358.947402][ T10] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 358.956515][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 358.966328][ T10] usb 6-1: config 0 descriptor?? [ 359.386139][ T10] plantronics 0003:047F:FFFF.004B: ignoring exceeding usage max [ 359.412229][ T10] plantronics 0003:047F:FFFF.004B: No inputs registered, leaving [ 359.451750][ T10] plantronics 0003:047F:FFFF.004B: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 359.600098][ T10] usb 6-1: USB disconnect, device number 37 [ 359.717164][T18344] fido_id[18344]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 359.763663][T18354] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 359.885128][T18354] rust_binder: Error while translating object. [ 359.891713][T18354] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 359.903604][T18354] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:282 [ 359.955549][T18362] input: syz0 as /devices/virtual/input/input56 [ 360.097627][T18367] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 360.097653][T18367] rust_binder: Read failure Err(EFAULT) in pid:286 [ 360.215355][T18371] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=18371 comm=syz.2.6016 [ 360.320325][T18378] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 360.320357][T18378] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 360.349427][T18378] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:291 [ 360.520411][T18384] rust_binder: validate_parent_fixup: new_min_offset=56, sg_entry.length=0 [ 360.539298][T18386] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 360.555725][T18384] rust_binder: Error while translating object. [ 360.566309][T18386] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 360.574765][T18384] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 360.582273][T18386] rust_binder: Write failure EINVAL in pid:841 [ 360.591889][T18384] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:293 [ 360.594614][T18386] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 360.787400][ T422] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 360.891523][ T307] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 360.928059][ T422] usb 6-1: device descriptor read/64, error -71 [ 361.051741][ T307] usb 3-1: unable to get BOS descriptor or descriptor too short [ 361.061058][ T307] usb 3-1: config 0 has an invalid interface number: 57 but max is 0 [ 361.070313][ T307] usb 3-1: config 0 has no interface number 0 [ 361.076436][ T307] usb 3-1: config 0 interface 57 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 361.087373][ T307] usb 3-1: config 0 interface 57 altsetting 1 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 361.098256][ T307] usb 3-1: config 0 interface 57 altsetting 1 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 361.109316][ T307] usb 3-1: config 0 interface 57 has no altsetting 0 [ 361.121601][ T307] usb 3-1: New USB device found, idVendor=05ac, idProduct=0253, bcdDevice=b1.e9 [ 361.130756][ T307] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.138905][ T307] usb 3-1: Product: syz [ 361.143100][ T307] usb 3-1: Manufacturer: syz [ 361.147694][ T307] usb 3-1: SerialNumber: syz [ 361.154326][ T307] usb 3-1: config 0 descriptor?? [ 361.179129][ T422] usb 6-1: device descriptor read/64, error -71 [ 361.369534][ T9] hid-generic C98F:0006:0005.004C: unknown main item tag 0x0 [ 361.377097][ T9] hid-generic C98F:0006:0005.004C: unknown main item tag 0x0 [ 361.386442][ T9] hid-generic C98F:0006:0005.004C: hidraw0: HID v8000.01 Device [syz0] on syz1 [ 361.401189][ T307] usbhid 3-1:0.57: couldn't find an input interrupt endpoint [ 361.420629][ T422] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 361.425991][ T307] usb 3-1: USB disconnect, device number 113 [ 361.489166][T18400] fido_id[18400]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 361.570783][ T422] usb 6-1: device descriptor read/64, error -71 [ 361.811718][ T422] usb 6-1: device descriptor read/64, error -71 [ 361.923874][ T422] usb usb6-port1: attempt power cycle [ 361.952388][T18402] tipc: Enabled bearer , priority 0 [ 361.960908][T18402] tipc: Disabling bearer [ 362.012994][T18404] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 362.111676][ T36] kauditd_printk_skb: 716 callbacks suppressed [ 362.111698][ T36] audit: type=1400 audit(2000000115.582:5087): avc: denied { unlink } for pid=14940 comm="syz-executor" name="file5" dev="tmpfs" ino=1544 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 362.149999][ T36] audit: type=1400 audit(2000000115.592:5088): avc: denied { read write } for pid=14940 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 362.175138][ T36] audit: type=1400 audit(2000000115.592:5089): avc: denied { read write open } for pid=14940 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 362.195779][ T307] hid-generic C98F:0003:0000.004D: unknown main item tag 0x0 [ 362.212829][ T36] audit: type=1400 audit(2000000115.592:5090): avc: denied { ioctl } for pid=14940 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 362.217946][ T307] hid-generic C98F:0003:0000.004D: unknown main item tag 0x0 [ 362.241724][ T36] audit: type=1400 audit(2000000115.622:5091): avc: denied { mounton } for pid=18416 comm="syz.2.6034" path="/syzcgroup/unified/syz2" dev="cgroup2" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 362.248368][ T307] hid-generic C98F:0003:0000.004D: hidraw0: HID v0.00 Device [syz0] on syz1 [ 362.274717][ T36] audit: type=1400 audit(2000000115.632:5092): avc: denied { read write } for pid=14940 comm="syz-executor" name="loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 362.304758][ T422] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 362.333717][ T36] audit: type=1400 audit(2000000115.632:5093): avc: denied { read write open } for pid=14940 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 362.363084][ T36] audit: type=1400 audit(2000000115.632:5094): avc: denied { ioctl } for pid=14940 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=51 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 362.364581][ T422] usb 6-1: device descriptor read/8, error -71 [ 362.392997][ T36] audit: type=1400 audit(2000000115.662:5095): avc: denied { read write } for pid=18418 comm="syz.2.6035" name="binder1" dev="binder" ino=28 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 362.423913][ T36] audit: type=1400 audit(2000000115.662:5096): avc: denied { read write open } for pid=18418 comm="syz.2.6035" path="/dev/binderfs/binder1" dev="binder" ino=28 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 362.464713][T18420] fido_id[18420]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 362.529867][ T422] usb 6-1: device descriptor read/8, error -71 [ 362.775420][ T422] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 362.797904][ T422] usb 6-1: device descriptor read/8, error -71 [ 362.932980][ T422] usb 6-1: device descriptor read/8, error -71 [ 363.047029][ T422] usb usb6-port1: unable to enumerate USB device [ 363.761094][T18447] rust_binder: Error while translating object. [ 363.761124][T18447] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 363.767837][T18447] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:394 [ 363.781514][T18447] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 363.804110][T18447] rust_binder: Error while translating object. [ 363.815871][T18447] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 363.823011][T18447] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:394 [ 364.081337][T18457] rust_binder: Write failure EFAULT in pid:380 [ 364.134996][T18459] SELinux: failed to load policy [ 364.160805][T18459] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 364.164124][T18459] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 364.170795][T18459] rust_binder: Error while translating object. [ 364.181527][T18459] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 364.187737][T18459] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:382 [ 365.533241][T18476] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000000 not found [ 365.551140][T18476] rust_binder: Write failure EINVAL in pid:413 [ 365.614837][T18478] rust_binder: Error while translating object. [ 365.621210][T18478] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 365.628660][T18478] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:415 [ 365.826438][T18481] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 365.845212][T18481] rust_binder: Failed to allocate buffer. len:65376, is_oneway:true [ 365.851808][T18481] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 365.859866][T18481] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:418 [ 365.878414][T18484] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 366.271476][T18499] tipc: Can't bind to reserved service type 2 [ 366.307333][ T306] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 366.332684][T18499] binder: Bad value for 'stats' [ 366.338101][T18501] binder: Unknown parameter '18446744073709551615' [ 366.471672][T18507] UHID_CREATE from different security context by process 432 (syz.5.6063), this is not allowed. [ 366.492219][ T306] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 366.517963][ T306] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 366.529095][ T306] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 366.538996][ T306] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 366.552028][ T306] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 366.561156][ T306] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 366.573991][ T306] usb 3-1: config 0 descriptor?? [ 366.656792][T18511] rust_binder: Failed to allocate buffer. len:65376, is_oneway:true [ 366.656822][T18511] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 366.665066][T18511] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:316 [ 366.735259][ T31] hid-generic C98F:0003:0000.004E: unknown main item tag 0x0 [ 366.752452][ T31] hid-generic C98F:0003:0000.004E: unknown main item tag 0x0 [ 366.761783][ T31] hid-generic C98F:0003:0000.004E: hidraw0: HID v0.00 Device [syz0] on syz1 [ 366.829398][T18514] fido_id[18514]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 366.875380][T18516] can0: slcan on ptm1. [ 366.937426][T18515] can0 (unregistered): slcan off ptm1. [ 366.988641][ T306] usbhid 3-1:0.0: can't add hid device: -71 [ 366.999590][ T306] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 367.025989][ T306] usb 3-1: USB disconnect, device number 114 [ 367.073963][T18523] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2576 sclass=netlink_route_socket pid=18523 comm=syz.7.6070 [ 367.150413][ T36] kauditd_printk_skb: 539 callbacks suppressed [ 367.150433][ T36] audit: type=1400 audit(2000000120.615:5636): avc: denied { read } for pid=18524 comm="syz.7.6071" name="binder0" dev="binder" ino=30 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 367.185115][ T36] audit: type=1400 audit(2000000120.615:5637): avc: denied { read open } for pid=18524 comm="syz.7.6071" path="/dev/binderfs/binder0" dev="binder" ino=30 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 367.209687][ T36] audit: type=1400 audit(2000000120.615:5638): avc: denied { ioctl } for pid=18524 comm="syz.7.6071" path="/dev/binderfs/binder0" dev="binder" ino=30 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 367.238673][T18529] rust_binder: Error while translating object. [ 367.238725][T18529] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 367.245146][T18529] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:329 [ 367.276736][ T36] audit: type=1400 audit(2000000120.615:5639): avc: denied { set_context_mgr } for pid=18524 comm="syz.7.6071" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 367.310239][ T36] audit: type=1400 audit(2000000120.615:5640): avc: denied { map } for pid=18524 comm="syz.7.6071" path="/dev/binderfs/binder0" dev="binder" ino=30 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 367.341498][ T36] audit: type=1400 audit(2000000120.615:5641): avc: denied { read } for pid=18524 comm="syz.7.6071" path="/dev/binderfs/binder0" dev="binder" ino=30 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 367.379817][ T36] audit: type=1326 audit(2000000120.615:5642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18524 comm="syz.7.6071" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fba6438e929 code=0x0 [ 367.385700][T18536] binder: Bad value for 'stats' [ 367.404373][ T36] audit: type=1400 audit(2000000120.615:5643): avc: denied { read write } for pid=15314 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 367.411930][T18535] kernel profiling enabled (shift: 63) [ 367.453293][ T36] audit: type=1400 audit(2000000120.615:5644): avc: denied { read write open } for pid=15314 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 367.469232][T18535] profiling shift: 63 too large [ 367.481310][T18538] netlink: 124 bytes leftover after parsing attributes in process `syz.5.6073'. [ 367.500382][ T36] audit: type=1400 audit(2000000120.615:5645): avc: denied { ioctl } for pid=15314 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=49 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 367.606925][T18542] tipc: Enabling of bearer rejected, media not registered [ 367.736492][T18550] binder: Unknown parameter 'fs5lcontext' [ 367.745802][T18547] binder: Unknown parameter 'stattlSb3' [ 367.792619][T18552] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 367.794297][T18553] rust_binder: Error in use_page_slow: ESRCH [ 367.800873][T18553] rust_binder: use_range failure ESRCH [ 367.808872][T18553] rust_binder: Failed to allocate buffer. len:4224, is_oneway:false [ 367.816123][T18553] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 367.836917][T18553] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:446 [ 368.109334][T18568] netlink: 'syz.2.6083': attribute type 4 has an invalid length. [ 368.128902][T18567] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 368.144270][T18568] netlink: 'syz.2.6083': attribute type 27 has an invalid length. [ 368.152143][T18568] netlink: 3609 bytes leftover after parsing attributes in process `syz.2.6083'. [ 368.162585][ T10] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 368.443388][ T31] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 368.596191][ T31] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 368.607865][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 368.619041][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 368.628934][ T31] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 368.641939][ T31] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 368.651044][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 368.674168][ T31] usb 3-1: config 0 descriptor?? [ 368.702068][T18578] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.089373][ T31] usbhid 3-1:0.0: can't add hid device: -71 [ 369.105140][ T31] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 369.114168][ T31] usb 3-1: USB disconnect, device number 115 [ 369.200447][T18595] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 369.200486][T18595] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:339 [ 369.210553][T18595] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 369.219745][T18595] rust_binder: Read failure Err(EFAULT) in pid:339 [ 369.325620][ T10] usb 6-1: new full-speed USB device number 43 using dummy_hcd [ 369.390384][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.390700][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.406094][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.417728][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.426278][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.433111][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.440334][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.447177][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.454009][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.461825][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.468718][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.475650][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.482522][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.485990][ T10] usb 6-1: device descriptor read/64, error -71 [ 369.489426][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.502166][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.509625][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.516541][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.523425][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.530253][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.537100][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.543891][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.550730][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.557555][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.564411][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.571254][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.578042][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.584825][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.591619][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.598425][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.605287][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.613401][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.621735][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.636648][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.643465][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.666700][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.673519][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.696684][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.703502][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.724523][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.732018][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.740543][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.749168][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.755985][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.756655][ T10] usb 6-1: device descriptor read/64, error -71 [ 369.762965][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.775866][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.783635][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.791264][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.799309][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.806201][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.814367][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.822069][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.826599][T18606] binder: Binderfs stats mode cannot be changed during a remount [ 369.830730][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.843479][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.851466][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.859135][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.866226][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.874389][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.882207][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.889931][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.896794][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.905426][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.913137][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.920843][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.928231][T18599] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 369.938932][T18610] binder: Bad value for 'max' [ 370.007278][ T10] usb 6-1: new full-speed USB device number 44 using dummy_hcd [ 370.038725][T18614] SELinux: Context o} is not valid (left unmapped). [ 370.049355][T18614] fuse: Unknown parameter '000000000000000000030x0000000000000006' [ 370.169469][ T10] usb 6-1: device descriptor read/64, error -71 [ 370.191236][T18621] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 370.236371][T18623] SELinux: failed to load policy [ 370.356818][T18633] rust_binder: Error in use_page_slow: ESRCH [ 370.356846][T18633] rust_binder: use_range failure ESRCH [ 370.370585][T18633] rust_binder: Failed to allocate buffer. len:144, is_oneway:false [ 370.378177][T18633] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 370.406587][T18633] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:910 [ 370.416098][ T10] usb 6-1: device descriptor read/64, error -71 [ 370.473678][T18636] random: crng reseeded on system resumption [ 370.549060][ T10] usb usb6-port1: attempt power cycle [ 370.594651][T18641] netlink: 'syz.0.6108': attribute type 4 has an invalid length. [ 370.602646][T18641] netlink: 'syz.0.6108': attribute type 27 has an invalid length. [ 370.611084][T18641] netlink: 3609 bytes leftover after parsing attributes in process `syz.0.6108'. [ 370.889298][ T10] usb 6-1: new full-speed USB device number 45 using dummy_hcd [ 370.911967][ T10] usb 6-1: device descriptor read/8, error -71 [ 371.041762][ T10] usb 6-1: device descriptor read/8, error -71 [ 371.114543][T18646] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 371.114568][T18646] rust_binder: Read failure Err(EFAULT) in pid:916 [ 371.154059][T18648] binder: Unknown parameter 'defcontext01777777777777777777777' [ 371.154083][T18649] binder: Unknown parameter 'defcontext01777777777777777777777' [ 371.280137][ T10] usb 6-1: new full-speed USB device number 46 using dummy_hcd [ 371.303198][ T10] usb 6-1: device descriptor read/8, error -71 [ 371.442921][ T10] usb 6-1: device descriptor read/8, error -71 [ 371.452890][T18657] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 371.543652][T18659] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 371.550948][ T10] usb usb6-port1: unable to enumerate USB device [ 371.562442][T18659] netlink: 188 bytes leftover after parsing attributes in process `syz.2.6114'. [ 371.914449][T18670] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 371.914467][T18670] rust_binder: Read failure Err(EFAULT) in pid:937 [ 371.923955][T18670] rust_binder: Write failure EINVAL in pid:937 [ 371.931645][T18670] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 371.937840][T18670] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:937 [ 372.111174][T18679] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 372.249067][ T36] kauditd_printk_skb: 1051 callbacks suppressed [ 372.249091][ T36] audit: type=1400 audit(2000000131.687:6697): avc: denied { read write } for pid=15314 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 372.280469][T18683] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 372.291246][T18683] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 372.301208][ T36] audit: type=1400 audit(2000000131.687:6698): avc: denied { read write open } for pid=15314 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 372.332766][ T36] audit: type=1400 audit(2000000131.687:6699): avc: denied { ioctl } for pid=15314 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=49 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 372.360407][ T36] audit: type=1400 audit(2000000131.717:6700): avc: denied { read } for pid=18682 comm="syz.0.6123" name="binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 372.384159][ T36] audit: type=1400 audit(2000000131.717:6701): avc: denied { read open } for pid=18682 comm="syz.0.6123" path="/dev/binderfs/binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 372.393124][T18686] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 372.410380][ T36] audit: type=1400 audit(2000000131.717:6702): avc: denied { ioctl } for pid=18682 comm="syz.0.6123" path="/dev/binderfs/binder0" dev="binder" ino=16 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 372.419659][ T10] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 372.447250][ T36] audit: type=1400 audit(2000000131.737:6703): avc: denied { ioctl } for pid=18678 comm="syz.5.6121" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 372.479108][ T36] audit: type=1400 audit(2000000131.737:6704): avc: denied { ioctl } for pid=18682 comm="syz.0.6123" path="/newroot/dev/binderfs/binder0" dev="binder" ino=16 ioctlcmd=0x6207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 372.506568][ T36] audit: type=1400 audit(2000000131.787:6705): avc: denied { read write } for pid=15314 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 372.532035][ T36] audit: type=1400 audit(2000000131.787:6706): avc: denied { read write open } for pid=15314 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 372.643932][ T10] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 372.661173][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 372.691135][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 372.701008][ T10] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 372.715114][ T10] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 372.725095][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.737133][ T10] usb 6-1: config 0 descriptor?? [ 372.936930][T18694] tun0: tun_chr_ioctl cmd 1074025676 [ 372.942443][T18694] tun0: owner set to 0 [ 372.952859][T18694] tun0: tun_chr_ioctl cmd 1074025680 [ 372.959885][T18694] cgroup: Unknown subsys name 'dont_hash' [ 373.155221][ T10] usbhid 6-1:0.0: can't add hid device: -71 [ 373.178146][ T10] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 373.220715][ T10] usb 6-1: USB disconnect, device number 47 [ 373.633527][T18730] rust_binder: Error in use_page_slow: ESRCH [ 373.633552][T18730] rust_binder: use_range failure ESRCH [ 373.635311][T18734] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 373.639663][T18730] rust_binder: Failed to allocate buffer. len:120, is_oneway:true [ 373.651809][T18730] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 373.670392][T18730] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:976 [ 373.935164][T18750] overlayfs: conflicting options: metacopy=off,verity=on [ 374.212355][T18775] binder: Unknown parameter '0xffffffffffffffff' [ 374.278528][T18778] cgroup: Invalid name [ 374.304608][T18778] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 374.399401][T18785] binder: Bad value for 'max' [ 374.414718][T18787] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 374.421549][T18787] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 374.441030][T18787] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:485 [ 374.451209][T18787] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 374.460451][T18787] rust_binder: Read failure Err(EFAULT) in pid:485 [ 374.515141][T18795] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 374.630092][T18796] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 374.641663][T18796] fuse: Invalid rootmode [ 374.657988][T18796] rust_binder: Write failure EINVAL in pid:487 [ 374.862088][ T422] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 375.021173][ T422] usb 3-1: Using ep0 maxpacket: 16 [ 375.028738][ T422] usb 3-1: config 247 has an invalid interface number: 79 but max is 0 [ 375.037950][ T422] usb 3-1: config 247 has no interface number 0 [ 375.044467][ T422] usb 3-1: config 247 interface 79 has no altsetting 0 [ 375.054540][ T422] usb 3-1: New USB device found, idVendor=03eb, idProduct=2002, bcdDevice= 1.18 [ 375.063885][ T422] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.071932][ T422] usb 3-1: Product: syz [ 375.076365][ T422] usb 3-1: Manufacturer: syz [ 375.080956][ T422] usb 3-1: SerialNumber: syz [ 375.304427][ T422] usb 3-1: USB disconnect, device number 117 [ 375.677690][T18813] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 375.681240][T18813] rust_binder: Error while translating object. [ 375.687841][T18813] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 375.694085][T18813] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:497 [ 376.074771][T18836] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6177'. [ 376.093916][ T422] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 376.094234][T18836] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6177'. [ 376.167106][T18836] binder: Bad value for 'max' [ 376.251142][ T422] usb 6-1: Using ep0 maxpacket: 32 [ 376.263905][ T422] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 376.274359][ T422] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 376.286939][ T422] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=c1.ee [ 376.296184][ T422] usb 6-1: New USB device strings: Mfr=52, Product=2, SerialNumber=3 [ 376.304463][ T422] usb 6-1: Product: syz [ 376.308969][ T422] usb 6-1: Manufacturer: syz [ 376.313784][ T422] usb 6-1: SerialNumber: syz [ 376.320036][ T422] usb 6-1: config 0 descriptor?? [ 376.481289][ T31] usb 3-1: new full-speed USB device number 118 using dummy_hcd [ 376.621263][ T31] usb 3-1: device descriptor read/64, error -71 [ 376.861210][ T31] usb 3-1: device descriptor read/64, error -71 [ 377.101541][ T31] usb 3-1: new full-speed USB device number 119 using dummy_hcd [ 377.251200][ T31] usb 3-1: device descriptor read/64, error -71 [ 377.361853][ T36] kauditd_printk_skb: 758 callbacks suppressed [ 377.361873][ T36] audit: type=1400 audit(2000000142.814:7465): avc: denied { ioctl } for pid=18846 comm="syz.2.6179" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 377.394497][ T36] audit: type=1400 audit(2000000142.814:7466): avc: denied { ioctl } for pid=18846 comm="syz.2.6179" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 377.420490][ T36] audit: type=1400 audit(2000000142.814:7467): avc: denied { ioctl } for pid=18846 comm="syz.2.6179" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 377.445925][ T36] audit: type=1400 audit(2000000142.814:7468): avc: denied { ioctl } for pid=18846 comm="syz.2.6179" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 377.471913][ T36] audit: type=1400 audit(2000000142.814:7469): avc: denied { ioctl } for pid=18846 comm="syz.2.6179" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 377.496908][ T36] audit: type=1400 audit(2000000142.814:7470): avc: denied { ioctl } for pid=18846 comm="syz.2.6179" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 377.501164][ T31] usb 3-1: device descriptor read/64, error -71 [ 377.522046][ T36] audit: type=1400 audit(2000000142.814:7471): avc: denied { ioctl } for pid=18846 comm="syz.2.6179" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 377.570772][ T36] audit: type=1400 audit(2000000142.884:7472): avc: denied { ioctl } for pid=18846 comm="syz.2.6179" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 377.585254][T18853] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 377.597485][ T36] audit: type=1400 audit(2000000142.974:7473): avc: denied { read write } for pid=15314 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 377.610700][T18853] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6181'. [ 377.628248][ T36] audit: type=1400 audit(2000000142.974:7474): avc: denied { read write open } for pid=15314 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 377.662522][ T31] usb usb3-port1: attempt power cycle [ 378.001197][ T31] usb 3-1: new full-speed USB device number 120 using dummy_hcd [ 378.023759][ T31] usb 3-1: device descriptor read/8, error -71 [ 378.153636][ T31] usb 3-1: device descriptor read/8, error -71 [ 378.391176][ T31] usb 3-1: new full-speed USB device number 121 using dummy_hcd [ 378.423823][ T31] usb 3-1: device descriptor read/8, error -71 [ 378.553536][ T31] usb 3-1: device descriptor read/8, error -71 [ 378.661317][ T31] usb usb3-port1: unable to enumerate USB device [ 378.784674][ T31] usb 6-1: USB disconnect, device number 48 [ 378.974585][T18863] binder: Unknown parameter 'fscontext?}' [ 379.518471][T18894] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 379.531838][T18894] SELinux: failed to load policy [ 379.540612][T18894] rust_binder: Fixups oob 154 158 203 174 [ 379.540633][T18894] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EINVAL } [ 379.546547][T18894] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 379.555004][T18894] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1037 [ 379.771178][ T306] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 379.931156][ T306] usb 6-1: Using ep0 maxpacket: 32 [ 379.938815][ T306] usb 6-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 379.949928][ T306] usb 6-1: config 0 interface 0 altsetting 16 has an invalid descriptor for endpoint zero, skipping [ 379.960935][ T306] usb 6-1: config 0 interface 0 altsetting 16 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 379.974031][ T306] usb 6-1: config 0 interface 0 has no altsetting 0 [ 379.980765][ T306] usb 6-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 379.989841][ T306] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 380.001738][ T306] usb 6-1: config 0 descriptor?? [ 380.238025][T18899] rust_binder: Failed to allocate buffer. len:160, is_oneway:false [ 380.329693][T16805] Bluetooth: hci0: Frame reassembly failed (-84) [ 380.371918][T18905] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 4200, limit: 4216, size: 18446744073709550742) [ 380.371948][T18905] rust_binder: Error while translating object. [ 380.373439][T16805] Bluetooth: hci0: Frame reassembly failed (-84) [ 380.386740][T18905] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 380.397174][T18905] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:380 [ 380.623014][T18915] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 380.631186][T18913] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 380.647758][T18913] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 380.672533][T18915] rust_binder: Error in use_page_slow: ESRCH [ 380.672557][T18915] rust_binder: use_range failure ESRCH [ 380.678605][T18915] rust_binder: Failed to allocate buffer. len:4224, is_oneway:false [ 380.684504][ T306] usbhid 6-1:0.0: can't add hid device: -71 [ 380.708142][ T306] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 380.716753][T18915] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 380.716794][T18915] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:441 [ 380.728094][ T306] usb 6-1: USB disconnect, device number 49 [ 380.835134][T18923] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 380.837449][T18923] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:443 [ 381.045265][T18934] syzkaller0: entered promiscuous mode [ 381.060295][T18934] syzkaller0: entered allmulticast mode [ 381.468426][T18950] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 381.468455][T18950] rust_binder: Error while translating object. [ 381.479216][T18950] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 381.485538][T18950] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1050 [ 381.746021][T18968] binder: Bad value for 'defcontext' [ 382.211182][ T422] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 382.252037][T19009] rust_binder: Error while translating object. [ 382.252066][T19009] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 382.258254][T19009] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:478 [ 382.351026][T19013] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 382.367031][T19013] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 382.373673][T19013] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:482 [ 382.381228][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 382.383171][T18237] Bluetooth: hci0: command 0x1003 tx timeout [ 382.395676][ T422] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 382.398509][ T36] kauditd_printk_skb: 650 callbacks suppressed [ 382.398539][ T36] audit: type=1400 audit(2000000147.844:8125): avc: denied { ioctl } for pid=18988 comm="syz.5.6224" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 382.417025][ T9] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 382.442404][ T36] audit: type=1400 audit(2000000147.844:8126): avc: denied { ioctl } for pid=18988 comm="syz.5.6224" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 382.452561][ T422] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 382.481383][ T36] audit: type=1400 audit(2000000147.844:8127): avc: denied { ioctl } for pid=18988 comm="syz.5.6224" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 382.524490][ T36] audit: type=1400 audit(2000000147.844:8128): avc: denied { ioctl } for pid=18988 comm="syz.5.6224" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 382.551705][ T36] audit: type=1400 audit(2000000147.844:8129): avc: denied { ioctl } for pid=18988 comm="syz.5.6224" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 382.579937][ T36] audit: type=1400 audit(2000000147.864:8130): avc: denied { ioctl } for pid=18988 comm="syz.5.6224" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 382.590227][T19017] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 382.605953][ T422] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 382.614370][T19017] rust_binder: Write failure EINVAL in pid:484 [ 382.629113][ T422] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 382.644051][ T36] audit: type=1400 audit(2000000147.864:8131): avc: denied { read write } for pid=15314 comm="syz-executor" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 382.671123][ T422] usb 6-1: SerialNumber: syz [ 382.687588][ T36] audit: type=1400 audit(2000000147.864:8132): avc: denied { read write open } for pid=15314 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 382.713271][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 382.732039][ T36] audit: type=1400 audit(2000000147.864:8133): avc: denied { ioctl } for pid=15314 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=49 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 382.762444][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 78, changing to 10 [ 382.768897][ T36] audit: type=1400 audit(2000000147.904:8134): avc: denied { read write } for pid=17208 comm="syz-executor" name="loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 382.784736][T19022] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 382.806336][T19025] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 2 [ 382.820356][ T9] usb 3-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00 [ 382.822277][T19025] rust_binder: Write failure EINVAL in pid:388 [ 382.829795][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 382.833888][T19022] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 382.840360][ T9] usb 3-1: config 0 descriptor?? [ 382.918630][T18990] netlink: 240 bytes leftover after parsing attributes in process `syz.5.6224'. [ 382.952099][ T422] usb 6-1: 0:2 : does not exist [ 382.960678][ T422] usb 6-1: USB disconnect, device number 50 [ 383.020269][ T5542] udevd[5542]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 383.264626][ T9] holtek 0003:1241:5015.004F: unknown global tag 0xe [ 383.271459][ T9] holtek 0003:1241:5015.004F: item 0 0 1 14 parsing failed [ 383.278895][ T9] holtek 0003:1241:5015.004F: parse failed [ 383.285397][ T9] holtek 0003:1241:5015.004F: probe with driver holtek failed with error -22 [ 383.525043][T19030] binder: Bad value for 'defcontext' [ 383.710155][T19039] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 383.773779][T19044] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 383.956938][T19051] futex_wake_op: syz.7.6245 tries to shift op by 144; fix this program [ 384.131315][T19061] rust_binder: Got transaction with invalid offset. [ 384.131376][T19061] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 384.139176][T19061] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:407 [ 384.372927][T16804] tipc: Subscription rejected, illegal request [ 384.523382][T19078] __vm_enough_memory: pid: 19078, comm: syz.0.6252, bytes: 70373039144960 not enough memory for the allocation [ 384.529161][T19074] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 384.556174][T19078] __vm_enough_memory: pid: 19078, comm: syz.0.6252, bytes: 70373039144960 not enough memory for the allocation [ 384.562694][T19074] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:571 [ 384.577247][T19074] rust_binder: Error while translating object. [ 384.587715][T19074] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 384.594876][T19074] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:571 [ 384.898993][T19089] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6256'. [ 384.920849][T19089] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6256'. [ 385.016979][T19093] binder: Unknown parameter 'deH֦fconte~d Xe )ah]~giR8{^eOg1خdST?[̗p#[":qcݴշ][9?<4oRv^`p7Kp2?m+Hf]Gē3-c(]"B 0b 31 c0 e9 b6 00 00 00 41 83 fd 0a 0f 87 aa 00 00 00 44 89 6c [ 389.927951][T19226] RSP: 0018:ffffc90008f67980 EFLAGS: 00010246 [ 389.934135][T19226] RAX: 0000000000000000 RBX: 1ffff920011ecf34 RCX: 0000000000000000 [ 389.942152][T19226] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90008f67a28 [ 389.950167][T19226] RBP: ffffc90008f67ac0 R08: ffffc90008f67a27 R09: 0000000000000000 [ 389.958281][T19226] R10: ffffc90008f67a10 R11: fffff520011ecf45 R12: ffffc90008f679c0 [ 389.966326][T19226] R13: 000000000000001d R14: dffffc0000000000 R15: 0000000000000000 [ 389.974533][T19226] FS: 00007efc3ca916c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 389.983707][T19226] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 389.990419][T19226] CR2: 0000200000001000 CR3: 00000001371cc000 CR4: 00000000003526b0 [ 389.998523][T19226] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000005325 [ 390.006560][T19226] DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400 [ 390.014681][T19226] Call Trace: [ 390.017996][T19226] [ 390.020948][T19226] ? match_int+0x16b/0x1f0 [ 390.025529][T19226] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 390.031349][T19226] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 390.037104][T19226] ___kmalloc_large_node+0x9c/0x1d0 [ 390.042624][T19226] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 390.048324][T19226] __kmalloc_large_node_noprof+0x1e/0xe0 [ 390.054010][T19226] ? incfs_realloc_mount_info+0xa7/0x4d0 [ 390.059680][T19226] __kmalloc_noprof+0x26d/0x450 [ 390.064648][T19226] incfs_realloc_mount_info+0xa7/0x4d0 [ 390.070172][T19226] ? sync_filesystem+0x249/0x270 [ 390.075158][T19226] incfs_remount_fs+0x129/0x1c0 [ 390.080221][T19226] ? __cfi_incfs_remount_fs+0x10/0x10 [ 390.085652][T19226] ? shrink_dcache_sb+0x110/0x160 [ 390.090717][T19226] ? __cfi_shrink_dcache_sb+0x10/0x10 [ 390.096155][T19226] ? __cfi_incfs_remount_fs+0x10/0x10 [ 390.101608][T19226] legacy_reconfigure+0x112/0x130 [ 390.106895][T19226] reconfigure_super+0x236/0x8b0 [ 390.111891][T19226] path_mount+0xd21/0x1050 [ 390.116432][T19226] __se_sys_mount+0x2bd/0x480 [ 390.121166][T19226] ? __x64_sys_mount+0xf0/0xf0 [ 390.125975][T19226] ? __kasan_check_write+0x18/0x20 [ 390.131141][T19226] ? fpregs_restore_userregs+0x11d/0x260 [ 390.136814][T19226] __x64_sys_mount+0xc3/0xf0 [ 390.141564][T19226] x64_sys_call+0x2021/0x2ee0 [ 390.146365][T19226] do_syscall_64+0x58/0xf0 [ 390.150788][T19226] ? clear_bhb_loop+0x50/0xa0 [ 390.155516][T19226] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 390.161584][T19226] RIP: 0033:0x7efc3bb8e929 [ 390.166019][T19226] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 390.185933][T19226] RSP: 002b:00007efc3ca91038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 390.194475][T19226] RAX: ffffffffffffffda RBX: 00007efc3bdb5fa0 RCX: 00007efc3bb8e929 [ 390.202507][T19226] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000000 [ 390.210515][T19226] RBP: 00007efc3bc10b39 R08: 0000200000000480 R09: 0000000000000000 [ 390.218535][T19226] R10: 0000000000048030 R11: 0000000000000246 R12: 0000000000000000 [ 390.226583][T19226] R13: 0000000000000000 R14: 00007efc3bdb5fa0 R15: 00007ffc15ef15d8 [ 390.234722][T19226] [ 390.237777][T19226] ---[ end trace 0000000000000000 ]--- [ 390.371165][ T31] usb 6-1: device descriptor read/64, error -71 [ 390.481255][ T31] usb usb6-port1: attempt power cycle [ 390.821149][ T31] usb 6-1: new full-speed USB device number 54 using dummy_hcd [ 390.843638][ T31] usb 6-1: device descriptor read/8, error -71 [ 390.984424][ T31] usb 6-1: device descriptor read/8, error -71 [ 391.221176][ T31] usb 6-1: new full-speed USB device number 55 using dummy_hcd [ 391.243659][ T31] usb 6-1: device descriptor read/8, error -71 [ 391.373594][ T31] usb 6-1: device descriptor read/8, error -71 [ 391.481305][ T31] usb usb6-port1: unable to enumerate USB device