last executing test programs: 2.727362946s ago: executing program 0 (id=588): mknod$loop(&(0x7f0000000080)='./file0\x00', 0x10, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r0, &(0x7f0000001240)=""/102400, 0x19000, 0x80000000000000) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581", @ANYRES8], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000500)={{0x12, 0x1, 0x110, 0x5d, 0x82, 0x2c, 0x10, 0x4b4, 0x6830, 0x683b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x8c, 0x2, 0x0, 0xd6, 0xc2, 0x69}}]}}]}}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x4, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000100)="66b9f502000066b8689d000066ba000000000f30baf80c66b868f1eb8366efbafc0c66b80200000066efdcf638f566b9810a000066b80d00000066ba000000000f30f20f3289eed9dd2e0fe32e5bedba6100b0d7ee", 0x55}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = fsmount(0xffffffffffffffff, 0x1, 0x8) fsetxattr$security_ima(r6, 0x0, 0x0, 0x0, 0x0) keyctl$reject(0x13, 0x0, 0x5, 0x7fffffffffffffff, 0x0) syz_usb_control_io(r2, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0) r7 = syz_open_dev$hiddev(&(0x7f0000000000), 0x0, 0x8ad40) ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0xd01c4813, &(0x7f0000000140)={0x2, 0xffffffff, 0xb0a96d0, 0xfffffffe, 0x4}) r8 = getuid() r9 = accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000180)={0x1f, 0x0, @fixed}, &(0x7f00000001c0)=0xe, 0x80000) setsockopt$sock_int(r9, 0x1, 0x9, &(0x7f0000000200)=0x8, 0x4) mount$fuseblk(&(0x7f0000002440), &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x200840c, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000020000,user_id=', @ANYRESDEC=r8, @ANYBLOB="2c00000000000000033d", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) read$FUSE(0xffffffffffffffff, &(0x7f0000000c40)={0x2020}, 0x2020) ioctl$HIDIOCGUSAGE(r7, 0xc018480b, &(0x7f00000000c0)={0x3, 0x200, 0x9, 0x40, 0x3a, 0x100}) 2.331357882s ago: executing program 1 (id=593): socket$can_raw(0x1d, 0x3, 0x1) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r0, &(0x7f0000000980)={0x2020}, 0x2020) getsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, 0x0, &(0x7f0000000000)) 2.312322703s ago: executing program 1 (id=594): mount_setattr(0xffffffffffffffff, 0x0, 0x8100, 0x0, 0x0) syz_usb_connect$printer(0x0, 0x0, 0x0, &(0x7f0000000d40)={0x0, 0x0, 0xd6, &(0x7f00000004c0)={0x5, 0xf, 0xd6, 0x4, [@ssp_cap={0x24, 0x10, 0xa, 0x5, 0x6, 0x7fffff9, 0xf000, 0x0, [0x1013f0f, 0x1800f, 0x0, 0x7, 0x3f00, 0xf]}, @generic={0x6b, 0x10, 0xa, "51426fe02bb39a227ab0fce579b905dc7e657032b1e936485d482dfa7b185a9359a33760413a6ff5e85da6f00c14fd3a8529127d11466a87f70e1d838b88e8f4d2d73ac46f70287b6b6a56670c80980614c6b0e61b34b5df3c9d88e9ac39a7649108ffbdc84639cf"}, @ssp_cap={0x20, 0x10, 0xa, 0x9, 0x5, 0x3, 0xff0f, 0xfff, [0x30, 0x0, 0xff30, 0xff0000, 0x30]}, @generic={0x22, 0x10, 0x4, "397998ab274886087e9882c1aab537e59ec62d3b9274d68f9a098ac370dda0"}]}}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000fc0200000000000000000000000000000000000000000000000000000000000000000003000000000a00002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000080ffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000ddfd99685c0000000000000000000000000000000000000084010500ac14143b000000000000000000000000000000002b00000000000000ac14140c000000000000000000000000000000000000ff00000000000000000000000000fc020000000000000000000000000000000000003200000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff020000000000000000000000000001000000003c00000002000000ac1414bb0000000000000000000000000000000001030000000000000000000000000000ff020000000000000000000000000001000000003c000000020000"], 0x23c}}, 0x0) 1.86872852s ago: executing program 2 (id=608): syz_open_dev$loop(&(0x7f0000000080), 0xa117, 0x241000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000000010104000000000000000002001000240002801400018008000100e000000108000200e00000010c000280050001000000ff841c0010800800014000000000d97405010000000008000240000000000800", @ANYRES64=r1], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 1.8684748s ago: executing program 2 (id=609): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) (async) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000440), 0x10) listen(r2, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f00000000c0)='?', 0x1}], 0x1) (async) writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f00000000c0)='?', 0x1}], 0x1) r3 = accept4$unix(r2, 0x0, 0x0, 0x0) accept4$unix(r3, &(0x7f0000000140), &(0x7f00000001c0)=0x6e, 0x800) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x11, r4, 0x147a5000) recvfrom$unix(r3, &(0x7f0000000200)=""/189, 0xbd, 0x0, 0x0, 0x0) (async) recvfrom$unix(r3, &(0x7f0000000200)=""/189, 0xbd, 0x0, 0x0, 0x0) lsm_set_self_attr(0x0, &(0x7f0000001b00)={0x65, 0x698, 0x20}, 0x20, 0x0) (async) lsm_set_self_attr(0x0, &(0x7f0000001b00)={0x65, 0x698, 0x20}, 0x20, 0x0) lsm_get_self_attr(0x0, &(0x7f00000002c0)={0x0, 0x0, 0x92, 0x72, ""/114}, &(0x7f0000000380)=0x92, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x15, 0x0, 0x33}, @flat=@weak_binder={0x77622a85, 0x1, 0x1}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) 1.792860331s ago: executing program 1 (id=610): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)) socket$nl_generic(0x10, 0x3, 0x10) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000080)) (async) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000080)) socket$packet(0x11, 0x3, 0x300) (async) r0 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000500)=@xdp={0x2c, 0xdd86, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000080)="0c9c76529718d2dbe1b31a4aa5f8006b00001080000000008da33ed3cf1113496f00000000000000", 0x28}], 0x1, 0x0, 0x0, 0x2f00}}], 0x1, 0x20000084) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r3, 0x40046210, &(0x7f0000000140)=0x1) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) ioprio_set$uid(0x3, 0xffffffffffffffff, 0x4007) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000400)={0x4, 0x0, &(0x7f0000000300)=[@exit_looper], 0x0, 0x0, &(0x7f0000000380)}) 1.740250992s ago: executing program 1 (id=611): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder1\x00', 0x1000, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/binder1\x00', 0x1000, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) (async) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x4, &(0x7f00000002c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab602000000ee8100e2838c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") (async) ptrace$setregs(0xd, r2, 0x4, &(0x7f00000002c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab602000000ee8100e2838c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4205, r2, 0x200, &(0x7f0000000080)={0x0}) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f00000000c0)={0x4, r3, 'id0\x00'}) ioctl$RTC_EPOCH_SET(r5, 0x4008700e, 0x3ed) 1.649448354s ago: executing program 1 (id=612): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="a400000000010104000000000000000002000000380001801400018008000100ac1e000108000200e00000010c000280050001003a0000001400018008000100e0000001080002"], 0xa4}}, 0x0) 1.646364004s ago: executing program 1 (id=613): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)) syz_io_uring_setup(0xb32, 0x0, 0x0, 0x0) r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r2, 0x40087703, 0x6e339c3) recvmsg$unix(0xffffffffffffffff, 0x0, 0x60010140) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r2, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x40087708, &(0x7f00000007c0)='\x00\x00\x03\x06\x00\x00\x00\x05\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xf0:\xfd$\xad\xbb\x9a|c\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b7\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Xd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84x\x00\x00X\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~~\x84\\\xe4\x00') socket$key(0xf, 0x3, 0x2) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r4 = syz_usb_connect(0x0, 0x68, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000a1121781bc2a930902240001000000100904090582024000000000000080000000000000000000000000001793c77d0923cd63a53adebf2785c006b9f420ad"], 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, &(0x7f0000000880)={0x1c, &(0x7f0000000740)=ANY=[@ANYBLOB="00148b"], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r4, 0x0, &(0x7f0000000280)={0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="2031500000003bd9781d8ad87e7bd3d752b8a0f0f91c1dca16c20501fec77e753d30030aff045cc577627257d8c123eeb64d0fd4ae4d5bb079a05f17767a316e43d0b6389b78d6f0f2c0abb8d0fba7ed5167903ce9a1"], 0x0, 0x0}) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002eb0e00000000000000000105000600200000000a00000040010000000500e50000070000001f00001a000000030000a95a6e870200010000e9ff070040000200000000050005000000cc580a"], 0x80}}, 0x0) sendmmsg(r3, &(0x7f0000000180), 0x400008a, 0x0) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000080)=0x40) pwritev(r1, &(0x7f0000000040)=[{&(0x7f00000000c0)="80fd02000040", 0x42}], 0x1, 0x0, 0xc87) r5 = getpid() getpriority(0x2, r5) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYRESHEX=r0], 0xa4}}, 0x0) 1.044588253s ago: executing program 3 (id=614): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeef, 0x8031, 0xffffffffffffffff, 0x1000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x80}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x1bc, 0x19, 0x1, 0x0, 0x25dfdbfd, {{@in=@multicast1, @in=@remote, 0x0, 0xb, 0xffff, 0x0, 0xa, 0x80, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, {0x1, 0x0, 0x80}}, [@tmpl={0x104, 0x5, [{{@in=@multicast2, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x34ff, 0x0, 0x2}, {{@in=@local, 0x0, 0x3c}, 0xa, @in6=@dev, 0x2, 0x0, 0x0, 0x0, 0x800, 0x800}, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x32}, 0x0, @in=@loopback, 0x3503, 0x3}, {{@in6=@loopback, 0x4d4, 0x2b}, 0x0, @in=@empty, 0x3, 0x0, 0x1, 0x8, 0x0, 0x0, 0x400}]}]}, 0x1bc}}, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.044399573s ago: executing program 2 (id=615): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x2000, 0x0) recvmmsg(r0, &(0x7f000000d880)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000580)=""/94, 0x5e}, {&(0x7f00000006c0)=""/107, 0x6b}, {&(0x7f0000000880)=""/186, 0xba}, {&(0x7f0000000400)=""/50, 0x32}, {&(0x7f0000000940)=""/10, 0xa}, {&(0x7f00000009c0)}, {0x0}, {&(0x7f0000000a00)=""/22, 0x16}, {&(0x7f0000000a40)=""/219, 0xdb}], 0x9, &(0x7f0000000c00)=""/213, 0xd5}, 0x4}, {{0x0, 0x0, 0x0}, 0x1e}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f000000a880)=[{&(0x7f00000093c0)=""/223, 0xdf}, {&(0x7f0000001fc0)=""/63, 0x3f}, {&(0x7f000000dbc0)=""/4096, 0x1000}, {&(0x7f000000a500)=""/56, 0x38}, {&(0x7f000000a540)=""/71, 0x47}, {&(0x7f000000a5c0)=""/236, 0xec}, {&(0x7f000000a6c0)=""/63, 0x3f}, {&(0x7f000000a700)=""/100, 0x64}, {&(0x7f000000a780)=""/197, 0xc5}], 0x9}, 0x5}, {{0x0, 0x0, 0x0}, 0x6e75}, {{0x0, 0x0, 0x0}, 0xda9}], 0x6, 0x40000000, &(0x7f00000009c0)={0x77359400}) 1.042308693s ago: executing program 2 (id=616): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=ANY=[@ANYBLOB="a0000000210001000000000000000000fc0200000000000000000000000000006401010200000000000000000000000000000000000000000a00000001a80000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000500011"], 0xa0}, 0x1, 0x0, 0x0, 0x44000}, 0x0) 1.030442853s ago: executing program 2 (id=617): mkdir(&(0x7f0000000540)='./file0\x00', 0x108) mount$cgroup(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)={[{@subsystem='cpuset'}, {@subsystem='memory'}, {@subsystem='cpuacct'}]}) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) fcntl$setstatus(r0, 0x4, 0x40800) connect$inet(r0, &(0x7f0000000300)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) write$eventfd(r1, &(0x7f0000000080)=0x4, 0x8) ftruncate(r1, 0x2000009) sendfile(r0, r1, 0x0, 0x7ffff004) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r2, &(0x7f000000cb00)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f00000000c0)={0x50, 0x0, r3, {0x7, 0x21, 0x0, 0x945f4a821577fb5d}}, 0x50) write$FUSE_INIT(r1, &(0x7f0000000180)={0x50, 0xfffffffffffffffe, r3, {0x7, 0x2b, 0x2, 0x800, 0xc8, 0x48c1, 0x3, 0x3, 0x0, 0x0, 0x28, 0x53ad}}, 0x50) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@xino_auto}]}) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r4, &(0x7f0000000f00)={0x2020}, 0x2020) 1.005466734s ago: executing program 2 (id=618): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000009800)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, &(0x7f0000003640)=[{&(0x7f00000017c0)=""/4117, 0x1015}, {&(0x7f0000003180)=""/177, 0xb1}, {&(0x7f0000000780)=""/18, 0x12}, {&(0x7f00000032c0)=""/246, 0xf6}, {&(0x7f0000000180)=""/235, 0xeb}, {&(0x7f00000034c0)=""/211, 0xd3}], 0x6}, 0x81}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x5}], 0x6, 0x2100, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x0, 0x12043, 0x0) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000700)={&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0}, &(0x7f0000000740)=0xffffff2d) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r4, 0x2000) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) lsm_list_modules(0x0, &(0x7f0000000040), 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x402000, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b0001110000000904"], 0x0) syz_clone3(&(0x7f00000013c0)={0x240040480, 0x0, 0x0, 0x0, {0x25}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$BTRFS_IOC_SEND(r1, 0x40489426, &(0x7f0000000100)={{r4}, 0x0, &(0x7f0000000080), 0xffffffffffff7ffe, 0x4, 0x1}) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/resume_offset', 0x2, 0x0) ppoll(&(0x7f0000000240)=[{r6, 0x8}, {r6, 0x88}], 0x2, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) r7 = openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0, 0x0) mknodat(r7, &(0x7f00000002c0)='./file1\x00', 0x1610, 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) openat$dir(0xffffffffffffff9c, &(0x7f0000000840)='./file0\x00', 0x8000, 0x1e6) 961.561724ms ago: executing program 0 (id=619): syz_open_dev$loop(&(0x7f0000000080), 0xa117, 0x241000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000000010104000000000000000002001000240002801400018008000100e000000108000200e00000010c00028005000100000084ff1c0010800800014000000000d97405010000000008000240000000000800", @ANYRES64=r1], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 900.722855ms ago: executing program 0 (id=620): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_CPUID2(r2, 0xc008ae91, 0x0) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r3, 0x2000) mremap(&(0x7f00003d5000/0x3000)=nil, 0x3000, 0x800000, 0x4, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f0000241000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) 900.426595ms ago: executing program 3 (id=621): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000300)='net/protocols\x00') read$FUSE(r2, &(0x7f0000000640)={0x2020}, 0x2020) mount$9p_virtio(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0xffffffc1) mmap(&(0x7f0000701000/0x2000)=nil, 0x2000, 0x0, 0x12, r1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000580)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) lseek(r3, 0xfffffffffffffffc, 0x1) ioctl$ASHMEM_SET_NAME(r1, 0x40087708, &(0x7f0000000540)='\x00\x00\x03\x06\x00\x00\x00\x05\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80`4/\xe9\x15\x9a\x9f\xf0:\xfd$\xad\xbb\x9a|c\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b7\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Xd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad/\xd8\x16\\n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x04;\xc5[\nja\xb9\'\xc9#\xfcx\x00\x00X\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~~\x84\\\xe4\x00B\x05\xd4\xea\xea\x7f=\xc6:\\N\xc3\xb7Vw\xc6\x9c\x96s\xaaHL\x96\xc72\n\x18Ynj\xceTS\xfbl\x0f\x9f8M\f\x89\xa1\xd2Hs`\x8bp\x8a\xc4%\xf8\x1d3\nV\x9a\xaf\x1f\xf96^\x93\xc1\xaf)\rg\x86\xd6\xea\xa9\x0f\x9a\xf1V\x1b\xbf\x8b\'-\xab\x8e\t7\xd3\xf7\xa9v\xfbY\xe6\x9b^d\x8c\xb1\xdd') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x94173000) ioctl$ASHMEM_SET_NAME(r1, 0x40087707, &(0x7f0000000300)='\x00\x00\x00\x06\x00\x00\x00\x01\x00x\x92\x12\xbc\x00\x00\xbb\x0642\x9c\x1a\xd1\xcbx\xb0\xd6\x1e\x10gQ\xca\x0e;\xf7\'\x8c\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn\x05\x00\x00\x00-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \xac\xc4K\x03\xfa\x13Vz\xbf\xe3c\x8d \x0f\xb1\xe9\xf2oci(\xcb\x82\x05\xfe[H\xaf\x01\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafd%\xf1\xdbjE\x01\xd1sD5hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\x851Y9OB\xdeB\xe1\x02-&\"1hS\x92\xe4$-\x02\x00\xe4\x8e\"\x85\xc9x\xef\x81E.r\x89\xe5\x00\x9e\x97\x96\xb8j\x81\xf0\xdca\xfb\xa6\xff\xff\xff\xff\x00\x00\x00\x00d\xf0\xf1j\x11\x12\xc0\xbb\xfdq~#\xf7\xa8\"$,\xf4\x84|\x89o\x00<\xa6-\xb0\xd3\x80\xbe\xcf\a\x00\xfc\xa6\xb1\x05\x94\x84l\xbfA\xeb\xd8\t\x00\x00\x00CvNhx461\x04N<\xedV\xcet\xaa~\xf3j\x94\xec\x92\x86uY\xf6\xb5\t?,~\xa67\\\xb9\xc9K\xf8\x9d\x96\xc0\xb5\xc7wF\x99\x12\x97T\x90.\x9c\xe3\x9a\xf1\xb9\x9c\x13\xbc\x19\xde/\xaahB\t\x97\a03\xcd\xb3\xc8\xd5l\x14!\xf9Xg2\x1d\xeeB\xccT\x0e\xd8\xef\xc8\xe9\xb4\xf3l\xc3\xf2\x998\xc8\xc2|2\xee\xb4W\x99f.\xeb\xe9\x05\xcbkz3+\xdd\xe1*8\x95@0t0\xad\xe3#\xd7\x19\xe7Q\xdfmI\xe5\x1e\xe4\x87\xc9\x8f\xa7\xe0\xd9v\xf6\x01\x9d\x8f`,\x1a8\x81I\x86l\x8f2\r:\xc1\x02\xd6Z%\xa7Ks\x8bUolS\x05\xbe\x97\x1fGe\x94\xa6\xa3\xab\xdb\r\x17\xff[\xb1\x00\xff\x7f\x00\x00\x00\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x93, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70b7a440b4187098442946238cdd38a235b264899fa2f8b51f8a660653545ab78b6a47b6462efaa8192061344501fb8d96f8de3b132ee012626f94be7b4a9e572a431676"}) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1000000) r4 = socket(0x28, 0x5, 0xa) bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r4, 0x4) ppoll(&(0x7f0000000500)=[{r4, 0x401}], 0x1, &(0x7f0000000540)={0x0, 0x3938700}, 0x0, 0x0) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000000)=0xa, 0x4) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 810.084797ms ago: executing program 0 (id=622): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="a400000000010104000000000000000002000000380001801400018008000100ac1e000108000200e00000010c000280050001003a0000001400018008000100e0000001080002"], 0xa4}}, 0x0) 789.843367ms ago: executing program 0 (id=623): r0 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 32) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (rerun: 32) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x3) (async) ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f0000000000)) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x474c, 0x4) (async, rerun: 64) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) (rerun: 64) write$UHID_INPUT(r2, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125b2ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb03bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2033aae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b85b7b26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1111c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c669bb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b2967cbfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d6748c2ce5bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4658098549646bd63175adf77b5cdcf102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4baea02fa76fb4830aebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f8426a9049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21abfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e0068607000000fb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9fb4000000f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002afea6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b46e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae66444a8f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0xdd52d6c}}, 0x1006) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) (async) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000), 0x4) (async) r3 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r3, 0x40087703, 0xfffffffa) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) preadv2(r4, &(0x7f00000016c0)=[{&(0x7f0000000340)=""/111, 0x6f}], 0x1, 0xc47c, 0x3e, 0x8) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r3, 0x0) (async) read(r3, &(0x7f0000000000)=""/175, 0xfffffe14) 712.737348ms ago: executing program 0 (id=624): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x2, 0x0) r1 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x46d, 0xc286, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xa0, 0x20, [{{0x9, 0x4, 0x0, 0x6, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x8}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xfe, 0x9}}}}}]}}]}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000003c0)={0xa, 0x4e22, 0x10000, @ipv4={'\x00', '\xff\xff', @empty}, 0x2}, 0x1c) listen(r2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000700), r3) sendmsg$IEEE802154_LIST_PHY(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000880)={0x14, r5, 0x1, 0x70bd2b, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0xaf09550cf70da353}, 0x80) r6 = socket$netlink(0x10, 0x3, 0x4) writev(r6, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001500add427323b470c45b4560a067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\"\b\x00\x00\x00'], 0x0}, 0x0) r7 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r7, 0x40087705, &(0x7f0000000280)={0xfffffff4, 0x1}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) 73.521839ms ago: executing program 3 (id=625): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x2000, 0x0) recvmmsg(r0, &(0x7f000000d880)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000580)=""/94, 0x5e}, {&(0x7f00000006c0)=""/107, 0x6b}, {&(0x7f0000000880)=""/186, 0xba}, {&(0x7f0000000400)=""/50, 0x32}, {&(0x7f0000000940)=""/10, 0xa}, {&(0x7f00000009c0)}, {0x0}, {&(0x7f0000000a00)=""/22, 0x16}, {&(0x7f0000000a40)=""/219, 0xdb}], 0x9, &(0x7f0000000c00)=""/213, 0xd5}, 0x4}, {{0x0, 0x0, 0x0}, 0x1e}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f000000a880)=[{&(0x7f00000093c0)=""/223, 0xdf}, {&(0x7f0000001fc0)=""/63, 0x3f}, {&(0x7f000000dbc0)=""/4096, 0x1000}, {&(0x7f000000a500)=""/56, 0x38}, {&(0x7f000000a540)=""/71, 0x47}, {&(0x7f000000a5c0)=""/236, 0xec}, {&(0x7f000000a6c0)=""/63, 0x3f}, {&(0x7f000000a700)=""/100, 0x64}, {&(0x7f000000a780)=""/197, 0xc5}], 0x9}, 0x5}, {{0x0, 0x0, 0x0}, 0x6e75}, {{0x0, 0x0, 0x0}, 0xda9}], 0x6, 0x40000000, &(0x7f00000009c0)={0x77359400}) 59.981349ms ago: executing program 3 (id=626): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=ANY=[@ANYBLOB="a0000000210001000000000000000000fc0200000000000000000000000000006401010200000000000000000000000000000000000000000a00000000000002", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000500011"], 0xa0}, 0x1, 0x0, 0x0, 0x44000}, 0x0) 567.28µs ago: executing program 3 (id=627): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x9) openat$cgroup_subtree(r1, &(0x7f0000000100), 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@xino_auto}]}) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000001800), 0x62000) ioctl$SNDRV_TIMER_IOCTL_GINFO(r3, 0xc0f85403, &(0x7f0000002b00)={{0x1, 0x0, 0x3, 0x3, 0xf20}, 0xa836, 0x6, 'id0\x00', 'timer1\x00', 0x0, 0x7, 0x3, 0x200, 0x5}) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWFLOWTABLE={0x28, 0x16, 0xa, 0x3, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELFLOWTABLE={0x204, 0x18, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x1}, [@NFTA_FLOWTABLE_HOOK={0x7c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'team0\x00'}, {0x14, 0x1, 'caif0\x00'}, {0x14, 0x1, 'veth0_vlan\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'ip6gretap0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth0_macvtap\x00'}]}]}, @NFTA_FLOWTABLE_HOOK={0x140, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_vlan\x00'}, {0x14, 0x1, 'vlan0\x00'}, {0x14, 0x1, 'veth1\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x68, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vlan0\x00'}, {0x14, 0x1, 'ip6gretap0\x00'}, {0x14, 0x1, 'ip6tnl0\x00'}, {0x14, 0x1, 'sit0\x00'}, {0x14, 0x1, 'vxcan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x7c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'wg2\x00'}, {0x14, 0x1, 'pimreg0\x00'}, {0x14, 0x1, 'vcan0\x00'}, {0x14, 0x1, 'pim6reg\x00'}, {0x14, 0x1, 'team0\x00'}, {0x14, 0x1, 'geneve0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x8}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x254}, 0x1, 0x0, 0x0, 0x40}, 0x1) read$FUSE(r2, &(0x7f0000000f00)={0x2020}, 0x2020) 0s ago: executing program 3 (id=635): r0 = openat$ashmem(0xffffffffffffff9c, 0x0, 0x28000, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000000)='\x00') ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000000c0)='\x87\x12z\xda\xc5p\xf2\x82\xe9\b\x98H*\xae\xbf\xacS4\x1d\xd6L\x83\x00\x00\xe1\xa6\xc8\xd1Oc\xa1\xaaya\x81\xbb\xca\x06j\xff:\xbb\xf4\x8f\xcbe\xfb\x8a\v/o/\xf8~\xa6\xeemf\x0e\x11\xfa\xe6\x8f\xc0\x00\x00\x00\x00k|l\x82\x95\x9d\xf8\xa2\xe2\xe5\x01n\x96t\x9do') close(r0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.30' (ED25519) to the list of known hosts. [ 21.988625][ T36] audit: type=1400 audit(1751374761.120:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.989961][ T281] cgroup: Unknown subsys name 'net' [ 22.011498][ T36] audit: type=1400 audit(1751374761.120:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.038802][ T36] audit: type=1400 audit(1751374761.150:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.039039][ T281] cgroup: Unknown subsys name 'devices' [ 22.242992][ T281] cgroup: Unknown subsys name 'hugetlb' [ 22.248628][ T281] cgroup: Unknown subsys name 'rlimit' [ 22.342296][ T36] audit: type=1400 audit(1751374761.480:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.365585][ T36] audit: type=1400 audit(1751374761.480:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.376497][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.390504][ T36] audit: type=1400 audit(1751374761.480:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.422052][ T36] audit: type=1400 audit(1751374761.540:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.447474][ T36] audit: type=1400 audit(1751374761.540:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.476805][ T36] audit: type=1400 audit(1751374761.620:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.477292][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.502618][ T36] audit: type=1400 audit(1751374761.620:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.304083][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.311204][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.318269][ T288] bridge_slave_0: entered allmulticast mode [ 23.324706][ T288] bridge_slave_0: entered promiscuous mode [ 23.332119][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.339154][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.346258][ T288] bridge_slave_1: entered allmulticast mode [ 23.352579][ T288] bridge_slave_1: entered promiscuous mode [ 23.397763][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.404848][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.411929][ T289] bridge_slave_0: entered allmulticast mode [ 23.418085][ T289] bridge_slave_0: entered promiscuous mode [ 23.424236][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.431314][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.438376][ T291] bridge_slave_0: entered allmulticast mode [ 23.444802][ T291] bridge_slave_0: entered promiscuous mode [ 23.451217][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.458261][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.465356][ T291] bridge_slave_1: entered allmulticast mode [ 23.471569][ T291] bridge_slave_1: entered promiscuous mode [ 23.480777][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.487808][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.494885][ T289] bridge_slave_1: entered allmulticast mode [ 23.501088][ T289] bridge_slave_1: entered promiscuous mode [ 23.559059][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.566182][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.573300][ T290] bridge_slave_0: entered allmulticast mode [ 23.579513][ T290] bridge_slave_0: entered promiscuous mode [ 23.585836][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.592972][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.600054][ T290] bridge_slave_1: entered allmulticast mode [ 23.606363][ T290] bridge_slave_1: entered promiscuous mode [ 23.717601][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.724682][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.731993][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.739012][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.758150][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.765220][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.772538][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.779558][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.789184][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.796227][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.803491][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.810511][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.829372][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.836439][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.843710][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.850732][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.880902][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.888168][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.895953][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.903282][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.910499][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.917806][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.925267][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.932539][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.947374][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.954426][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.962246][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.969350][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.981186][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.988220][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.002525][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.009549][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.026040][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.033082][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.055257][ T288] veth0_vlan: entered promiscuous mode [ 24.061662][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.068677][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.087924][ T291] veth0_vlan: entered promiscuous mode [ 24.099184][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.106236][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.117308][ T288] veth1_macvtap: entered promiscuous mode [ 24.137801][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.144946][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.156238][ T291] veth1_macvtap: entered promiscuous mode [ 24.177212][ T290] veth0_vlan: entered promiscuous mode [ 24.208974][ T289] veth0_vlan: entered promiscuous mode [ 24.218997][ T290] veth1_macvtap: entered promiscuous mode [ 24.226839][ T288] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.249699][ T290] percpu: allocation failed, size=8 align=8 atomic=1, atomic alloc failed, no space left [ 24.271993][ T289] veth1_macvtap: entered promiscuous mode [ 24.283869][ T310] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4'. [ 24.299840][ T311] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1'. [ 24.358980][ T317] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.364599][ T318] rust_binder: 318: no such ref 0 [ 24.386878][ T320] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:4 [ 24.390318][ T318] rust_binder: Write failure EINVAL in pid:4 [ 24.396648][ T314] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 24.442238][ T328] netlink: 36 bytes leftover after parsing attributes in process `syz.3.9'. [ 24.469171][ T331] rust_binder: Error while translating object. [ 24.469220][ T331] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 24.480168][ T331] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:10 [ 24.556738][ T345] rust_binder: 345: no such ref 0 [ 24.571803][ T345] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 24.571823][ T345] rust_binder: Read failure Err(EFAULT) in pid:11 [ 24.638670][ T351] rust_binder: 351: no such ref 0 [ 24.651251][ T351] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 24.651269][ T351] rust_binder: Read failure Err(EFAULT) in pid:5 [ 24.659338][ T351] rust_binder: Write failure EINVAL in pid:5 [ 24.734646][ T362] sysfs: cannot create duplicate filename '/module/raw_gadget' [ 24.771419][ T365] netlink: 36 bytes leftover after parsing attributes in process `syz.3.21'. [ 24.790774][ T362] CPU: 0 UID: 0 PID: 362 Comm: syz.1.20 Not tainted 6.12.30-syzkaller-g648383294760 #0 93f95243d2c671158253b6b51cea62df3148036e [ 24.790806][ T362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 24.790827][ T362] Call Trace: [ 24.790834][ T362] [ 24.790843][ T362] __dump_stack+0x21/0x30 [ 24.790877][ T362] dump_stack_lvl+0x10c/0x190 [ 24.790902][ T362] ? __cfi_dump_stack_lvl+0x10/0x10 [ 24.790928][ T362] ? __kmalloc_cache_noprof+0x1a5/0x3c0 [ 24.790972][ T362] ? sysfs_warn_dup+0x65/0x160 [ 24.790999][ T362] dump_stack+0x19/0x20 [ 24.791023][ T362] sysfs_warn_dup+0x144/0x160 [ 24.791050][ T362] sysfs_create_dir_ns+0x1ab/0x200 [ 24.791077][ T362] ? __cfi_sysfs_create_dir_ns+0x10/0x10 [ 24.791104][ T362] ? _raw_spin_lock+0x8c/0x120 [ 24.791133][ T362] kobject_add_internal+0x703/0xc20 [ 24.791149][ T362] kobject_init_and_add+0x126/0x190 [ 24.791173][ T362] ? _raw_spin_lock+0x109/0x120 [ 24.791197][ T362] ? __cfi_kobject_init_and_add+0x10/0x10 [ 24.791224][ T362] ? __kmalloc_cache_noprof+0x1a5/0x3c0 [ 24.791256][ T362] ? lookup_or_create_module_kobject+0x83/0x210 [ 24.791276][ T362] lookup_or_create_module_kobject+0xeb/0x210 [ 24.791296][ T362] module_add_driver+0xc4/0x330 [ 24.791311][ T362] bus_add_driver+0x3f0/0x740 [ 24.791329][ T362] driver_register+0x2b7/0x3c0 [ 24.791360][ T362] usb_gadget_register_driver_owner+0xfc/0x270 [ 24.791377][ T362] raw_ioctl+0x130e/0x3600 [ 24.791396][ T362] ? handle_mm_fault+0x169b/0x1b90 [ 24.791419][ T362] ? __cfi_raw_ioctl+0x10/0x10 [ 24.791438][ T362] ? selinux_file_ioctl+0x6e0/0x1360 [ 24.791462][ T362] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 24.791489][ T362] ? __fget_files+0x2c5/0x340 [ 24.791513][ T362] ? bpf_lsm_file_ioctl+0xd/0x20 [ 24.791530][ T362] ? security_file_ioctl+0x34/0xd0 [ 24.791553][ T362] ? __cfi_raw_ioctl+0x10/0x10 [ 24.791571][ T362] __se_sys_ioctl+0x132/0x1b0 [ 24.791594][ T362] __x64_sys_ioctl+0x7f/0xa0 [ 24.791624][ T362] x64_sys_call+0x1878/0x2ee0 [ 24.791653][ T362] do_syscall_64+0x58/0xf0 [ 24.791672][ T362] ? clear_bhb_loop+0x50/0xa0 [ 24.791698][ T362] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.791716][ T362] RIP: 0033:0x7f5d61f8e52b [ 24.791734][ T362] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 24.791747][ T362] RSP: 002b:00007f5d62d46f10 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 24.791770][ T362] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f5d61f8e52b [ 24.791788][ T362] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004 [ 24.791802][ T362] RBP: 00007f5d62d47fe0 R08: 0000000000000000 R09: 00312e6364755f79 [ 24.791818][ T362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 24.791832][ T362] R13: 00007f5d62d46fb0 R14: 0000200000000380 R15: 00007f5d622e0b88 [ 24.791850][ T362] [ 24.791861][ T362] kobject: kobject_add_internal failed for raw_gadget with -EEXIST, don't try to register things with the same name in the same directory. [ 25.001460][ T45] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 25.005332][ T362] Adding module 'raw_gadget' to sysfs failed (-17), the system may be unstable. [ 25.109977][ T362] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.118614][ T362] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.424311][ T404] rust_binder: 404: no such ref 0 [ 25.439337][ T404] rust_binder: Write failure EINVAL in pid:18 [ 25.462133][ T409] capability: warning: `syz.0.36' uses deprecated v2 capabilities in a way that may be insecure [ 25.590654][ T45] usb 2-1: device not accepting address 2, error -71 [ 25.848537][ T427] netlink: 72 bytes leftover after parsing attributes in process `syz.3.41'. [ 25.900262][ T433] rust_binder: Error while translating object. [ 25.900299][ T433] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 25.906758][ T433] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:34 [ 25.940670][ T45] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 25.943479][ T438] rust_binder: 438: no such ref 0 [ 26.030781][ T440] rust_binder: Write failure EINVAL in pid:14 [ 26.121512][ T45] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 26.136778][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.150039][ T45] usb 2-1: config 0 descriptor?? [ 26.283825][ T450] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.300303][ T450] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 26.300333][ T450] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:38 [ 26.341636][ T453] netlink: 72 bytes leftover after parsing attributes in process `syz.2.51'. [ 26.429310][ T462] netlink: 36 bytes leftover after parsing attributes in process `syz.0.55'. [ 26.452397][ T466] Zero length message leads to an empty skb [ 27.104265][ T36] kauditd_printk_skb: 114 callbacks suppressed [ 27.104285][ T36] audit: type=1400 audit(1751374766.240:188): avc: denied { append } for pid=473 comm="syz.3.59" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 27.234618][ T482] netlink: 72 bytes leftover after parsing attributes in process `syz.3.61'. [ 27.270010][ T36] audit: type=1400 audit(1751374766.400:189): avc: denied { ioctl } for pid=485 comm="syz.3.63" path="socket:[4047]" dev="sockfs" ino=4047 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.318866][ T36] audit: type=1400 audit(1751374766.450:190): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 27.372610][ T495] binder: Unknown parameter '01777777777777777777777' [ 27.380791][ T36] audit: type=1400 audit(1751374766.510:191): avc: denied { remount } for pid=494 comm="syz.2.65" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 27.408752][ T497] netlink: 36 bytes leftover after parsing attributes in process `syz.3.66'. [ 27.452225][ T504] netlink: 32 bytes leftover after parsing attributes in process `syz.0.69'. [ 27.475015][ T506] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 27.475048][ T506] rust_binder: Read failure Err(EFAULT) in pid:53 [ 27.546874][ T36] audit: type=1400 audit(1751374766.680:192): avc: denied { create } for pid=511 comm="syz.3.72" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 27.580767][ T45] usb 2-1: Cannot set autoneg [ 27.585574][ T45] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 27.603842][ T45] usb 2-1: USB disconnect, device number 3 [ 27.621031][ T36] audit: type=1400 audit(1751374766.760:193): avc: denied { setopt } for pid=517 comm="syz.3.74" lport=135 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.656514][ T36] audit: type=1400 audit(1751374766.790:194): avc: denied { connect } for pid=517 comm="syz.3.74" lport=135 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.690679][ T36] audit: type=1400 audit(1751374766.810:195): avc: denied { setopt } for pid=517 comm="syz.3.74" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 27.724664][ T36] audit: type=1400 audit(1751374766.820:196): avc: denied { write } for pid=517 comm="syz.3.74" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 27.806495][ T526] rust_binder: validate_parent_fixup: new_min_offset=14, sg_entry.length=0 [ 27.806527][ T526] rust_binder: Error while translating object. [ 27.815639][ T526] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 27.821991][ T526] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:60 [ 27.888828][ T36] audit: type=1400 audit(1751374767.020:197): avc: denied { append } for pid=528 comm="syz.2.77" name="loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 28.080725][ T551] rust_binder: Error while translating object. [ 28.080755][ T551] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 28.087036][ T551] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:80 [ 28.125534][ T554] tipc: Started in network mode [ 28.148913][ T554] tipc: Node identity ac14140f, cluster identity 4711 [ 28.165969][ T554] tipc: New replicast peer: 255.255.255.255 [ 28.177953][ T554] tipc: Enabled bearer , priority 10 [ 28.302399][ T579] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 28.302431][ T579] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:82 [ 28.443991][ T583] netlink: 'syz.1.96': attribute type 4 has an invalid length. [ 28.462041][ T595] ======================================================= [ 28.462041][ T595] WARNING: The mand mount option has been deprecated and [ 28.462041][ T595] and is ignored by this kernel. Remove the mand [ 28.462041][ T595] option from the mount to silence this warning. [ 28.462041][ T595] ======================================================= [ 28.532253][ T595] binder: Unknown parameter '' [ 28.892807][ T620] rust_binder: Error while translating object. [ 28.892843][ T620] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 28.899045][ T620] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:70 [ 28.949101][ T623] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 28.979903][ T630] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 28.994518][ T630] rust_binder: Error in use_page_slow: ESRCH [ 28.994543][ T630] rust_binder: use_range failure ESRCH [ 29.011841][ T630] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 29.017330][ T630] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 29.042504][ T630] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:78 [ 29.222158][ T659] rust_binder: Got transaction with invalid offset. [ 29.229551][ T655] tipc: Enabled bearer , priority 0 [ 29.250654][ T659] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 29.250700][ T659] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:88 [ 29.262135][ T655] tipc: Resetting bearer [ 29.316657][ T655] tipc: Disabling bearer [ 29.391533][ T666] batadv_slave_1: entered promiscuous mode [ 29.416437][ T665] batadv_slave_1: left promiscuous mode [ 29.520939][ T667] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 29.678351][ T9] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 29.711215][ T9] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 29.715999][ T680] __nla_validate_parse: 10 callbacks suppressed [ 29.716019][ T680] netlink: 16 bytes leftover after parsing attributes in process `syz.1.131'. [ 29.825994][ T683] fido_id[683]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 29.908240][ T696] rust_binder: Write failure EINVAL in pid:69 [ 29.961140][ T700] binder: Binderfs stats mode cannot be changed during a remount [ 30.088294][ T706] rust_binder: Error while translating object. [ 30.088330][ T706] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 30.096435][ T706] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:71 [ 30.202021][ T711] netlink: 16 bytes leftover after parsing attributes in process `syz.1.143'. [ 30.280682][ T306] tipc: Node number set to 2886997007 [ 30.348851][ T730] netlink: 72 bytes leftover after parsing attributes in process `syz.0.146'. [ 30.466634][ T746] netlink: 36 bytes leftover after parsing attributes in process `syz.0.155'. [ 30.486523][ T748] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 30.570634][ T306] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 30.612395][ T755] netlink: 72 bytes leftover after parsing attributes in process `syz.0.158'. [ 30.631833][ T757] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:153 [ 30.644274][ T757] rust_binder: Error while translating object. [ 30.653481][ T757] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 30.659823][ T757] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:153 [ 30.660648][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 30.700641][ T306] usb 2-1: device descriptor read/64, error -71 [ 30.735182][ T763] netlink: 4 bytes leftover after parsing attributes in process `syz.0.162'. [ 30.744069][ T750] veth1_to_team: entered promiscuous mode [ 30.749896][ T750] veth1_to_team: entered allmulticast mode [ 30.837950][ T771] netlink: 36 bytes leftover after parsing attributes in process `syz.0.164'. [ 30.847892][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 30.862918][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 30.873442][ T9] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 30.881615][ T773] capability: warning: `syz.0.165' uses 32-bit capabilities (legacy support in use) [ 30.882668][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 30.901099][ T9] usb 4-1: SerialNumber: syz [ 30.951182][ T306] usb 2-1: device descriptor read/64, error -71 [ 31.111013][ T9] usb 4-1: 0:2 : does not exist [ 31.121880][ T9] usb 4-1: USB disconnect, device number 2 [ 31.169057][ T308] udevd[308]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 31.200628][ T306] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 31.330651][ T306] usb 2-1: device descriptor read/64, error -71 [ 31.423279][ T780] netlink: 72 bytes leftover after parsing attributes in process `syz.2.167'. [ 31.454219][ T782] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 31.454244][ T782] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:114 [ 31.506958][ T792] rust_binder: 792: no such ref 0 [ 31.521200][ T792] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 31.521218][ T792] rust_binder: Read failure Err(EFAULT) in pid:124 [ 31.529538][ T792] rust_binder: Write failure EINVAL in pid:124 [ 31.570687][ T306] usb 2-1: device descriptor read/64, error -71 [ 31.604851][ T798] rust_binder: Error in use_page_slow: ESRCH [ 31.604873][ T798] rust_binder: use_range failure ESRCH [ 31.604873][ T799] rust_binder: Error in use_page_slow: ESRCH [ 31.604891][ T798] rust_binder: Failed to allocate buffer. len:120, is_oneway:true [ 31.611022][ T799] rust_binder: use_range failure ESRCH [ 31.624441][ T798] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 31.638623][ T798] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:130 [ 31.645601][ T799] rust_binder: Failed to allocate buffer. len:120, is_oneway:true [ 31.657070][ T799] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 31.665064][ T799] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:130 [ 31.698606][ T306] usb usb2-port1: attempt power cycle [ 31.707916][ T808] tipc: Started in network mode [ 31.718042][ T808] tipc: Node identity 6288cc799736, cluster identity 4711 [ 31.725256][ T808] tipc: Enabled bearer , priority 0 [ 31.733671][ T808] tipc: Disabling bearer [ 31.913354][ T838] fuse: Invalid gid '00000000000037777777777' [ 32.050643][ T306] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 32.070646][ T448] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 32.079008][ T306] usb 2-1: device descriptor read/8, error -71 [ 32.090627][ T370] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 32.211741][ T306] usb 2-1: device descriptor read/8, error -71 [ 32.220644][ T448] usb 3-1: Using ep0 maxpacket: 8 [ 32.226136][ T448] usb 3-1: too many configurations: 26, using maximum allowed: 8 [ 32.227093][ T36] kauditd_printk_skb: 37 callbacks suppressed [ 32.227107][ T36] audit: type=1400 audit(1751374771.360:235): avc: denied { read } for pid=94 comm="acpid" name="event3" dev="devtmpfs" ino=445 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 32.241441][ T370] usb 4-1: not running at top speed; connect to a high speed hub [ 32.261460][ T36] audit: type=1400 audit(1751374771.360:236): avc: denied { open } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=445 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 32.261510][ T36] audit: type=1400 audit(1751374771.360:237): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=445 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 32.269442][ T448] usb 3-1: New USB device found, idVendor=0979, idProduct=0270, bcdDevice=a8.17 [ 32.325101][ T448] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.333324][ T448] usb 3-1: Product: syz [ 32.337545][ T370] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 32.348454][ T370] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 520, setting to 64 [ 32.359239][ T448] usb 3-1: Manufacturer: syz [ 32.363955][ T448] usb 3-1: SerialNumber: syz [ 32.370088][ T370] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 32.379321][ T448] usb 3-1: config 0 descriptor?? [ 32.384367][ T370] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.392550][ T370] usb 4-1: Product: syz [ 32.397020][ T448] hub 3-1:0.0: Invalid hub with more than one config or interface [ 32.404870][ T370] usb 4-1: Manufacturer: syz [ 32.409486][ T370] usb 4-1: SerialNumber: syz [ 32.414109][ T448] hub 3-1:0.0: probe with driver hub failed with error -22 [ 32.422137][ T832] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 32.450618][ T306] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 32.471569][ T306] usb 2-1: device descriptor read/8, error -71 [ 32.597368][ T826] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.601755][ T306] usb 2-1: device descriptor read/8, error -71 [ 32.607207][ T826] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.630087][ T826] binder: Bad value for 'max' [ 32.636721][ T370] cdc_ncm 4-1:1.0: bind() failure [ 32.638090][ T842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.650957][ T842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.651494][ T826] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.667179][ T826] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.668218][ T370] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 32.683300][ T370] cdc_ncm 4-1:1.1: bind() failure [ 32.691902][ T370] usb 4-1: USB disconnect, device number 3 [ 32.710731][ T306] usb usb2-port1: unable to enumerate USB device [ 32.761554][ T64] usb 3-1: USB disconnect, device number 2 [ 33.140720][ T370] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 33.260800][ T36] audit: type=1400 audit(1751374772.400:238): avc: denied { create } for pid=852 comm="syz.0.192" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 33.280728][ T36] audit: type=1400 audit(1751374772.420:239): avc: denied { sys_admin } for pid=852 comm="syz.0.192" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 33.310716][ T370] usb 4-1: not running at top speed; connect to a high speed hub [ 33.329251][ T370] usb 4-1: config 1 interface 0 altsetting 4 endpoint 0x82 has invalid maxpacket 1023, setting to 64 [ 33.340670][ T370] usb 4-1: config 1 interface 0 altsetting 4 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 33.350603][ T36] audit: type=1400 audit(1751374772.480:240): avc: denied { write } for pid=858 comm="syz.2.194" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 33.370613][ T370] usb 4-1: config 1 interface 0 has no altsetting 0 [ 33.381936][ T370] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 33.388899][ T859] rust_binder: Read failure Err(EFAULT) in pid:85 [ 33.395356][ T370] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.427273][ T370] usb 4-1: Product: ᠒遻浛팈㑌鄘樊捭街컾䂔ᅑ䢦燝撕럙槨 [ 33.440018][ T872] cgroup: name respecified [ 33.445606][ T370] usb 4-1: Manufacturer: 하‿ߙ띀蓌堁씟흽罾ꩰ괙㰤낮ꢭȬɟ鏯᜘奏飔ꌌꇻ薝觍᧾蔵ഊ愱֦펀팿⒨햆䳭鮊氎儉폨铫ዳꯟಐ솢⪌쫈璤霙㎏疤梤贎燧氈얔珉㆙†鍖썮Ꮷ겻⥠玸ᄾ﫱欩蛳珨㎝漐１Ṷ衧ꦧ甉葞ᛁ旨ꜝ⠱⍕滭荖衣鲡糵ꗟ↗ᨿ큉驷█癤䀫貆颧ځ侹⮰ᮗ搢솁 [ 33.480101][ T370] usb 4-1: SerialNumber: syz [ 33.505107][ T876] rust_binder: 876: no such ref 7 [ 33.507651][ T832] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 33.517390][ T832] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 33.562469][ T36] audit: type=1400 audit(1751374772.700:241): avc: denied { read } for pid=874 comm="syz.2.200" name="usbmon5" dev="devtmpfs" ino=106 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 33.562724][ T876] rust_binder: Read failure Err(EFAULT) in pid:157 [ 33.585679][ T36] audit: type=1400 audit(1751374772.700:242): avc: denied { open } for pid=874 comm="syz.2.200" path="/dev/usbmon5" dev="devtmpfs" ino=106 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 33.640122][ T889] netlink: 40 bytes leftover after parsing attributes in process `syz.2.203'. [ 33.709247][ T892] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 33.722744][ T36] audit: type=1400 audit(1751374772.860:243): avc: denied { getopt } for pid=891 comm="syz.2.204" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 33.742011][ T36] audit: type=1400 audit(1751374772.870:244): avc: denied { read } for pid=891 comm="syz.2.204" path="socket:[7532]" dev="sockfs" ino=7532 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 33.743694][ T832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.773400][ T832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.784927][ T832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.793405][ T832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.870607][ T306] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 34.003238][ T832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.011819][ T832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.022776][ T370] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 34.031120][ T306] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 34.039810][ T306] usb 1-1: config 1 has an invalid descriptor of length 250, skipping remainder of the config [ 34.051311][ T370] usb 4-1: USB disconnect, device number 4 [ 34.057847][ T306] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 34.068829][ T306] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 34.077928][ T306] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.085934][ T306] usb 1-1: Manufacturer: М [ 34.090433][ T306] usb 1-1: SerialNumber: 䰊 [ 34.498843][ T885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.507758][ T885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.520689][ T306] usb 1-1: 0:2 : does not exist [ 34.540633][ T306] usb 1-1: USB disconnect, device number 2 [ 34.654729][ T938] netlink: 436 bytes leftover after parsing attributes in process `syz.2.222'. [ 34.671348][ T940] rust_binder: Error in use_page_slow: ESRCH [ 34.671366][ T940] rust_binder: use_range failure ESRCH [ 34.677542][ T940] rust_binder: Failed to allocate buffer. len:104, is_oneway:true [ 34.683290][ T940] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 34.691459][ T940] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:175 [ 34.741633][ T945] netlink: 12 bytes leftover after parsing attributes in process `syz.2.224'. [ 34.910627][ T370] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 34.980626][ T64] usb 3-1: new low-speed USB device number 3 using dummy_hcd [ 35.061541][ T370] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.072261][ T370] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 35.082189][ T370] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 35.091558][ T370] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 35.095490][ T955] overlayfs: The uuid=off requires a single fs for lower and upper, falling back to uuid=null. [ 35.100043][ T370] usb 2-1: SerialNumber: syz [ 35.131296][ T946] futex_wake_op: syz.2.224 tries to shift op by -1; fix this program [ 35.139428][ T946] futex_wake_op: syz.2.224 tries to shift op by -1; fix this program [ 35.149048][ T946] futex_wake_op: syz.2.224 tries to shift op by -1; fix this program [ 35.164367][ T946] futex_wake_op: syz.2.224 tries to shift op by -1; fix this program [ 35.172919][ T946] futex_wake_op: syz.2.224 tries to shift op by -1; fix this program [ 35.181231][ T946] futex_wake_op: syz.2.224 tries to shift op by -1; fix this program [ 35.189326][ T946] futex_wake_op: syz.2.224 tries to shift op by -1; fix this program [ 35.197646][ T946] futex_wake_op: syz.2.224 tries to shift op by -1; fix this program [ 35.205818][ T946] futex_wake_op: syz.2.224 tries to shift op by -1; fix this program [ 35.220644][ T946] futex_wake_op: syz.2.224 tries to shift op by -1; fix this program [ 35.233556][ T64] usb 3-1: unable to get BOS descriptor or descriptor too short [ 35.245802][ T64] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 35.253584][ T64] usb 3-1: can't read configurations, error -71 [ 35.264926][ T966] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.264953][ T966] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.317357][ T370] usb 2-1: MIDIStreaming interface descriptor not found [ 35.335467][ T370] usb 2-1: USB disconnect, device number 9 [ 35.344462][ T308] udevd[308]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.345289][ T971] rust_binder: got new transaction with bad transaction stack [ 35.361052][ T971] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:230 [ 35.434027][ T974] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.649977][ T981] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:124 [ 35.700620][ T10] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 35.744906][ T983] netlink: 36 bytes leftover after parsing attributes in process `syz.2.235'. [ 35.872789][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 35.884098][ T10] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 35.893792][ T370] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 35.902312][ T10] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 35.920646][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.928663][ T10] usb 1-1: Product: syz [ 35.933005][ T10] usb 1-1: Manufacturer: syz [ 35.937613][ T10] usb 1-1: SerialNumber: syz [ 36.040618][ T370] usb 4-1: device descriptor read/64, error -71 [ 36.127423][ T1012] netlink: 36 bytes leftover after parsing attributes in process `syz.1.245'. [ 36.156758][ T979] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 36.160473][ T1016] /dev/nullb0: Can't lookup blockdev [ 36.171738][ T10] usb 1-1: 0:2 : does not exist [ 36.187152][ T10] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 36.200079][ T10] usb 1-1: USB disconnect, device number 3 [ 36.280717][ T370] usb 4-1: device descriptor read/64, error -71 [ 36.315353][ T1027] rust_binder: Write failure EINVAL in pid:140 [ 36.380839][ T64] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 36.540632][ T370] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 36.549054][ T64] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 36.570611][ T64] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.580389][ T64] usb 3-1: New USB device found, idVendor=1b96, idProduct=000c, bcdDevice= 0.00 [ 36.589628][ T64] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.599538][ T64] usb 3-1: config 0 descriptor?? [ 36.670627][ T370] usb 4-1: device descriptor read/64, error -71 [ 36.920625][ T370] usb 4-1: device descriptor read/64, error -71 [ 37.007240][ T64] ntrig 0003:1B96:000C.0002: unknown main item tag 0x0 [ 37.015058][ T64] ntrig 0003:1B96:000C.0002: hidraw0: USB HID v0.00 Device [HID 1b96:000c] on usb-dummy_hcd.2-1/input0 [ 37.030825][ T370] usb usb4-port1: attempt power cycle [ 37.206469][ T1000] rust_binder: Failed to allocate buffer. len:120, is_oneway:true [ 37.207931][ T64] usb 3-1: USB disconnect, device number 5 [ 37.380728][ T370] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 37.401619][ T370] usb 4-1: device descriptor read/8, error -71 [ 37.531573][ T370] usb 4-1: device descriptor read/8, error -71 [ 37.726539][ T1036] netlink: 36 bytes leftover after parsing attributes in process `syz.0.262'. [ 37.728413][ T36] kauditd_printk_skb: 11 callbacks suppressed [ 37.728431][ T36] audit: type=1400 audit(1751374776.860:256): avc: denied { connect } for pid=1035 comm="syz.1.255" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 37.770774][ T370] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 37.811555][ T370] usb 4-1: device descriptor read/8, error -71 [ 37.850557][ T36] audit: type=1400 audit(1751374776.980:257): avc: denied { nlmsg_write } for pid=1045 comm="syz.1.258" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 37.872062][ T36] audit: type=1400 audit(1751374776.990:258): avc: denied { ioctl } for pid=1045 comm="syz.1.258" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0xf502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 37.941635][ T370] usb 4-1: device descriptor read/8, error -71 [ 38.030629][ T64] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 38.050698][ T370] usb usb4-port1: unable to enumerate USB device [ 38.140628][ T31] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 38.181657][ T64] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.192601][ T64] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.202343][ T64] usb 1-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice= 0.00 [ 38.211402][ T64] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.219925][ T64] usb 1-1: config 0 descriptor?? [ 38.291640][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.302583][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.312347][ T31] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 38.325244][ T31] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 38.334302][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.343166][ T31] usb 3-1: config 0 descriptor?? [ 38.426028][ T36] audit: type=1400 audit(1751374777.560:259): avc: denied { setattr } for pid=1040 comm="syz.0.256" name="RAWv6" dev="sockfs" ino=8098 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 38.627478][ T64] belkin 0003:1020:0006.0003: unknown main item tag 0x3 [ 38.635309][ T64] belkin 0003:1020:0006.0003: hidraw0: USB HID v0.00 Device [HID 1020:0006] on usb-dummy_hcd.0-1/input0 [ 38.669930][ T1060] UHID_CREATE from different security context by process 131 (syz.3.263), this is not allowed. [ 38.693748][ T36] audit: type=1400 audit(1751374777.830:260): avc: denied { append } for pid=1064 comm="syz.3.264" name="vsock" dev="devtmpfs" ino=207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 38.750914][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.758348][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.765765][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.773187][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.780677][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.788096][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.795494][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.802885][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.810243][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.817691][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.825176][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.833085][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.840558][ T1070] netlink: 36 bytes leftover after parsing attributes in process `syz.3.265'. [ 38.849532][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.857080][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.864755][ T31] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 38.873271][ T31] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 38.884638][ T31] plantronics 0003:047F:FFFF.0004: hiddev96,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 38.952483][ T1050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.961011][ T1050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.969575][ T31] usb 3-1: USB disconnect, device number 6 [ 39.110718][ T64] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 39.261999][ T64] usb 4-1: unable to get BOS descriptor or descriptor too short [ 39.270049][ T64] usb 4-1: not running at top speed; connect to a high speed hub [ 39.278531][ T64] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 39.288649][ T64] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 39.298998][ T64] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 39.308073][ T64] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.316066][ T64] usb 4-1: Product: syz [ 39.320236][ T64] usb 4-1: Manufacturer: syz [ 39.324864][ T64] usb 4-1: SerialNumber: syz [ 39.509876][ T36] audit: type=1326 audit(1751374778.640:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1080 comm="syz.2.268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effda58e929 code=0x7ffc0000 [ 39.522714][ T1081] netlink: 16 bytes leftover after parsing attributes in process `syz.2.268'. [ 39.533431][ T36] audit: type=1326 audit(1751374778.640:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1080 comm="syz.2.268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effda58e929 code=0x7ffc0000 [ 39.565710][ T36] audit: type=1326 audit(1751374778.640:263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1080 comm="syz.2.268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7effda58e929 code=0x7ffc0000 [ 39.588923][ T36] audit: type=1326 audit(1751374778.640:264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1080 comm="syz.2.268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7effda58e929 code=0x7ffc0000 [ 39.612964][ T36] audit: type=1326 audit(1751374778.640:265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1080 comm="syz.2.268" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7effda590847 code=0x7ffc0000 [ 39.665607][ T64] usb 4-1: USB disconnect, device number 9 [ 39.960652][ T64] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 40.111717][ T64] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.122669][ T64] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 40.132515][ T64] usb 4-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 40.141674][ T64] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.150275][ T64] usb 4-1: config 0 descriptor?? [ 40.536846][ T1096] rust_binder: Error while translating object. [ 40.536886][ T1096] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 40.543227][ T1096] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:221 [ 40.558589][ T64] hid-thrustmaster 0003:044F:B65D.0005: unknown main item tag 0x0 [ 40.576862][ T64] hid-thrustmaster 0003:044F:B65D.0005: hidraw1: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.3-1/input0 [ 40.600778][ T64] hid-thrustmaster 0003:044F:B65D.0005: Wrong number of endpoints? [ 40.742075][ T1107] netlink: 72 bytes leftover after parsing attributes in process `syz.2.275'. [ 40.795644][ T64] usb 1-1: USB disconnect, device number 4 [ 40.812054][ C0] hid-thrustmaster 0003:044F:B65D.0005: URB to get model id failed with error -71 [ 40.821586][ T9] usb 4-1: USB disconnect, device number 10 [ 41.000647][ T370] usb 3-1: new low-speed USB device number 7 using dummy_hcd [ 41.151655][ T370] usb 3-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 41.162722][ T370] usb 3-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 32, setting to 8 [ 41.173359][ T370] usb 3-1: config 0 interface 0 has no altsetting 0 [ 41.179963][ T370] usb 3-1: New USB device found, idVendor=046d, idProduct=c286, bcdDevice= 0.00 [ 41.189006][ T370] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.197620][ T370] usb 3-1: config 0 descriptor?? [ 41.202843][ T1109] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 41.489419][ T1121] netlink: 36 bytes leftover after parsing attributes in process `syz.1.281'. [ 41.498389][ T1121] netlink: 20 bytes leftover after parsing attributes in process `syz.1.281'. [ 41.546252][ T1125] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.555462][ T1125] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.612553][ T370] logitech 0003:046D:C286.0006: unknown main item tag 0x6 [ 41.620364][ T370] logitech 0003:046D:C286.0006: hidraw0: USB HID v0.00 Device [HID 046d:c286] on usb-dummy_hcd.2-1/input0 [ 41.632885][ T370] logitech 0003:046D:C286.0006: no inputs found [ 41.662065][ T1133] netlink: 72 bytes leftover after parsing attributes in process `syz.3.285'. [ 41.734757][ T1139] rust_binder: Error while translating object. [ 41.734791][ T1139] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 41.741059][ T1139] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:166 [ 41.760090][ T1142] FAULT_INJECTION: forcing a failure. [ 41.760090][ T1142] name failslab, interval 1, probability 0, space 0, times 1 [ 41.781831][ T1142] CPU: 1 UID: 0 PID: 1142 Comm: syz.3.289 Not tainted 6.12.30-syzkaller-g648383294760 #0 93f95243d2c671158253b6b51cea62df3148036e [ 41.781855][ T1142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 41.781864][ T1142] Call Trace: [ 41.781868][ T1142] [ 41.781874][ T1142] __dump_stack+0x21/0x30 [ 41.781895][ T1142] dump_stack_lvl+0x10c/0x190 [ 41.781911][ T1142] ? __cfi_dump_stack_lvl+0x10/0x10 [ 41.781928][ T1142] ? release_sock+0x171/0x1f0 [ 41.781949][ T1142] dump_stack+0x19/0x20 [ 41.781964][ T1142] should_fail_ex+0x3d9/0x530 [ 41.781981][ T1142] should_failslab+0xac/0x100 [ 41.782001][ T1142] kmem_cache_alloc_node_noprof+0x45/0x3b0 [ 41.782023][ T1142] ? __alloc_skb+0x10c/0x370 [ 41.782043][ T1142] __alloc_skb+0x10c/0x370 [ 41.782064][ T1142] netlink_alloc_large_skb+0xf7/0x1b0 [ 41.782086][ T1142] netlink_sendmsg+0x586/0xaf0 [ 41.782101][ T1142] ? __cfi_netlink_sendmsg+0x10/0x10 [ 41.782116][ T1142] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 41.782130][ T1142] ? security_socket_sendmsg+0x33/0xd0 [ 41.782148][ T1142] ? __cfi_netlink_sendmsg+0x10/0x10 [ 41.782162][ T1142] ____sys_sendmsg+0xa15/0xa70 [ 41.782178][ T1142] ? __sys_sendmsg_sock+0x50/0x50 [ 41.782194][ T1142] ? import_iovec+0x81/0xb0 [ 41.782206][ T1142] ___sys_sendmsg+0x220/0x2a0 [ 41.782222][ T1142] ? __sys_sendmsg+0x280/0x280 [ 41.782237][ T1142] ? proc_fail_nth_write+0x17e/0x210 [ 41.782251][ T1142] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 41.782270][ T1142] __x64_sys_sendmsg+0x1eb/0x2c0 [ 41.782285][ T1142] ? fput+0x1a5/0x240 [ 41.782298][ T1142] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 41.782313][ T1142] ? ksys_write+0x1ef/0x250 [ 41.782331][ T1142] ? __kasan_check_read+0x15/0x20 [ 41.782348][ T1142] x64_sys_call+0x2a4c/0x2ee0 [ 41.782366][ T1142] do_syscall_64+0x58/0xf0 [ 41.782378][ T1142] ? clear_bhb_loop+0x50/0xa0 [ 41.782394][ T1142] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 41.782409][ T1142] RIP: 0033:0x7ff1ed98e929 [ 41.782420][ T1142] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 41.782432][ T1142] RSP: 002b:00007ff1ee7f2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 41.782446][ T1142] RAX: ffffffffffffffda RBX: 00007ff1edbb5fa0 RCX: 00007ff1ed98e929 [ 41.782457][ T1142] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 41.782466][ T1142] RBP: 00007ff1ee7f2090 R08: 0000000000000000 R09: 0000000000000000 [ 41.782475][ T1142] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 41.782483][ T1142] R13: 0000000000000000 R14: 00007ff1edbb5fa0 R15: 00007fff13033328 [ 41.782494][ T1142] [ 41.790628][ T998] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 42.059714][ T31] usb 3-1: USB disconnect, device number 7 [ 42.200697][ T998] usb 2-1: Using ep0 maxpacket: 16 [ 42.207214][ T998] usb 2-1: unable to get BOS descriptor or descriptor too short [ 42.215570][ T998] usb 2-1: config 9 has an invalid interface number: 63 but max is 1 [ 42.223671][ T998] usb 2-1: config 9 has an invalid interface number: 159 but max is 1 [ 42.231860][ T998] usb 2-1: config 9 has no interface number 0 [ 42.237934][ T998] usb 2-1: config 9 has no interface number 1 [ 42.244037][ T998] usb 2-1: config 9 interface 63 has no altsetting 0 [ 42.252068][ T998] usb 2-1: New USB device found, idVendor=0582, idProduct=0005, bcdDevice=5c.87 [ 42.261150][ T998] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.269153][ T998] usb 2-1: Product: syz [ 42.273317][ T998] usb 2-1: Manufacturer: syz [ 42.277911][ T998] usb 2-1: SerialNumber: syz [ 42.321038][ T1146] netlink: 36 bytes leftover after parsing attributes in process `syz.3.291'. [ 42.329916][ T1146] netlink: 20 bytes leftover after parsing attributes in process `syz.3.291'. [ 42.351590][ T1148] rust_binder: Failed to allocate buffer. len:128, is_oneway:true [ 42.573695][ T1152] netlink: 72 bytes leftover after parsing attributes in process `syz.2.294'. [ 42.600614][ T9] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 42.604714][ T1154] rust_binder: Write failure EINVAL in pid:237 [ 42.608273][ T1155] rust_binder: Write failure EINVAL in pid:237 [ 42.750638][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 42.771677][ T9] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 42.779896][ T9] usb 4-1: config 1 has no interface number 0 [ 42.800608][ T9] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 42.810646][ T9] usb 4-1: config 1 interface 105 has no altsetting 0 [ 42.821692][ T9] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 42.830996][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 42.839029][ T9] usb 4-1: Product: syz [ 42.843618][ T9] usb 4-1: Manufacturer: syz [ 42.848240][ T9] usb 4-1: SerialNumber: syz [ 42.861119][ T1150] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 43.156194][ T36] kauditd_printk_skb: 50 callbacks suppressed [ 43.156212][ T36] audit: type=1400 audit(1751374782.290:316): avc: denied { create } for pid=1149 comm="syz.3.293" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 44.080617][ T31] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 44.110635][ T64] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 44.230611][ T31] usb 3-1: Using ep0 maxpacket: 8 [ 44.236692][ T31] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 44.244999][ T31] usb 3-1: config 179 has no interface number 0 [ 44.251303][ T31] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 44.262350][ T31] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 44.273577][ T31] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 44.282087][ T64] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 44.284719][ T31] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 44.295984][ T64] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 44.306953][ T31] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 44.306993][ T31] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 44.317077][ T64] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 44.329999][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.331534][ T1162] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 44.339693][ T64] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 44.376504][ T64] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.392957][ T64] usb 1-1: config 0 descriptor?? [ 44.567203][ T36] audit: type=1400 audit(1751374783.700:317): avc: denied { create } for pid=1161 comm="syz.2.298" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 44.590527][ T31] input: Generic X-Box pad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input5 [ 44.609098][ T998] usb 2-1: USB disconnect, device number 10 [ 44.627892][ T884] udevd[884]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:9.63/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 44.769442][ T1162] rust_binder: Got transaction with invalid offset. [ 44.769477][ T1162] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 44.776263][ T1162] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:244 [ 44.786378][ T998] usb 3-1: USB disconnect, device number 8 [ 44.786509][ C1] xpad 3-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 44.809784][ T998] xpad 3-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 44.810621][ C1] dummy_hcd dummy_hcd.2: timer fired with no URBs pending? [ 44.828555][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.838135][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.845573][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.852989][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.860364][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.867771][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.875234][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.882634][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.890031][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.898237][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.905667][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.913128][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.920500][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.927905][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.935307][ T64] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 44.942905][ T64] plantronics 0003:047F:FFFF.0007: No inputs registered, leaving [ 44.951918][ T64] plantronics 0003:047F:FFFF.0007: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 45.052846][ T1164] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.061467][ T1164] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.071391][ T31] usb 1-1: USB disconnect, device number 5 [ 45.142621][ T1171] tipc: Enabling of bearer rejected, failed to enable media [ 45.151456][ T1171] binder: Bad value for 'stats' [ 45.312813][ T1175] FAULT_INJECTION: forcing a failure. [ 45.312813][ T1175] name failslab, interval 1, probability 0, space 0, times 0 [ 45.325619][ T1175] CPU: 0 UID: 0 PID: 1175 Comm: syz.2.301 Not tainted 6.12.30-syzkaller-g648383294760 #0 93f95243d2c671158253b6b51cea62df3148036e [ 45.325651][ T1175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 45.325663][ T1175] Call Trace: [ 45.325669][ T1175] [ 45.325677][ T1175] __dump_stack+0x21/0x30 [ 45.325704][ T1175] dump_stack_lvl+0x10c/0x190 [ 45.325721][ T1175] ? __cfi_dump_stack_lvl+0x10/0x10 [ 45.325743][ T1175] ? __lookup_slow+0x2d4/0x400 [ 45.325765][ T1175] dump_stack+0x19/0x20 [ 45.325781][ T1175] should_fail_ex+0x3d9/0x530 [ 45.325799][ T1175] should_failslab+0xac/0x100 [ 45.325820][ T1175] __kmalloc_cache_noprof+0x41/0x3c0 [ 45.325839][ T1175] ? stack_depot_save+0x12/0x20 [ 45.325857][ T1175] ? ctnetlink_alloc_filter+0xbc/0xbd0 [ 45.325887][ T1175] ctnetlink_alloc_filter+0xbc/0xbd0 [ 45.325909][ T1175] ? ctnetlink_fill_info+0x15a0/0x15a0 [ 45.325931][ T1175] ? __nla_validate+0x70/0x70 [ 45.325954][ T1175] ctnetlink_del_conntrack+0x69b/0x830 [ 45.325975][ T1175] ? __cfi_ctnetlink_del_conntrack+0x10/0x10 [ 45.325998][ T1175] ? __cfi_mutex_lock+0x10/0x10 [ 45.326016][ T1175] nfnetlink_rcv_msg+0x66e/0x860 [ 45.326059][ T1175] ? __cfi_nfnetlink_rcv_msg+0x10/0x10 [ 45.326085][ T1175] ? avc_has_perm_noaudit+0x286/0x360 [ 45.326104][ T1175] ? cred_has_capability+0x281/0x380 [ 45.326129][ T1175] netlink_rcv_skb+0x22e/0x4a0 [ 45.326156][ T1175] ? __cfi_nfnetlink_rcv_msg+0x10/0x10 [ 45.326177][ T1175] ? __cfi_netlink_rcv_skb+0x10/0x10 [ 45.326193][ T1175] ? security_capable+0xcf/0xf0 [ 45.326209][ T1175] ? ns_capable+0x91/0xf0 [ 45.326227][ T1175] ? netlink_net_capable+0x129/0x160 [ 45.326249][ T1175] nfnetlink_rcv+0x278/0x26f0 [ 45.326269][ T1175] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 45.326289][ T1175] ? stack_trace_save+0x9d/0xe0 [ 45.326326][ T1175] ? stack_depot_save_flags+0x38/0x800 [ 45.326347][ T1175] ? __cfi_nfnetlink_rcv+0x10/0x10 [ 45.326368][ T1175] ? kasan_save_alloc_info+0x40/0x50 [ 45.326385][ T1175] ? __kasan_slab_alloc+0x73/0x90 [ 45.326406][ T1175] ? kmem_cache_alloc_node_noprof+0x139/0x3b0 [ 45.326426][ T1175] ? kmalloc_reserve+0xcf/0x500 [ 45.326449][ T1175] ? __alloc_skb+0x144/0x370 [ 45.326471][ T1175] ? netlink_alloc_large_skb+0xf7/0x1b0 [ 45.326506][ T1175] ? netlink_sendmsg+0x586/0xaf0 [ 45.326521][ T1175] ? ____sys_sendmsg+0xa15/0xa70 [ 45.326536][ T1175] ? ___sys_sendmsg+0x220/0x2a0 [ 45.326570][ T1175] ? __x64_sys_sendmsg+0x1eb/0x2c0 [ 45.326587][ T1175] ? x64_sys_call+0x2a4c/0x2ee0 [ 45.326608][ T1175] ? do_syscall_64+0x58/0xf0 [ 45.326621][ T1175] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 45.326642][ T1175] ? selinux_nlmsg_lookup+0x104/0x970 [ 45.326662][ T1175] ? selinux_netlink_send+0x750/0x810 [ 45.326681][ T1175] ? __asan_memset+0x39/0x50 [ 45.326699][ T1175] ? __netlink_lookup+0x432/0x490 [ 45.326717][ T1175] ? netlink_autobind+0x1c0/0x1c0 [ 45.326734][ T1175] ? is_vmalloc_addr+0x11/0x40 [ 45.326748][ T1175] netlink_unicast+0x8c6/0xa60 [ 45.326763][ T1175] netlink_sendmsg+0x7f0/0xaf0 [ 45.326781][ T1175] ? __cfi_netlink_sendmsg+0x10/0x10 [ 45.326798][ T1175] ? bpf_lsm_socket_sendmsg+0xd/0x20 [ 45.326813][ T1175] ? security_socket_sendmsg+0x33/0xd0 [ 45.326833][ T1175] ? __cfi_netlink_sendmsg+0x10/0x10 [ 45.326850][ T1175] ____sys_sendmsg+0xa15/0xa70 [ 45.326868][ T1175] ? __sys_sendmsg_sock+0x50/0x50 [ 45.326891][ T1175] ? import_iovec+0x81/0xb0 [ 45.326905][ T1175] ___sys_sendmsg+0x220/0x2a0 [ 45.326922][ T1175] ? __sys_sendmsg+0x280/0x280 [ 45.326939][ T1175] ? proc_fail_nth_write+0x17e/0x210 [ 45.326955][ T1175] ? __cfi_proc_fail_nth_write+0x10/0x10 [ 45.326977][ T1175] __x64_sys_sendmsg+0x1eb/0x2c0 [ 45.326994][ T1175] ? fput+0x1a5/0x240 [ 45.327008][ T1175] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 45.327025][ T1175] ? ksys_write+0x1ef/0x250 [ 45.327046][ T1175] ? __kasan_check_read+0x15/0x20 [ 45.327065][ T1175] x64_sys_call+0x2a4c/0x2ee0 [ 45.327085][ T1175] do_syscall_64+0x58/0xf0 [ 45.327098][ T1175] ? clear_bhb_loop+0x50/0xa0 [ 45.327116][ T1175] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 45.327133][ T1175] RIP: 0033:0x7effda58e929 [ 45.327146][ T1175] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 45.327159][ T1175] RSP: 002b:00007effdb48e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 45.327176][ T1175] RAX: ffffffffffffffda RBX: 00007effda7b5fa0 RCX: 00007effda58e929 [ 45.327188][ T1175] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 45.327199][ T1175] RBP: 00007effdb48e090 R08: 0000000000000000 R09: 0000000000000000 [ 45.327209][ T1175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 45.327218][ T1175] R13: 0000000000000000 R14: 00007effda7b5fa0 R15: 00007ffca9c34e88 [ 45.327231][ T1175] [ 45.604246][ T1177] netlink: 72 bytes leftover after parsing attributes in process `syz.0.303'. [ 45.613616][ T9] aqc111 4-1:1.105: probe with driver aqc111 failed with error -22 [ 45.658151][ T1180] netlink: 12 bytes leftover after parsing attributes in process `syz.2.304'. [ 45.659552][ T9] usb 4-1: USB disconnect, device number 11 [ 45.902862][ T1201] rust_binder: Error in use_page_slow: ESRCH [ 45.902878][ T1201] rust_binder: use_range failure ESRCH [ 45.908916][ T1201] rust_binder: Failed to allocate buffer. len:152, is_oneway:false [ 45.914418][ T1201] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 45.922401][ T1201] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:187 [ 45.940624][ T31] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 45.967133][ T1207] FAULT_INJECTION: forcing a failure. [ 45.967133][ T1207] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 45.981295][ T1207] CPU: 0 UID: 0 PID: 1207 Comm: syz.2.313 Not tainted 6.12.30-syzkaller-g648383294760 #0 93f95243d2c671158253b6b51cea62df3148036e [ 45.981325][ T1207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 45.981337][ T1207] Call Trace: [ 45.981344][ T1207] [ 45.981351][ T1207] __dump_stack+0x21/0x30 [ 45.981379][ T1207] dump_stack_lvl+0x10c/0x190 [ 45.981402][ T1207] ? __cfi_dump_stack_lvl+0x10/0x10 [ 45.981427][ T1207] dump_stack+0x19/0x20 [ 45.981465][ T1207] should_fail_ex+0x3d9/0x530 [ 45.981490][ T1207] should_fail+0xf/0x20 [ 45.981512][ T1207] should_fail_usercopy+0x1e/0x30 [ 45.981538][ T1207] _copy_to_user+0x24/0xa0 [ 45.981576][ T1207] simple_read_from_buffer+0xed/0x160 [ 45.981598][ T1207] proc_fail_nth_read+0x19e/0x210 [ 45.981620][ T1207] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 45.981642][ T1207] ? bpf_lsm_file_permission+0xd/0x20 [ 45.981666][ T1207] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 45.981688][ T1207] vfs_read+0x278/0xb60 [ 45.981714][ T1207] ? __cfi_vfs_read+0x10/0x10 [ 45.981739][ T1207] ? __kasan_check_write+0x18/0x20 [ 45.981764][ T1207] ? mutex_lock+0x92/0x1c0 [ 45.981788][ T1207] ? __cfi_mutex_lock+0x10/0x10 [ 45.981821][ T1207] ? __fget_files+0x2c5/0x340 [ 45.981867][ T1207] ksys_read+0x141/0x250 [ 45.981893][ T1207] ? __cfi_ksys_read+0x10/0x10 [ 45.981919][ T1207] ? __kasan_check_read+0x15/0x20 [ 45.981944][ T1207] __x64_sys_read+0x7f/0x90 [ 45.981970][ T1207] x64_sys_call+0x2638/0x2ee0 [ 45.981997][ T1207] do_syscall_64+0x58/0xf0 [ 45.982015][ T1207] ? clear_bhb_loop+0x50/0xa0 [ 45.982039][ T1207] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 45.982061][ T1207] RIP: 0033:0x7effda58d33c [ 45.982077][ T1207] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 45.982093][ T1207] RSP: 002b:00007effdb48e030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 45.982115][ T1207] RAX: ffffffffffffffda RBX: 00007effda7b5fa0 RCX: 00007effda58d33c [ 45.982132][ T1207] RDX: 000000000000000f RSI: 00007effdb48e0a0 RDI: 0000000000000004 [ 45.982145][ T1207] RBP: 00007effdb48e090 R08: 0000000000000000 R09: 0000000000000000 [ 45.982159][ T1207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 45.982172][ T1207] R13: 0000000000000000 R14: 00007effda7b5fa0 R15: 00007ffca9c34e88 [ 45.982189][ T1207] [ 46.222594][ T31] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 46.250652][ T31] usb 2-1: config 0 has no interfaces? [ 46.256850][ T36] audit: type=1400 audit(1751374785.390:318): avc: denied { getopt } for pid=1213 comm="syz.3.316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 46.279177][ T31] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 46.282564][ T36] audit: type=1400 audit(1751374785.390:319): avc: denied { setopt } for pid=1213 comm="syz.3.316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 46.296437][ T1219] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.310636][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 46.338363][ T31] usb 2-1: config 0 descriptor?? [ 46.446104][ T1239] netlink: 'syz.0.323': attribute type 12 has an invalid length. [ 46.454064][ T1237] netlink: 36 bytes leftover after parsing attributes in process `syz.3.324'. [ 46.465601][ T1237] netlink: 16 bytes leftover after parsing attributes in process `syz.3.324'. [ 46.515618][ T36] audit: type=1400 audit(1751374785.650:320): avc: denied { map } for pid=1242 comm="syz.3.325" path="socket:[10579]" dev="sockfs" ino=10579 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 46.550653][ T1249] netlink: 72 bytes leftover after parsing attributes in process `syz.3.326'. [ 46.562136][ T998] usb 2-1: USB disconnect, device number 11 [ 46.590865][ T1251] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.606478][ T1255] rust_binder: Write failure EINVAL in pid:219 [ 46.616962][ T1258] incfs: Backing dir is not set, filesystem can't be mounted. [ 46.633865][ T1258] incfs: mount failed -2 [ 46.671096][ T1273] netlink: 36 bytes leftover after parsing attributes in process `syz.0.333'. [ 46.698826][ T36] audit: type=1400 audit(1751374785.830:321): avc: denied { append } for pid=1275 comm="syz.0.335" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 46.850276][ T36] audit: type=1400 audit(1751374785.980:322): avc: denied { read } for pid=1291 comm="syz.0.340" name="msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 46.873033][ T36] audit: type=1400 audit(1751374785.980:323): avc: denied { open } for pid=1291 comm="syz.0.340" path="/dev/cpu/0/msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 47.000626][ T31] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 47.047215][ T1300] netlink: 'syz.0.342': attribute type 4 has an invalid length. [ 47.099077][ T36] audit: type=1400 audit(1751374786.230:324): avc: denied { watch watch_reads } for pid=1305 comm="syz.1.344" path="/63/file0" dev="tmpfs" ino=372 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 47.160778][ T31] usb 3-1: Using ep0 maxpacket: 32 [ 47.171706][ T31] usb 3-1: unable to get BOS descriptor or descriptor too short [ 47.180506][ T31] usb 3-1: config 128 has an invalid interface number: 127 but max is 3 [ 47.202457][ T31] usb 3-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 47.213078][ T1311] netlink: 36 bytes leftover after parsing attributes in process `syz.3.346'. [ 47.222339][ T31] usb 3-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 47.228771][ T1316] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 47.238981][ T31] usb 3-1: config 128 has no interface number 0 [ 47.249542][ T1316] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 47.251782][ T1316] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:301 [ 47.263979][ T31] usb 3-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 127, changing to 10 [ 47.284984][ T36] audit: type=1400 audit(1751374786.420:325): avc: denied { watch watch_reads } for pid=1318 comm="syz.1.348" path="/64" dev="tmpfs" ino=373 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 47.309585][ T31] usb 3-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid maxpacket 41225, setting to 1024 [ 47.321931][ T31] usb 3-1: config 128 interface 127 has no altsetting 0 [ 47.332876][ T31] usb 3-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 47.345430][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.355973][ T1330] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 47.356001][ T1330] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:183 [ 47.373648][ T31] usb 3-1: Product: syz [ 47.400612][ T31] usb 3-1: Manufacturer: syz [ 47.405437][ T31] usb 3-1: SerialNumber: syz [ 47.420104][ T1339] binder: Unknown parameter 'rw.' [ 47.464810][ T1347] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4 sclass=netlink_route_socket pid=1347 comm=syz.1.355 [ 47.500004][ T1350] netlink: 36 bytes leftover after parsing attributes in process `syz.0.357'. [ 47.535361][ T1352] exFAT-fs (rnullb0): invalid boot record signature [ 47.542144][ T1352] exFAT-fs (rnullb0): failed to read boot sector [ 47.548507][ T1352] exFAT-fs (rnullb0): failed to recognize exfat type [ 47.591836][ T1355] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 47.592246][ T1355] rust_binder: Failed to allocate buffer. len:4208, is_oneway:false [ 47.600985][ T1355] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 47.616814][ T1355] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:315 [ 47.636274][ T31] usb 3-1: USB disconnect, device number 9 [ 47.657693][ T884] udevd[884]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:128.127/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 47.680688][ T9] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 47.821778][ T1377] netlink: 72 bytes leftover after parsing attributes in process `syz.1.367'. [ 47.841744][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 47.857795][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.867786][ T9] usb 4-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 47.877017][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.894520][ T9] usb 4-1: config 0 descriptor?? [ 47.960141][ T1386] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 48.035800][ T1386] /dev/md0: Can't lookup blockdev [ 48.075839][ T1388] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.076507][ T1388] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.170666][ T998] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 48.189478][ T1400] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.192139][ T1402] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 48.208510][ T1402] input: syz0 as /devices/virtual/input/input6 [ 48.236294][ T1404] netlink: 72 bytes leftover after parsing attributes in process `syz.2.378'. [ 48.301308][ T9] hid-multitouch 0003:1FD2:6007.0008: collection stack underflow [ 48.309143][ T9] hid-multitouch 0003:1FD2:6007.0008: item 0 4 0 12 parsing failed [ 48.319578][ T9] hid-multitouch 0003:1FD2:6007.0008: probe with driver hid-multitouch failed with error -22 [ 48.330593][ T998] usb 2-1: Using ep0 maxpacket: 32 [ 48.338057][ T998] usb 2-1: config 0 has an invalid interface number: 36 but max is 1 [ 48.346185][ T998] usb 2-1: config 0 has an invalid interface number: 129 but max is 1 [ 48.354385][ T998] usb 2-1: config 0 has no interface number 0 [ 48.360486][ T998] usb 2-1: config 0 has no interface number 1 [ 48.361817][ T1407] rust_binder: Write failure EINVAL in pid:289 [ 48.366674][ T998] usb 2-1: config 0 interface 129 altsetting 6 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 48.383881][ T998] usb 2-1: config 0 interface 36 has no altsetting 0 [ 48.390551][ T998] usb 2-1: config 0 interface 129 has no altsetting 0 [ 48.398679][ T998] usb 2-1: New USB device found, idVendor=04bb, idProduct=0930, bcdDevice=cb.5d [ 48.407932][ T998] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.415931][ T998] usb 2-1: Product: syz [ 48.420107][ T998] usb 2-1: Manufacturer: syz [ 48.424735][ T998] usb 2-1: SerialNumber: syz [ 48.429864][ T998] usb 2-1: config 0 descriptor?? [ 48.502142][ T31] usb 4-1: USB disconnect, device number 12 [ 48.640185][ T36] kauditd_printk_skb: 2 callbacks suppressed [ 48.640202][ T36] audit: type=1400 audit(1751374787.770:328): avc: denied { bind } for pid=1383 comm="syz.1.369" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 48.763686][ T998] asix 2-1:0.36 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 48.773893][ T998] asix 2-1:0.36: probe with driver asix failed with error -71 [ 48.782587][ T998] asix 2-1:0.129 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 48.792758][ T998] asix 2-1:0.129: probe with driver asix failed with error -71 [ 48.801708][ T998] usb 2-1: USB disconnect, device number 12 [ 49.031285][ T1413] 9pnet: p9_errstr2errno: server reported unknown error [ 49.292767][ T1433] overlayfs: The uuid=off requires a single fs for lower and upper, falling back to uuid=null. [ 49.390941][ T370] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 49.537674][ T36] audit: type=1400 audit(1751374788.670:329): avc: denied { create } for pid=1435 comm="syz.3.389" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 49.557776][ T31] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 49.566368][ T370] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 49.577820][ T370] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 49.587971][ T370] usb 3-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice= 0.00 [ 49.597192][ T370] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.610963][ T370] usb 3-1: config 0 descriptor?? [ 49.710696][ T31] usb 2-1: Using ep0 maxpacket: 16 [ 49.717025][ T31] usb 2-1: config 0 has no interfaces? [ 49.724189][ T31] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 49.733519][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.741676][ T31] usb 2-1: Product: syz [ 49.745952][ T31] usb 2-1: Manufacturer: syz [ 49.750756][ T31] usb 2-1: SerialNumber: syz [ 49.756642][ T31] usb 2-1: config 0 descriptor?? [ 49.770633][ T9] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 49.921719][ T9] usb 4-1: too many endpoints for config 0 interface 0 altsetting 253: 33, using maximum allowed: 30 [ 49.932655][ T9] usb 4-1: config 0 interface 0 altsetting 253 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 49.943711][ T9] usb 4-1: config 0 interface 0 altsetting 253 endpoint 0x81 has invalid wMaxPacketSize 0 [ 49.953652][ T9] usb 4-1: config 0 interface 0 altsetting 253 has 1 endpoint descriptor, different from the interface descriptor's value: 33 [ 49.965383][ T1433] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.966743][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 49.975586][ T1433] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.981650][ T9] usb 4-1: New USB device found, idVendor=046d, idProduct=c090, bcdDevice= 0.00 [ 49.992634][ T306] usb 2-1: USB disconnect, device number 13 [ 49.998372][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.012858][ T9] usb 4-1: config 0 descriptor?? [ 50.027525][ T370] belkin 0003:1020:0006.0009: unknown main item tag 0x3 [ 50.035768][ T370] belkin 0003:1020:0006.0009: hidraw0: USB HID v0.00 Device [HID 1020:0006] on usb-dummy_hcd.2-1/input0 [ 50.170630][ T31] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 50.321663][ T31] usb 1-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=a0.b5 [ 50.330781][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.339411][ T31] usb 1-1: config 0 descriptor?? [ 50.419819][ T36] audit: type=1400 audit(1751374789.550:330): avc: denied { map } for pid=1435 comm="syz.3.389" path="/dev/bus/usb/003/001" dev="devtmpfs" ino=102 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 50.492625][ T9] usbhid 4-1:0.0: can't add hid device: -22 [ 50.498659][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -22 [ 50.507943][ T9] usb 4-1: USB disconnect, device number 13 [ 50.527186][ T1444] rust_binder: Error while translating object. [ 50.527211][ T1444] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 50.533441][ T1444] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:219 [ 50.545434][ T31] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 50.564636][ T31] asix 1-1:0.0: probe with driver asix failed with error -32 [ 51.063525][ T36] audit: type=1400 audit(1751374790.200:331): avc: denied { write } for pid=1468 comm="syz.1.408" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 51.118824][ T1472] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 51.380615][ T31] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 51.531710][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.542700][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 51.552456][ T31] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 51.565367][ T31] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 51.574427][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.583141][ T31] usb 4-1: config 0 descriptor?? [ 51.791054][ T31] plantronics 0003:047F:FFFF.000A: unknown main item tag 0xd [ 51.799629][ T31] plantronics 0003:047F:FFFF.000A: No inputs registered, leaving [ 51.810355][ T31] plantronics 0003:047F:FFFF.000A: hiddev96,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 52.040940][ T1475] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 52.041024][ T1474] rust_binder: Failed to allocate buffer. len:128, is_oneway:false [ 52.048240][ T370] usb 4-1: USB disconnect, device number 14 [ 52.140386][ T36] audit: type=1400 audit(1751374791.270:332): avc: denied { lock } for pid=1489 comm="syz.1.409" path="socket:[11501]" dev="sockfs" ino=11501 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 52.203639][ T1491] tipc: Started in network mode [ 52.208607][ T1491] tipc: Node identity 1271b44bd5c6, cluster identity 4711 [ 52.215831][ T1491] tipc: Enabled bearer , priority 0 [ 52.232274][ T31] usb 3-1: USB disconnect, device number 10 [ 52.253841][ T1491] tipc: Disabling bearer [ 52.261735][ T1494] pim6reg1: entered allmulticast mode [ 52.402732][ T36] audit: type=1400 audit(1751374791.540:333): avc: denied { bind } for pid=1493 comm="syz.2.410" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 52.422220][ T1494] fuse: Unknown parameter 'G' [ 52.577359][ T1515] netlink: 72 bytes leftover after parsing attributes in process `syz.3.416'. [ 52.669192][ T36] audit: type=1400 audit(1751374791.800:334): avc: denied { mount } for pid=1531 comm="syz.2.422" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 52.693667][ T36] audit: type=1400 audit(1751374791.830:335): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 52.843414][ T1541] netlink: 72 bytes leftover after parsing attributes in process `syz.3.427'. [ 52.883636][ T31] usb 1-1: USB disconnect, device number 6 [ 53.210628][ T370] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 53.363026][ T370] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 53.374217][ T370] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 53.384698][ T370] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 53.397997][ T370] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 53.407225][ T370] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.416335][ T370] usb 4-1: config 0 descriptor?? [ 53.546177][ T1560] netlink: 12 bytes leftover after parsing attributes in process `syz.1.433'. [ 53.676377][ T1567] fuseblk: Bad value for 'rootmode' [ 53.724820][ T36] audit: type=1400 audit(1751374792.860:336): avc: denied { map } for pid=1568 comm="syz.2.437" path="socket:[11928]" dev="sockfs" ino=11928 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 53.761103][ T1569] mmap: syz.2.437 (1569) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 53.811728][ T1573] netlink: 72 bytes leftover after parsing attributes in process `syz.2.439'. [ 53.841690][ T36] audit: type=1400 audit(1751374792.980:337): avc: denied { ioctl } for pid=1574 comm="syz.0.441" path="socket:[13129]" dev="sockfs" ino=13129 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 54.029912][ T370] usbhid 4-1:0.0: can't add hid device: -71 [ 54.036289][ T370] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 54.045162][ T370] usb 4-1: USB disconnect, device number 15 [ 54.100622][ T1165] usb 1-1: new low-speed USB device number 7 using dummy_hcd [ 54.251961][ T1165] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 54.259589][ T1165] usb 1-1: can't read configurations, error -61 [ 54.372441][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.372471][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.378923][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.385480][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.391931][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.398362][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.400647][ T1165] usb 1-1: new low-speed USB device number 8 using dummy_hcd [ 54.404817][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.418585][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.425023][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.431527][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.437986][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.444442][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.450891][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.457308][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.463735][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.470166][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.476607][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.483052][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.489460][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.495888][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.502320][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.508727][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.515586][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.522036][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.528453][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.534904][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.541369][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.547831][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.562379][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.563090][ T1165] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 54.568824][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.568844][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.584652][ T1165] usb 1-1: can't read configurations, error -61 [ 54.603857][ T1165] usb usb1-port1: attempt power cycle [ 54.609618][ T1583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.655246][ T1595] netlink: 72 bytes leftover after parsing attributes in process `syz.2.449'. [ 54.687459][ T1599] devtmpfs: Unknown parameter '^ *([%' [ 54.897315][ T36] audit: type=1400 audit(1751374794.030:338): avc: denied { getopt } for pid=1613 comm="syz.1.455" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 54.897540][ T1614] __vm_enough_memory: pid: 1614, comm: syz.1.455, bytes: 70373039144960 not enough memory for the allocation [ 54.940632][ T1165] usb 1-1: new low-speed USB device number 9 using dummy_hcd [ 54.963669][ T1165] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 54.971322][ T1165] usb 1-1: can't read configurations, error -61 [ 55.100628][ T1165] usb 1-1: new low-speed USB device number 10 using dummy_hcd [ 55.122543][ T1165] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 55.130151][ T1165] usb 1-1: can't read configurations, error -61 [ 55.136515][ T1165] usb usb1-port1: unable to enumerate USB device [ 55.250687][ T370] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 55.339967][ T1622] netlink: 'syz.2.458': attribute type 12 has an invalid length. [ 55.349254][ T1622] netlink: 'syz.2.458': attribute type 12 has an invalid length. [ 55.422111][ T370] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 55.433800][ T370] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 55.445035][ T370] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 55.455136][ T370] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 55.468308][ T370] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 55.477503][ T370] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.491920][ T370] usb 2-1: config 0 descriptor?? [ 55.518485][ T1630] netlink: 72 bytes leftover after parsing attributes in process `syz.3.460'. [ 55.570573][ T36] audit: type=1400 audit(1751374794.700:339): avc: denied { connect } for pid=1633 comm="syz.3.462" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 55.758375][ T1657] netlink: 72 bytes leftover after parsing attributes in process `syz.2.471'. [ 55.818562][ T36] audit: type=1400 audit(1751374794.950:340): avc: denied { nlmsg_tty_audit } for pid=1666 comm="syz.2.476" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 55.866560][ T36] audit: type=1400 audit(1751374795.000:341): avc: denied { ioctl } for pid=1676 comm="syz.2.479" path="socket:[12113]" dev="sockfs" ino=12113 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 55.890640][ T9] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 55.912255][ T370] plantronics 0003:047F:FFFF.000B: ignoring exceeding usage max [ 55.921898][ T370] plantronics 0003:047F:FFFF.000B: No inputs registered, leaving [ 55.930731][ T370] plantronics 0003:047F:FFFF.000B: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 56.042796][ T9] usb 4-1: New USB device found, idVendor=0b95, idProduct=772b, bcdDevice=a2.4c [ 56.051867][ T9] usb 4-1: New USB device strings: Mfr=24, Product=2, SerialNumber=3 [ 56.059929][ T9] usb 4-1: Product: syz [ 56.064125][ T9] usb 4-1: Manufacturer: syz [ 56.068749][ T9] usb 4-1: SerialNumber: syz [ 56.074012][ T9] usb 4-1: config 0 descriptor?? [ 56.681693][ T9] asix 4-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 56.861537][ T1690] netlink: 72 bytes leftover after parsing attributes in process `syz.0.483'. [ 56.900520][ T1694] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=53 sclass=netlink_route_socket pid=1694 comm=syz.0.485 [ 56.913004][ T1694] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=31 sclass=netlink_route_socket pid=1694 comm=syz.0.485 [ 56.925652][ T1694] netlink: 'syz.0.485': attribute type 27 has an invalid length. [ 57.241305][ T36] audit: type=1400 audit(1751374796.380:342): avc: denied { map } for pid=1724 comm="syz.0.496" path="/dev/zero" dev="devtmpfs" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 57.279226][ T1727] netlink: 36 bytes leftover after parsing attributes in process `syz.0.497'. [ 57.307402][ T36] audit: type=1400 audit(1751374796.440:343): avc: denied { mount } for pid=1728 comm="syz.0.498" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 57.322340][ T9] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 57.339486][ T9] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 57.353180][ T64] usb 2-1: reset high-speed USB device number 14 using dummy_hcd [ 57.363866][ T36] audit: type=1400 audit(1751374796.500:344): avc: denied { map } for pid=1731 comm="syz.0.499" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=13487 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 57.393495][ T9] asix 4-1:0.0: probe with driver asix failed with error -71 [ 57.399603][ T36] audit: type=1400 audit(1751374796.500:345): avc: denied { read write } for pid=1731 comm="syz.0.499" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=13487 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 57.404934][ T9] usb 4-1: USB disconnect, device number 16 [ 57.490623][ T64] usb 2-1: device descriptor read/64, error -32 [ 57.640615][ T1165] usb 1-1: new low-speed USB device number 11 using dummy_hcd [ 57.730646][ T64] usb 2-1: device descriptor read/64, error -32 [ 57.792121][ T1165] usb 1-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 57.803169][ T1165] usb 1-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 57.814278][ T1165] usb 1-1: config 0 interface 0 has no altsetting 0 [ 57.820946][ T1165] usb 1-1: New USB device found, idVendor=056a, idProduct=0319, bcdDevice= 0.00 [ 57.830027][ T1165] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.840622][ T1165] usb 1-1: config 0 descriptor?? [ 57.849321][ T1738] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 57.949052][ T1745] netlink: 5 bytes leftover after parsing attributes in process `syz.2.501'. [ 57.970617][ T64] usb 2-1: reset high-speed USB device number 14 using dummy_hcd [ 58.100617][ T64] usb 2-1: device descriptor read/64, error -32 [ 58.263362][ T1165] wacom 0003:056A:0319.000C: unknown main item tag 0x0 [ 58.271880][ T1165] wacom 0003:056A:0319.000C: unknown main item tag 0x0 [ 58.278818][ T1165] wacom 0003:056A:0319.000C: unknown main item tag 0x0 [ 58.285910][ T1165] wacom 0003:056A:0319.000C: unknown main item tag 0x0 [ 58.292819][ T1165] wacom 0003:056A:0319.000C: unknown main item tag 0x0 [ 58.299681][ T1165] wacom 0003:056A:0319.000C: unknown main item tag 0x0 [ 58.306601][ T1165] wacom 0003:056A:0319.000C: unknown main item tag 0x0 [ 58.313501][ T1165] wacom 0003:056A:0319.000C: unknown main item tag 0x0 [ 58.336854][ T1751] FAT-fs (rnullb0): bogus number of reserved sectors [ 58.343603][ T1751] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 58.403619][ T1755] netlink: 36 bytes leftover after parsing attributes in process `syz.3.507'. [ 58.431086][ T1758] netlink: 'syz.3.508': attribute type 27 has an invalid length. [ 58.483195][ T1165] usb 1-1: USB disconnect, device number 11 [ 58.980897][ T998] usb 2-1: USB disconnect, device number 14 [ 59.003646][ T1781] netlink: 36 bytes leftover after parsing attributes in process `syz.0.517'. [ 59.103428][ T1791] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 59.103452][ T1791] rust_binder: Read failure Err(EFAULT) in pid:406 [ 59.236570][ T1801] 9p: Unknown access argument jDBƄ*K<;b=n#U66q#'5f't@|inRל"TK0_' [ 59.236570][ T1801] b..=#:Cء7: -22 [ 59.287099][ T36] kauditd_printk_skb: 1 callbacks suppressed [ 59.287123][ T36] audit: type=1400 audit(1751374798.420:347): avc: denied { setopt } for pid=1804 comm="syz.0.527" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 59.287435][ T1805] netlink: 4 bytes leftover after parsing attributes in process `syz.0.527'. [ 59.352254][ T1810] netlink: 36 bytes leftover after parsing attributes in process `syz.0.529'. [ 59.612258][ T998] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 59.622013][ T1823] netlink: 72 bytes leftover after parsing attributes in process `syz.1.534'. [ 59.696222][ T1829] netlink: 'syz.1.537': attribute type 16 has an invalid length. [ 59.704059][ T1829] netlink: 64138 bytes leftover after parsing attributes in process `syz.1.537'. [ 59.713827][ T1829] binder: Unknown parameter 'dLS;t' [ 59.750583][ T36] audit: type=1400 audit(1751374798.880:348): avc: denied { nlmsg_read } for pid=1833 comm="syz.1.539" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 59.761645][ T998] usb 4-1: config index 0 descriptor too short (expected 5668, got 36) [ 59.789301][ T998] usb 4-1: config 3 has too many interfaces: 84, using maximum allowed: 32 [ 59.798217][ T998] usb 4-1: config 3 has 1 interface, different from the descriptor's value: 84 [ 59.799184][ T1836] rust_binder: Error while translating object. [ 59.808579][ T1836] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 59.810760][ T998] usb 4-1: config 3 has no interface number 0 [ 59.815251][ T1836] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:331 [ 59.830601][ T998] usb 4-1: config 3 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 59.860735][ T998] usb 4-1: config 3 interface 20 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 59.871990][ T998] usb 4-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 59.881139][ T998] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 59.889132][ T998] usb 4-1: Product: syz [ 59.893377][ T998] usb 4-1: Manufacturer: syz [ 59.897978][ T998] usb 4-1: SerialNumber: syz [ 59.912056][ T1814] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 60.000781][ T1846] netlink: 72 bytes leftover after parsing attributes in process `syz.1.544'. [ 60.036959][ T1848] netlink: 52 bytes leftover after parsing attributes in process `syz.1.545'. [ 60.150600][ T9] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 60.187664][ T998] usb-storage 4-1:3.20: USB Mass Storage device detected [ 60.201689][ T998] usb-storage 4-1:3.20: Quirks match for vid 04e6 pid 000b: 4 [ 60.220801][ T998] scsi host1: usb-storage 4-1:3.20 [ 60.228372][ T998] usb 4-1: USB disconnect, device number 17 [ 60.300666][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 60.308606][ T9] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 60.326810][ T9] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 60.331458][ T1869] netlink: 72 bytes leftover after parsing attributes in process `syz.1.553'. [ 60.337125][ T9] usb 1-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 60.358650][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 60.365450][ T9] usb 1-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 60.374552][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 60.391350][ T9] usb 1-1: config 0 descriptor?? [ 60.430170][ T1166] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 60.438278][ T1166] hid-generic 0000:0000:0000.000D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 60.950622][ T1166] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 60.973844][ T1893] fuseblk: Bad value for 'fd' [ 61.042295][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 61.048254][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 61.057083][ T9] usb 1-1: USB disconnect, device number 12 [ 61.100665][ T1166] usb 4-1: Using ep0 maxpacket: 16 [ 61.109959][ T1166] usb 4-1: config 1 has an invalid interface number: 105 but max is 0 [ 61.118784][ T1166] usb 4-1: config 1 has no interface number 0 [ 61.125050][ T1166] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 61.135084][ T1166] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 61.145303][ T1166] usb 4-1: config 1 interface 105 has no altsetting 0 [ 61.154709][ T1166] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 61.159131][ T1907] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 61.163817][ T1907] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:383 [ 61.165979][ T1166] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.190625][ T1166] usb 4-1: Product: syz [ 61.191469][ T1909] binder: Bad value for 'defcontext' [ 61.194801][ T1166] usb 4-1: Manufacturer: syz [ 61.194823][ T1166] usb 4-1: SerialNumber: syz [ 61.210473][ T1883] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 61.217840][ T1883] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 61.433556][ T1920] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 61.455840][ T1924] tmpfs: Unknown parameter 'h yuid' [ 61.523948][ T1934] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:408 [ 61.551323][ T1939] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:413 [ 61.565722][ T1941] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 61.576102][ T1941] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 61.583226][ T36] audit: type=1400 audit(1751374800.720:349): avc: denied { lock } for pid=1940 comm="syz.0.583" path="/dev/binderfs/binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 61.613577][ T1945] SELinux: Context system_u:object_r:usb_device_t:s0 is not valid (left unmapped). [ 61.625775][ T1941] rust_binder: 1941: no such ref 3 [ 61.628290][ T1883] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 61.637476][ T36] audit: type=1400 audit(1751374800.760:350): avc: denied { create } for pid=1946 comm="syz.1.585" name="core" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:usb_device_t:s0" [ 61.662276][ T1883] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 61.669458][ T36] audit: type=1400 audit(1751374800.760:351): avc: denied { associate } for pid=1946 comm="syz.1.585" name="core" scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:usb_device_t:s0" [ 61.695173][ T36] audit: type=1400 audit(1751374800.760:352): avc: denied { write open } for pid=1946 comm="syz.1.585" path="/151/core" dev="tmpfs" ino=844 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:usb_device_t:s0" [ 61.695839][ T1947] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:424 [ 62.477196][ T1166] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -71 [ 62.498510][ T1166] aqc111 4-1:1.105 eth1: register 'aqc111' at usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, aa:0f:6d:40:8e:96 [ 62.512505][ T1166] usb 4-1: USB disconnect, device number 18 [ 62.521508][ T36] audit: type=1400 audit(1751374801.660:353): avc: denied { read } for pid=148 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 62.522279][ T1166] aqc111 4-1:1.105 eth1: unregister 'aqc111' usb-dummy_hcd.3-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 62.555780][ T36] audit: type=1400 audit(1751374801.700:354): avc: denied { search } for pid=148 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 62.582235][ T36] audit: type=1400 audit(1751374801.700:355): avc: denied { read } for pid=148 comm="dhcpcd" name="n15" dev="tmpfs" ino=3253 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 62.606492][ T36] audit: type=1400 audit(1751374801.700:356): avc: denied { open } for pid=148 comm="dhcpcd" path="/run/udev/data/n15" dev="tmpfs" ino=3253 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 62.650990][ T1166] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 62.660344][ T1166] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 62.671077][ T45] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 62.675630][ T1166] aqc111 4-1:1.105 eth1 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 62.831698][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 62.849844][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 62.859789][ T45] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 62.872912][ T45] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 62.882051][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 62.890917][ T45] usb 1-1: config 0 descriptor?? [ 63.025784][ T2004] rust_binder: 2004: no such ref 0 [ 63.031068][ T2004] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 63.031087][ T2004] rust_binder: Read failure Err(EFAULT) in pid:335 [ 63.039363][ T2004] rust_binder: Write failure EINVAL in pid:335 [ 63.066289][ T2015] __nla_validate_parse: 9 callbacks suppressed [ 63.066309][ T2015] netlink: 88 bytes leftover after parsing attributes in process `syz.3.601'. [ 63.079799][ T2017] netlink: 52 bytes leftover after parsing attributes in process `syz.2.602'. [ 63.107449][ T2019] netlink: 88 bytes leftover after parsing attributes in process `syz.3.603'. [ 63.116391][ T2019] netlink: 8 bytes leftover after parsing attributes in process `syz.3.603'. [ 63.305048][ T1957] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 63.313761][ T1957] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 63.339750][ T45] plantronics 0003:047F:FFFF.000E: unknown main item tag 0xd [ 63.348648][ T45] plantronics 0003:047F:FFFF.000E: No inputs registered, leaving [ 63.351528][ T2040] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 63.356716][ T2041] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 63.364044][ T45] plantronics 0003:047F:FFFF.000E: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 63.463084][ T2050] netlink: 88 bytes leftover after parsing attributes in process `syz.1.612'. [ 63.652015][ T64] usb 1-1: USB disconnect, device number 13 [ 63.730608][ T1166] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 63.860605][ T1166] usb 2-1: device descriptor read/64, error -71 [ 64.100631][ T1166] usb 2-1: device descriptor read/64, error -71 [ 64.112165][ T2060] overlayfs: failed to clone upperpath [ 64.238547][ T2071] overlayfs: failed to clone upperpath [ 64.327403][ T2075] netlink: 88 bytes leftover after parsing attributes in process `syz.0.622'. [ 64.350652][ T1166] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 64.480615][ T1166] usb 2-1: device descriptor read/64, error -71 [ 64.620622][ T64] usb 1-1: new low-speed USB device number 14 using dummy_hcd [ 64.720610][ T1166] usb 2-1: device descriptor read/64, error -71 [ 64.771610][ T64] usb 1-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 64.782652][ T64] usb 1-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 32, setting to 8 [ 64.793296][ T64] usb 1-1: config 0 interface 0 has no altsetting 0 [ 64.799901][ T64] usb 1-1: New USB device found, idVendor=046d, idProduct=c286, bcdDevice= 0.00 [ 64.808989][ T64] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 64.817506][ T64] usb 1-1: config 0 descriptor?? [ 64.823022][ T2081] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 64.831429][ T1166] usb usb2-port1: attempt power cycle [ 65.170605][ T1166] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 65.191547][ T1166] usb 2-1: device descriptor read/8, error -71 [ 65.234035][ T64] logitech 0003:046D:C286.000F: unknown main item tag 0x6 [ 65.241770][ T64] logitech 0003:046D:C286.000F: hidraw0: USB HID v0.00 Device [HID 046d:c286] on usb-dummy_hcd.0-1/input0 [ 65.253250][ T64] logitech 0003:046D:C286.000F: no inputs found [ 65.260303][ T2091] ================================================================== [ 65.268381][ T2091] BUG: KASAN: slab-use-after-free in read_report_descriptor+0xbf/0x100 [ 65.276645][ T2091] Read of size 8 at addr ffff8881046e3020 by task fido_id/2091 [ 65.284174][ T2091] [ 65.286492][ T2091] CPU: 1 UID: 0 PID: 2091 Comm: fido_id Not tainted 6.12.30-syzkaller-g648383294760 #0 93f95243d2c671158253b6b51cea62df3148036e [ 65.286532][ T2091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 65.286542][ T2091] Call Trace: [ 65.286547][ T2091] [ 65.286553][ T2091] __dump_stack+0x21/0x30 [ 65.286573][ T2091] dump_stack_lvl+0x10c/0x190 [ 65.286590][ T2091] ? __cfi_dump_stack_lvl+0x10/0x10 [ 65.286609][ T2091] print_address_description+0x71/0x220 [ 65.286624][ T2091] print_report+0x4a/0x70 [ 65.286637][ T2091] kasan_report+0x163/0x1a0 [ 65.286660][ T2091] ? read_report_descriptor+0xbf/0x100 [ 65.286682][ T2091] ? read_report_descriptor+0xbf/0x100 [ 65.286708][ T2091] kasan_check_range+0x299/0x2a0 [ 65.286730][ T2091] ? read_report_descriptor+0xbf/0x100 [ 65.286752][ T2091] __asan_memcpy+0x31/0x80 [ 65.286770][ T2091] read_report_descriptor+0xbf/0x100 [ 65.286792][ T2091] ? __cfi_read_report_descriptor+0x10/0x10 [ 65.286814][ T2091] sysfs_kf_bin_read+0x1c6/0x200 [ 65.286833][ T2091] ? __cfi_sysfs_kf_bin_read+0x10/0x10 [ 65.286851][ T2091] kernfs_fop_read_iter+0x2c7/0x520 [ 65.286867][ T2091] vfs_read+0x53d/0xb60 [ 65.286887][ T2091] ? __cfi_vfs_read+0x10/0x10 [ 65.286904][ T2091] ? __kasan_slab_free+0x6a/0x80 [ 65.286926][ T2091] ? putname+0x113/0x150 [ 65.286946][ T2091] ? __kasan_check_read+0x15/0x20 [ 65.286964][ T2091] ksys_read+0x141/0x250 [ 65.286982][ T2091] ? __cfi_ksys_read+0x10/0x10 [ 65.287001][ T2091] ? __kasan_check_read+0x15/0x20 [ 65.287018][ T2091] __x64_sys_read+0x7f/0x90 [ 65.287037][ T2091] x64_sys_call+0x2638/0x2ee0 [ 65.287057][ T2091] do_syscall_64+0x58/0xf0 [ 65.287070][ T2091] ? clear_bhb_loop+0x50/0xa0 [ 65.287088][ T2091] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 65.287104][ T2091] RIP: 0033:0x7fe0948a7407 [ 65.287116][ T2091] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 65.287129][ T2091] RSP: 002b:00007ffc685375f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 65.287145][ T2091] RAX: ffffffffffffffda RBX: 00007fe094f7b880 RCX: 00007fe0948a7407 [ 65.287156][ T2091] RDX: 0000000000001000 RSI: 00007ffc68537640 RDI: 0000000000000004 [ 65.287167][ T2091] RBP: 0000562d75edb2c0 R08: 0000000000000000 R09: 0000000000000000 [ 65.287177][ T2091] R10: 0000000000000000 R11: 0000000000000202 R12: 0000562d75eda4c0 [ 65.287187][ T2091] R13: 00007ffc68537640 R14: 0000000000000004 R15: 0000562d65ec44d8 [ 65.287200][ T2091] [ 65.287205][ T2091] [ 65.436271][ T64] usb 1-1: USB disconnect, device number 14 [ 65.438562][ T2091] Allocated by task 64: [ 65.461797][ T1166] usb 2-1: device descriptor read/8, error -71 [ 65.462565][ T2091] kasan_save_track+0x3e/0x80 [ 65.556434][ T2091] kasan_save_alloc_info+0x40/0x50 [ 65.561562][ T2091] __kasan_kmalloc+0x96/0xb0 [ 65.566146][ T2091] __kmalloc_node_track_caller_noprof+0x1ad/0x440 [ 65.572550][ T2091] kmemdup_noprof+0x31/0x80 [ 65.577043][ T2091] hid_open_report+0x1f2/0x1110 [ 65.581885][ T2091] lg_probe+0x28d/0x920 [ 65.586033][ T2091] hid_device_probe+0x2c4/0x5d0 [ 65.590884][ T2091] really_probe+0x2d3/0x890 [ 65.595384][ T2091] __driver_probe_device+0x198/0x280 [ 65.600666][ T2091] driver_probe_device+0x54/0x3f0 [ 65.605705][ T2091] __device_attach_driver+0x2f1/0x4b0 [ 65.611090][ T2091] bus_for_each_drv+0x260/0x2f0 [ 65.615932][ T2091] __device_attach+0x2bd/0x3a0 [ 65.620693][ T2091] device_initial_probe+0x1e/0x30 [ 65.625723][ T2091] bus_probe_device+0x18b/0x270 [ 65.630572][ T2091] device_add+0x80c/0xc00 [ 65.634907][ T2091] hid_add_device+0x39b/0x560 [ 65.639591][ T2091] usbhid_probe+0xde3/0x12b0 [ 65.644172][ T2091] usb_probe_interface+0x696/0xc00 [ 65.649284][ T2091] really_probe+0x2d3/0x890 [ 65.653798][ T2091] __driver_probe_device+0x198/0x280 [ 65.659075][ T2091] driver_probe_device+0x54/0x3f0 [ 65.664094][ T2091] __device_attach_driver+0x2f1/0x4b0 [ 65.669467][ T2091] bus_for_each_drv+0x260/0x2f0 [ 65.674323][ T2091] __device_attach+0x2bd/0x3a0 [ 65.679346][ T2091] device_initial_probe+0x1e/0x30 [ 65.684363][ T2091] bus_probe_device+0x18b/0x270 [ 65.689207][ T2091] device_add+0x80c/0xc00 [ 65.693527][ T2091] usb_set_configuration+0x1ad4/0x20b0 [ 65.699015][ T2091] usb_generic_driver_probe+0x95/0x160 [ 65.704465][ T2091] usb_probe_device+0x1d4/0x380 [ 65.709321][ T2091] really_probe+0x2d3/0x890 [ 65.713819][ T2091] __driver_probe_device+0x198/0x280 [ 65.719098][ T2091] driver_probe_device+0x54/0x3f0 [ 65.724116][ T2091] __device_attach_driver+0x2f1/0x4b0 [ 65.729487][ T2091] bus_for_each_drv+0x260/0x2f0 [ 65.734328][ T2091] __device_attach+0x2bd/0x3a0 [ 65.739091][ T2091] device_initial_probe+0x1e/0x30 [ 65.744109][ T2091] bus_probe_device+0x18b/0x270 [ 65.748965][ T2091] device_add+0x80c/0xc00 [ 65.753290][ T2091] usb_new_device+0x9ed/0x1590 [ 65.758044][ T2091] hub_event+0x265b/0x41a0 [ 65.762449][ T2091] process_scheduled_works+0x7d2/0x1020 [ 65.767987][ T2091] worker_thread+0xc58/0x1250 [ 65.772650][ T2091] kthread+0x2ca/0x370 [ 65.776708][ T2091] ret_from_fork+0x64/0xa0 [ 65.781109][ T2091] ret_from_fork_asm+0x1a/0x30 [ 65.785858][ T2091] [ 65.788164][ T2091] Freed by task 64: [ 65.791961][ T2091] kasan_save_track+0x3e/0x80 [ 65.796627][ T2091] kasan_save_free_info+0x4a/0x60 [ 65.801636][ T2091] __kasan_slab_free+0x5f/0x80 [ 65.806387][ T2091] kfree+0x156/0x400 [ 65.810272][ T2091] hid_close_report+0x628/0x6f0 [ 65.815131][ T2091] hid_device_probe+0x523/0x5d0 [ 65.819985][ T2091] really_probe+0x2d3/0x890 [ 65.824478][ T2091] __driver_probe_device+0x198/0x280 [ 65.829758][ T2091] driver_probe_device+0x54/0x3f0 [ 65.834776][ T2091] __device_attach_driver+0x2f1/0x4b0 [ 65.840146][ T2091] bus_for_each_drv+0x260/0x2f0 [ 65.844985][ T2091] __device_attach+0x2bd/0x3a0 [ 65.849745][ T2091] device_initial_probe+0x1e/0x30 [ 65.850654][ T1166] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 65.854766][ T2091] bus_probe_device+0x18b/0x270 [ 65.867133][ T2091] device_add+0x80c/0xc00 [ 65.871484][ T2091] hid_add_device+0x39b/0x560 [ 65.876172][ T2091] usbhid_probe+0xde3/0x12b0 [ 65.880752][ T2091] usb_probe_interface+0x696/0xc00 [ 65.881685][ T1166] usb 2-1: device descriptor read/8, error -71 [ 65.885960][ T2091] really_probe+0x2d3/0x890 [ 65.896588][ T2091] __driver_probe_device+0x198/0x280 [ 65.901864][ T2091] driver_probe_device+0x54/0x3f0 [ 65.906881][ T2091] __device_attach_driver+0x2f1/0x4b0 [ 65.912241][ T2091] bus_for_each_drv+0x260/0x2f0 [ 65.917076][ T2091] __device_attach+0x2bd/0x3a0 [ 65.921826][ T2091] device_initial_probe+0x1e/0x30 [ 65.926841][ T2091] bus_probe_device+0x18b/0x270 [ 65.931676][ T2091] device_add+0x80c/0xc00 [ 65.935995][ T2091] usb_set_configuration+0x1ad4/0x20b0 [ 65.941442][ T2091] usb_generic_driver_probe+0x95/0x160 [ 65.946894][ T2091] usb_probe_device+0x1d4/0x380 [ 65.951760][ T2091] really_probe+0x2d3/0x890 [ 65.956284][ T2091] __driver_probe_device+0x198/0x280 [ 65.961595][ T2091] driver_probe_device+0x54/0x3f0 [ 65.963994][ T2093] netlink: 88 bytes leftover after parsing attributes in process `syz.0.628'. [ 65.966633][ T2091] __device_attach_driver+0x2f1/0x4b0 [ 65.975609][ T2093] netlink: 8 bytes leftover after parsing attributes in process `syz.0.628'. [ 65.980836][ T2091] bus_for_each_drv+0x260/0x2f0 [ 65.980859][ T2091] __device_attach+0x2bd/0x3a0 [ 65.999195][ T2091] device_initial_probe+0x1e/0x30 [ 66.004237][ T2091] bus_probe_device+0x18b/0x270 [ 66.009107][ T2091] device_add+0x80c/0xc00 [ 66.013456][ T2091] usb_new_device+0x9ed/0x1590 [ 66.018238][ T2091] hub_event+0x265b/0x41a0 [ 66.022304][ T1166] usb 2-1: device descriptor read/8, error -71 [ 66.022702][ T2091] process_scheduled_works+0x7d2/0x1020 [ 66.030159][ T2096] process 'syz.0.630' launched '/dev/fd/4' with NULL argv: empty string added [ 66.034382][ T2091] worker_thread+0xc58/0x1250 [ 66.034420][ T2091] kthread+0x2ca/0x370 [ 66.034452][ T2091] ret_from_fork+0x64/0xa0 [ 66.034476][ T2091] ret_from_fork_asm+0x1a/0x30 [ 66.034504][ T2091] [ 66.034511][ T2091] The buggy address belongs to the object at ffff8881046e3020 [ 66.034511][ T2091] which belongs to the cache kmalloc-8 of size 8 [ 66.034531][ T2091] The buggy address is located 0 bytes inside of [ 66.034531][ T2091] freed 8-byte region [ffff8881046e3020, ffff8881046e3028) [ 66.044926][ T36] kauditd_printk_skb: 18 callbacks suppressed [ 66.044944][ T36] audit: type=1400 audit(1751374805.190:375): avc: denied { execute_no_trans } for pid=2094 comm="syz.0.630" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAADD16D64C8854858A9250C1A65E0202864656C6574656429 dev="tmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 66.048040][ T2091] [ 66.048046][ T2091] The buggy address belongs to the physical page: [ 66.130745][ T1166] usb usb2-port1: unable to enumerate USB device [ 66.134601][ T2091] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8881046e3600 pfn:0x1046e3 [ 66.151132][ T2091] flags: 0x4000000000000200(workingset|zone=1) [ 66.157279][ T2091] page_type: f5(slab) [ 66.161261][ T2091] raw: 4000000000000200 ffff888100041500 ffff888100040210 ffffea00047eabd0 [ 66.169837][ T2091] raw: ffff8881046e3600 000000000080007c 00000001f5000000 0000000000000000 [ 66.178421][ T2091] page dumped because: kasan: bad access detected [ 66.184826][ T2091] page_owner tracks the page as allocated [ 66.190537][ T2091] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 2794728175, free_ts 0 [ 66.208061][ T2091] post_alloc_hook+0x3b9/0x3f0 [ 66.212820][ T2091] prep_new_page+0x1c/0x120 [ 66.217320][ T2091] get_page_from_freelist+0x46bb/0x4750 [ 66.222859][ T2091] __alloc_pages_noprof+0x30d/0x6c0 [ 66.228062][ T2091] alloc_slab_page+0x6b/0x1f0 [ 66.232731][ T2091] allocate_slab+0x69/0x440 [ 66.237227][ T2091] ___slab_alloc+0x59a/0x8b0 [ 66.241841][ T2091] __kmalloc_node_track_caller_noprof+0x23a/0x440 [ 66.248245][ T2091] kmemdup_noprof+0x31/0x80 [ 66.252742][ T2091] platform_device_add_data+0x49/0x140 [ 66.258198][ T2091] dummy_hcd_init+0x662/0x1120 [ 66.262956][ T2091] do_one_initcall+0x1a5/0x670 [ 66.267711][ T2091] do_initcall_level+0x16f/0x2e5 [ 66.272645][ T2091] do_initcalls+0x7e/0x170 [ 66.277392][ T2091] do_basic_setup+0x95/0xb0 [ 66.281882][ T2091] kernel_init_freeable+0x2a1/0x3f0 [ 66.287072][ T2091] page_owner free stack trace missing [ 66.292423][ T2091] [ 66.294739][ T2091] Memory state around the buggy address: [ 66.300360][ T2091] ffff8881046e2f00: 00 04 fc fc 00 00 fc fc 00 03 fc fc fa fb fc fc [ 66.308414][ T2091] ffff8881046e2f80: 00 06 fc fc 00 04 fc fc 00 04 fc fc 00 07 fc fc [ 66.316460][ T2091] >ffff8881046e3000: fa fc fc fc fa fc fc fc fa fc fc fc 00 fc fc fc [ 66.324513][ T2091] ^ [ 66.329631][ T2091] ffff8881046e3080: 05 fc fc fc 05 fc fc fc 00 fc fc fc 00 fc fc fc [ 66.337676][ T2091] ffff8881046e3100: 00 fc fc fc fa fc fc fc fa fc fc fc 00 fc fc fc [ 66.345718][ T2091] ================================================================== [ 66.356047][ T2091] Disabling lock debugging due to kernel taint [ 66.357531][ T36] audit: type=1400 audit(1751374805.490:376): avc: denied { read } for pid=91 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 66.384320][ T36] audit: type=1400 audit(1751374805.490:377): avc: denied { search } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 66.405773][ T36] audit: type=1400 audit(1751374805.490:378): avc: denied { write } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 66.427054][ T36] audit: type=1400 audit(1751374805.490:379): avc: denied { add_name } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 66.447931][ T36] audit: type=1400 audit(1751374805.490:380): avc: denied { create } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 66.468456][ T36] audit: type=1400 audit(1751374805.490:381): avc: denied { append open } for pid=91 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 66.491391][ T36] audit: type=1400 audit(1751374805.490:382): avc: denied { getattr } for pid=91 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1