last executing test programs: 5.157620079s ago: executing program 0 (id=437): ioprio_set$pid(0x2, 0x0, 0x0) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x8800, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0x8, 0x80) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000001200)=@urb_type_interrupt={0x1, {0x9, 0x1}, 0x1, 0x24, &(0x7f0000000100)="d55ec6b543191cc769437ebb4a73718a6610471125e92ac4a97dc2516f574d83cae77f243ded9f8cf984d24d499658b7bda9f013f1d3c402ec3aaa1f8874d2c85ccc28579b0342f51a25218e02c414d018e2f813a71408be9b08552b374b38c53d772c4979565f0e4dddde8bea3e7c4ea71b1980e6d656808e4eb7402187560fe7dcf0cd3299da068bcd951c2d03e501e8830fd8e9849be7295e15374867768437a0070ecc79e4569312e06c546e5cd1b73728c86de7912c7ba4e798748e1ca41091d401fb1a711f74fe5adcf69223ac3d24a6cf1c056cc48cd889bfd480b97e79f60bade9cd2b0b678f655830fbc9cb658fd6322da158957097e16451aa50488c377cb841b078c452c104937d0c3a51829137f456794f70c16a7d84246be4ef8b0d3157b9f69c2580abaa3baad46aefecc0c417c2d04233c9d2ac1e53a61992a963dcf67b33a56af298eba3a7e688ba8c4b90d395a873ed2014cbec8898be155ff3db33de7f8983f1b0ebe86a9f3015d2e6156709a278b7ae9ece021d59ee6d50a8ffedbea4a1bedad8f044a67c321f7812f6547975d30c0e1b0060105f82fdc17a5af6c830f893176211f1a759131697d6b8492f0247ce406e58e2863f93164ab3a5c880da29aa03d1f576bed8c16992e341c3f9631036d71ff41063ee3ab0aa0ee7d4c99eca63333dc0949a4cb9172a80d8bf4d2099a103db7e30484a0b5c062836615ae4cf85bc2c2733e0fd25cd194fb5160c4898e0a4510b11c5a0c65d955721d173fedbf51dddc4193e21e80438def13dbd93f4150f14668aa5e4b1f2e73b813725a64e3c72ddc3ee0873bf4f9ae013e073cc2ba3903884d4cfeab25e195300d4edb16fdc319fcf155ffa232426a704001c08443300b3025b40b823fbfd520a5355a92e713b80ec17987611ab1741bcf0c182a78ef984f879b878448eeca0699157bc6bed3230a90225242f9be0ba8d020ad1ef939c6d8d493ddf1f518ec31f329f8f1094ac1ef94320038d3b3264348c9ed75ab8f8bb1116fe14e8a84682b1735dd3699c046c3c221448ef2334bae6d1586486f3c1487509fb10d0f1b8328ea53931772db4e348d39ea41bc3942ef0a448eb114a29a3c59cc2fda1355eee51b0307d670ddeff2d02a4e94c03823b263ed7dfc267cea79c9899f7a061fa448bdb0ae89f5ba4756d96866eb01781bd6daed87e3cbed35442159859bc4b8616995491eb917e6494cb02e00a3b34ef5147574d3c223147af23f48143eaae3257febdf7b92ec5deabefac2faaa70fbbc26acd2397dcf844e89e3fbeb109bb0ef338372466ec9926e4289f604133d1d97d74ff3acaaa8b01fe1c329be33a8f8ebbed6b819454e0448856f8e96df5f138a42b29d41846be327b20179d0f70dee33152f23140953590e9ffb893303360ba3cd62be830e078b705cd4d819646b19d8eb0af0250f89e56d33a1c620f2767c8717bbea78000b79b0dc5ce1231bb66763af7717e7295141c1f1a847483663319a0b24a1341b43e2dd21090f0df9af7126a0fefdca142f6a58e3c36e4520fcae1d203d9fca48aa23722a5b5e091cbb640b81fc893a703f8ebfa872212bd27d69b3b2ca59d29cc35cf70a691a2a767d18c1023ba5529323f0e0cc861156948238c2494bb51ebce3eda44369491e19c8e4a3cf9907371d34fd507d6a7b37d00a39b22d4ab04500a7cd1abb8f789129f4c24d95161b1aaa7db2ad1147b2cbf08603692bc0a74c6c7549346e396b00c69f34443f781d2028a813f1e93b88eafbb87209f221375d8ce8eb98962b830d7be200024ce2ee7531e13a96108f271b132266b2b91bb80f1e4940be31d77fc8160b62be8a31b4db714acd59550e6d19f6dedcaaac69548d92a8dcf2d3518985d2badb5cb130f1d7dddb9ab69f524d9e002ceb1f83c67546295043e1a983847b544c7fc70783c0b73d23e8680f5435afc545fe5305c68b3a4f22d9bb0964a20b3f386c4ecec5c230437aa35fc724b7aefaaea0cb24efa9a189000e6aba46159b5cb426718009fa3f14773b347dbbc0341f81d4cb8ebd20eaf30a7a4181d6f0170c987ba3476659795ce6f119cae9901c5478e9d6c319e9ed3dbee8a4ec695bf176e3ab73450b3c3a38ba60083f31341581c24b5ae101a19aefbce6add5e5169976ac97b58d7477a6172f572e129c3f963a8989d752309f991df1f11c593a4d6ac40c0e15897124fd4d1291d62dc06e5f273995a5711773393754727f6adeef6427d501f1d9df8d6de0ebb77cfe5c948ccbde5e98cf6fc40fef694be79b776bb1f92a05d62a83eb84c01ebd77937fa476f1d0c38782f1fbd0b2a6d4b4c4e07751562cb99dca2dbda49b90e4cb6340bcd86e60d267737009dd843647d458d632b15e7bd541ca22b9cdd0e358f23e289b46880ad156bf1fc432d947e9558fcbb4ecff738d66c807e7a11a81ba12c3a2f2c284664c3e6da138f63cb9ddfb82e51406997d39fc02786c7d113eafb52b0dbff073afa5f4bf0a29e92e166ea361884f4dde66761af3e838cedfed0d6408512cf6a3b06eb5004db9785de43a12bd9b3d699afcd72eed7d4b3a06d0af12641c063de0c77539e630cd91729656f00f98c134ee5b7dc51d8e37abe15b465bbae3b9db1ca9df0423012d0a46cc744d98816a007ecbe09b8badd505e119ff5c66b2927ed46fdcbee1d28309de10ccff5f0337ca82549f4dc937dd6d1b800039c3320a7e3032d766072ebb405d7893c82cecd68f8339bd83a87557d7b91eece726967442de399b69184f68e31e14d50275b293ef8307d1e8da8fc6f156c1aff8b9c57b8a32edd6932d434226c3e44cc38765be220ae0b50af43fe18c60e009a5104a941eb54a386eebbc19f58d1fa969fb40a91ca4aa2135fea9393e50595adc6f21cc5ecfb331f4c814c33bc94a2e9f3b0868298f1f53a62b69c7065f4f0e04fc4db781e284d39a38d75a88e8ff759b7bb01d7d118c3aca35126af65bd29e962143ae52f729b65ec6cf291758c7f92c40d18d3077b46f6c789ab744399dfa96e9d827949a08a332dc1b36f307e2365896a41d568ad275663016dfd02c6fe6fabfbd525ef4180a00554c7104c18e0f6b18a29632534234a135848c9c2c04e58224b179a26de1d28ce36c753730f506785e92587d6ce40fb5ecf3d438f1db9c68722a2995c0569f54dac65089a83b7664d93126c1b6ec8b90c0eaf7ddb7b8bfa014443e2c92dd58288afe1d65b2b8b4627b52fbe28a8a9c02919589ead8e611d7829687212775f0d045b2ec127649beeaa8241ebbd25d29f9fcafb5ddbd836ce2422dcafc9fcb4dc157645ff3c03d3a90ea105450ff1c70e602a5547bb798a4a0993ba0912cc770f9c45f0b891cba85f01e70818cb96d34aa370f9df904662c018d7dc830e0d6796fba2203052873b0a8221731c291712790a027454dc3a7049a64ace20e1df01c5b96fda84266836ff68380f240ba71dd279e8ce8525017e9ba5ed27da2dc224657b2529ed358a0528e138ec1f86e4e8d6e2ac872664130516d3ae1112cdd39a2e198600da249cecaeb7ba9e4bbea5f94589ca8337c09b8753996e3bf57048e4282cf7c2b45565b70dc8cfac3c1565060f0add2c5c684af9feb08ff95da1c15e3a4420a78a7ffbde8878a26861a28f95ecb501cb442d4263278a013ae41a9a8f0574d3ed689c20a56f457f05fd5ed54d6420138f0c0e3d9d25adb8e2f099b378b5ca21c9ae18b50f2aff13248553b4dfd6fa30d9d6be27786e521dacf414ffb520cbf0a4b574332f56709f5a75750448c94c9713862543678bcf5e9991447750b60680aa03e3d4932704a8229f38a58ba517e01f3f4150519913a21d3f96a60c0a3e6b7a4412a59443a8bdc02e5573b9ecef26996c87153373c664b235bf11181698961cb7a587788f81158479c0f52afd2f868402a1220b98aa8de08e8c3f46ff9951dbcf50a09138dec3d160299493f88174c18575a3bdd959e069d31b338dd546d230a06cb8b27fe8d516cf2be2bdbd0a816336a739c266aa1a3bc4660b85e3981b0966c7e5a8b1ba9c6e5553e2549b132351c9e3271aa7b38861cf2b3358d51302e9ea389a83c5dadc760b994273a2cf22c0773c79d28753678637fcb2c1e33229f1003b591523f094096a1ae69f55ebc74e7f8eaa0253794d4e247229e15d4092974f89f8ec762cd5a3a9830c85b1e15cc7667d6e1f9dbabfb1346bb0b527ea0799b00be9b053801bbae9d56af1b07a374b0b8b7465ac1b8541cf3cbc09b58f0f57ecf3c220b6943980dc4dd28a22180deaf9f215d01fd94f356559c2bbe46c0a0bab6ad82273d1b9b1eb35aa11bfe868d601d1cf3c3625059dff224ef90e1daa61f60f7bcc9f124500f0b7030a7082cdf895b372ce862ef9e8e4a3c511d6430a5c88d294e77a204966fa6a5f510ead1c52c9014e394220f592df9e380b8193d5d7a72e9b35e37660c57734314262b3405f513532983354d43a18cdf87db8c276ac3f731b024a2abbc829c6929e77e4fd6d1f429e809f242a782305a9eb1329d830ea9f341a47d27f4aacf9c08e0171cf9fa58d261e9a2e0fc63c5dfcc150d3ab0ae01b8c981eb1df4504e84b87b057c4de57d7835703712d10cfe98b8abca11eedbf3ebbcbd54b75fab6d48586564da2967c2f5b4df0142ecbc4539d8991a3c310cece853dd5c7fbee6e0be467d2c48b494dfbbc713516eef8489242b5502b63ade8a66512e4f4e634f272dc3ae935b617e80c42ef9203c57bbf01cf19a2069e859e1c2c01509bb272a9d9cdc2405dc80dfeaade2c920701d7f239b05fea5f88eba26a92871706f155bb7332308cf6545b4d4aec758ec3e033e0aac2068834e3e1cb0ae8b180096ba366fa8ab5873926ad53793681ad65657f2f354b753792ee643405eb503b3c9380cc065a45fe367ba21412badbcdd0344e75df5296a1045bbad74010ecf977a51b5f7fd19e91729322465aee14eb86381641b7aa2ebad949c519b0eca748977a982ab588e17684ef9e7c6a400f44239a996de0b5e3c6e8e5f21f751cd27ac5b7d84fd0d94f6aed6b298e3ced23f79578305a1fc10c52da5d3c5436ab0ff251d1d8ceb383f32f88776e385d0c122d6a36b571ae7c91c9f88ca30aab2cf984cc83a1c8928cf232aff19877b3ed4bdb9fd118cc6b94b12f4b687378d6cd52fd4bb9ed0d9d4a7047533689bd71a6c9ad1ca3f078096c414e37584b6ac8178c87d3c3d0ebe3b53288562d78953dd86edf7af14f472b0b60f99296ae80e861b0a2f6cb60ea8e865a2253e5b765833e2e7031ce721f0511dbd8d40e22d1af479d512e95ab83a622b449e263adf009d84440ceb1bde857fc8961081fd396625c393ea74f61ddd4562113b7466907b8318ccc72109e9dd4a09b0a4eb5d93eb08487e2c36d47932d6eb75496878a7f4694b6018a8bf4354c92292215f74b451bd40cd4d7db7d18a5a6716416b8b514d88eae802062a0c15a3e40944e7537acf429e15ea365ec89f635d2de6b8f09d366f81d0db29847f4661b1d96f5c0bf66fdf0c312d68e4023b0d26776bb94b56f34480368ec44017f4f529b9caa001f3022848bbe9351966355435676054e4157adb7aa8f4c4e83d2bbfd573926dccb95c13f290a91ec9a2915ee4cbdc19f94595e14f3b7a3cebe999bee71b9ab3f8821f80b563462878ae551369ed12c2f5b6dbd24d6613161755645acabe92cc32eb7d8bb594dac7117b7720d84c287b5734ccce30a9ea4277e9729498db4011c7b6ef3086dc95ff3dca4f81a9f", 0x1000, 0x4, 0x1, 0x0, 0x7fff, 0x7, &(0x7f0000001100)="90338d2da6a5eb7407eb239cb6383ea5342fc0920cee1c35c2d4604baedbd1650080d646fbb88d554a3bb4c483edf2a1ed036d05f83cd2cd3fd9fcbbc35eaf7eef3872e2c48be718cdb5850a011f4efb5420e8588b06e95fe5bd2441d3f7e9ec1b443b5439c513b4024282231319397d3c34b2f5f448c245dfe60d4e03a859ec84a63b7612ee17155ead30062abe537f820c1ac8dca9b806bec71e972635176a26b1123f7090dc5ce40c35c4f035fcf9c8c1b873d852ff93529284d529789a23844aacaa25024d590b7735"}) read(r0, &(0x7f0000000080)=""/93, 0xffffff6c) 4.999280552s ago: executing program 0 (id=444): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793f10d10501200002000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000100)={0x40, 0x1, 0x7, "48c308730a1eab"}, &(0x7f00000001c0)={0x0, 0xa, 0x1, 0xc0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2e, &(0x7f0000000340)={0x8, {{0x2, 0x8000, @multicast2}}, {{0x2, 0x0, @multicast2}}}, 0x108) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) getsockopt$inet_buf(r1, 0x0, 0x30, &(0x7f0000000340)=""/225, &(0x7f0000000180)=0xe1) 4.075734117s ago: executing program 3 (id=454): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22102, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) syz_clone(0x80001000, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) (async) munmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000) ioctl$TUNGETDEVNETNS(r3, 0xff03, 0x0) r4 = eventfd(0x2) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000080)={r4, 0x1}) close_range(r0, 0xffffffffffffffff, 0x0) 3.957871298s ago: executing program 3 (id=455): setxattr$incfs_metadata(&(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0), 0x0, 0x0, 0x2) (async) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='mountinfo\x00') read$FUSE(r0, &(0x7f0000000440)={0x2020}, 0x2020) 3.956393848s ago: executing program 3 (id=456): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x10, 0x0, &(0x7f0000000300)=[@increfs, @decrefs={0x40046307, 0x1}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x10, 0x0, &(0x7f0000000300)=[@increfs, @decrefs={0x40046307, 0x1}], 0x0, 0x0, 0x0}) (async) 3.910924659s ago: executing program 3 (id=457): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x20102, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r2, 0x400455cb, 0x0) pipe(&(0x7f0000000400)) socket$inet6_udp(0xa, 0x2, 0x0) syncfs(r0) socket$nl_route(0x10, 0x3, 0x0) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000080)=0x50000) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0xc, &(0x7f00000002c0), 0x4) r4 = socket$packet(0x11, 0x2, 0x300) pipe2$9p(&(0x7f0000000180), 0x0) r5 = creat(&(0x7f0000000080)='./file0\x00', 0x2a) syz_usb_connect$uac1(0x4, 0xa4, &(0x7f0000000300)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3", @ANYRES8=r5, @ANYRES64=r4], 0x0) r6 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFLAGS(r6, 0x800452d2, 0x0) r7 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) r10 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r10, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r10, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18, 0xffffffffffffffda, r11, {0x3}}, 0x18) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f0000000200)=ANY=[@ANYBLOB="0300000000000000900000400000000009000000000000009f0300007709000000000000080000000000000053babbf08300000000b192acd0247bd2df8761f7ab71484bc752ec3a62a296cbf04aa2b14269ccc55c37f6b367ec60768fac6e600ceeb853928a91872109727feca09cbbcb39db10bdd44aa27b604e98247c4c056c3cc02b63e56b70eb368e7f5e67f7d8d918dbbe4ebceea0ff88eb33ef68e8549cc921aa4641f07d2c88deaf1ebd88f424b90073c2ab82387f8f9b52d11f08ea35b0a16c8ce682142d3d2fed33e83b93e0c3c98c7dad79ff24d1b2d3f3ce2f4fdf4f54778b9b5809"]) close_range(r8, 0xffffffffffffffff, 0x0) 3.318279068s ago: executing program 2 (id=466): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@newtaction={0x18, 0x30, 0x80d, 0x70bd29, 0x25dfdbfb, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x8080}, 0x9080) openat$ashmem(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000080)=0x30000) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x1}, 0x10) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000000)={0x40, 0x2, 0x3}, 0x10) close_range(r1, r1, 0x2) 3.261334469s ago: executing program 2 (id=467): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x1bfddced705bf19a, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x4b0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000000)=')}%!:\xb9+\x00') r1 = fcntl$dupfd(r0, 0x0, r0) read(r1, &(0x7f0000000400)=""/169, 0xa9) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x9, 0x40}, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') r3 = syz_open_procfs(0x0, &(0x7f0000000e00)='maps\x00') ioctl$UDMABUF_CREATE_LIST(r3, 0x40087543, 0x0) socket$nl_route(0x10, 0x3, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000100)=[@register_looper], 0x50, 0x0, &(0x7f0000000340)="a89aff67520a7335b849b4f88a6db06e45e3f5e648a65b8003975be8a982d5135e161a783d3d01fddcbd838bac308358a7e349f333e620505e4cf1982c991b516a9e26b6bb537c85f5ad467697f0d78b"}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) socket$inet6(0xa, 0x80002, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x2000007, 0x12, r4, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x1bfddced705bf19a, 0x0) (async) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x4b0) (async) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000000)=')}%!:\xb9+\x00') (async) fcntl$dupfd(r0, 0x0, r0) (async) read(r1, &(0x7f0000000400)=""/169, 0xa9) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) (async) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x9, 0x40}, 0x0) (async) syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') (async) syz_open_procfs(0x0, &(0x7f0000000e00)='maps\x00') (async) ioctl$UDMABUF_CREATE_LIST(r3, 0x40087543, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000100)=[@register_looper], 0x50, 0x0, &(0x7f0000000340)="a89aff67520a7335b849b4f88a6db06e45e3f5e648a65b8003975be8a982d5135e161a783d3d01fddcbd838bac308358a7e349f333e620505e4cf1982c991b516a9e26b6bb537c85f5ad467697f0d78b"}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) (async) socket$inet6(0xa, 0x80002, 0x0) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) (async) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x2000007, 0x12, r4, 0x0) (async) 3.252603459s ago: executing program 3 (id=468): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = getuid() setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000000)={{{@in=@multicast1, @in6=@mcast1, 0x4e23, 0x8, 0x4e20, 0xc9, 0x2, 0xa0, 0x77431841f95b75a0, 0x73, 0x0, r1}, {0x8000000000000001, 0x8, 0x0, 0x9, 0x1000, 0x3, 0x4, 0x2}, {0x8, 0x7, 0x7f, 0x10001}, 0x6, 0x6e6bb8, 0x1, 0x1, 0x3, 0x2}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4d4, 0x3c}, 0xa, @in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x38}}, 0x3502, 0x0, 0x1, 0x7, 0xfffffff7, 0x2, 0x2}}, 0xe8) r2 = dup2(r0, r0) r3 = syz_clone(0x200a0080, &(0x7f0000000100)="7e1ad75925e8246346ce7edf4733816728ed84850dc7ce0ab0daef5497b37a1af127ac0a74459854a14cd6ba476169e7754a4ea730dcc84043b44b2f", 0x3c, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)="78db88622fce72b3ba985bb57c2760eeb314aa7185d5e2441669cf5d057411edc2771c84407f54fe7895b61fbf5d1149d2dc1040bae9e294349df8eb9956b79be02a4ebc1cfdf11a3b82c51ab2241f90a162eb3183bcbe47c2eb44911d7d9b6c45297e7e75a4d2e8516cbbb70ddf5bda1f5c00214faf00e16231a3602f2003e08486144e9820923be665087e3acec510765d4482484480cec412469797b2a071b8b959c8f37a") getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000002c0)=0xc) kcmp(r3, r4, 0x0, r0, r0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x20010, r0, 0x5855) tkill(r4, 0x3b) setresuid(r5, r5, r1) accept4$unix(r2, &(0x7f0000000300), &(0x7f0000000380)=0x6e, 0x80000) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f00000003c0)='./file0\x00', r1, r6) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000500), r2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000540)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x54, r7, 0x0, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x57b}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004000}, 0x20008000) r9 = dup2(r2, r0) clock_gettime(0x0, &(0x7f0000000680)={0x0, 0x0}) clock_nanosleep(0x6, 0x1, &(0x7f00000006c0)={r10, r11+10000000}, &(0x7f0000000700)) mount$binder(0x0, &(0x7f0000000740)='./file0/file0\x00', &(0x7f0000000780), 0x10, &(0x7f00000007c0)={[{@max={'max', 0x3d, 0x2}}, {@max={'max', 0x3d, 0x2}}, {@max={'max', 0x3d, 0x4}}, {@max={'max', 0x3d, 0x2}}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@max={'max', 0x3d, 0x3}}, {@stats}, {@stats}, {@stats}], [{@audit}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@seclabel}, {@fsname={'fsname', 0x3d, '@\\%!@\x9e\'%$+'}}, {@measure}, {@smackfstransmute={'smackfstransmute', 0x3d, '\x00'}}, {@flag='dirsync'}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}, {@appraise}]}) ioctl$sock_inet6_SIOCDELRT(r9, 0x890c, &(0x7f0000000900)={@loopback, @empty, @rand_addr=' \x01\x00', 0x10001, 0x40, 0x7, 0x0, 0x9, 0x400000, r8}) connect$inet(r2, &(0x7f0000000980)={0x2, 0x4e21, @empty}, 0x10) fcntl$getownex(r0, 0x10, &(0x7f00000009c0)) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000a00)={'veth0_to_hsr\x00', {0x2, 0x4e21, @local}}) lgetxattr(&(0x7f0000000a40)='./file0/file0\x00', &(0x7f0000000a80)=@known='com.apple.FinderInfo\x00', &(0x7f0000000ac0)=""/48, 0x30) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f0000000c40)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b40)={0x98, 0x0, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x10}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x9}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x34, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x1f}}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}]}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x9}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x4}]}, 0x98}, 0x1, 0x0, 0x0, 0xc0}, 0x4014) recvfrom$inet(r2, &(0x7f0000000c80)=""/153, 0x99, 0x40000000, &(0x7f0000000d40)={0x2, 0x4e21, @remote}, 0x10) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000d80)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x92, 0x3, 0x1, 0x0, 0xb0, 0x3, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x4cb, 0xf}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x9a, 0x2b, 0x80, {0x7, 0x25, 0x1, 0x3, 0x9, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0x7, 0x1, 0xfe, 0x6, "48c2b5", "53b1b0"}, @format_type_i_discrete={0x10, 0x24, 0x2, 0x1, 0x7, 0x4, 0x81, 0x6, "74838e3bd51b891c"}, @as_header={0x7, 0x24, 0x1, 0x4, 0x0, 0x4}, @as_header={0x7, 0x24, 0x1, 0x2, 0xe, 0x5}, @as_header={0x7, 0x24, 0x1, 0x5, 0x8, 0x2}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x3, 0x7, 0x7, {0x7, 0x25, 0x1, 0x82, 0xff, 0x6}}}}}}}]}}, &(0x7f0000000f40)={0xa, &(0x7f0000000e40)={0xa, 0x6, 0x300, 0x3, 0x79, 0xb, 0x8, 0xf}, 0x1a, &(0x7f0000000e80)={0x5, 0xf, 0x1a, 0x2, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0xb, 0x6, 0x1, 0x9239}, @wireless={0xb, 0x10, 0x1, 0xc, 0x2, 0x3e, 0x80, 0x1, 0x2}]}, 0x1, [{0x72, &(0x7f0000000ec0)=@string={0x72, 0x3, "ad105a959168a3d03f3716cb9ee5a1925dbf95056a64496ae6b56a4753f0d1767ae5747c8a7096df5c4c36c56c98590a009772b96764a36d3ef4e3000025aac56ecc047ed25a411e63bc031304a175d3035ef04ea110c94f2896b4f2b9c021a438ebce7ae18da291ad4b46b4d2281071"}}]}) write$tun(r9, &(0x7f0000000f80)={@val={0x0, 0x7}, @val={0x3, 0x0, 0xfff8, 0x5, 0x1ff, 0x4}, @arp=@ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x4, @broadcast, @remote, @multicast, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}, 0x42) setsockopt$inet6_IPV6_ADDRFORM(r9, 0x29, 0x1, &(0x7f0000001000), 0x4) 3.23026006s ago: executing program 2 (id=469): prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x2000)=nil, 0x2000, &(0x7f0000000000)='/dev/audio#\x00') r0 = memfd_create(&(0x7f0000000340)='y\x105\xfc\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xa4\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01L\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x06\xb3\xf0wVq\xe9d\xac\xe9\xaa\x9dR\x00\x9b\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2G\x1b+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2v\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x1e\x11X\f\x0f\xf0\xe2\xb5\xf8', 0xb) fcntl$addseals(r0, 0x409, 0x4) ftruncate(r0, 0xffff) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0) 3.165411561s ago: executing program 2 (id=470): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000240), 0x5, 0x6042) mmap(&(0x7f0000012000/0x1000)=nil, 0x1000, 0x4000011, 0x11, r1, 0x88053000) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x0) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x20102, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001200192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e0fff0004fcff", 0x58}], 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x4, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000000c0), 0x4) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) syz_usb_connect$cdc_ncm(0x5, 0x7c, &(0x7f00000001c0)=ANY=[@ANYBLOB="12015002020000082505a1a440000102030109026a0002010210030904000001020d0000052406000105240001000d240f01020000001f0000106206241a050000042406ad"], &(0x7f0000000300)={0x0, 0x0, 0x10, 0x0}) write$cgroup_int(r7, &(0x7f0000000000), 0xffffff6a) sendfile(r6, r7, 0x0, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000340)="430f01cf470f01df0f01c2070f813535ba420066ed3e426c66430f38f8a107000000b9f70a0000b8ef8b0000ba000000000f300f324331f5"}], 0x1, 0x15, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f00000001c0)={0x3, 0x0, [{0x40000090, 0x0, 0x9}, {0x39f, 0x0, 0xd8}, {0x977, 0x0, 0x8}]}) r8 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, r10, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40840) ioctl$VHOST_SET_OWNER(r8, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r8, 0x4008af03, &(0x7f00000002c0)={0x35}) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x2, 0x0) 3.164740281s ago: executing program 0 (id=471): r0 = creat(&(0x7f0000000080)='./file0\x00', 0xc7) close(r0) (async) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000), 0x101000, 0x800, 0x3, 0x1}, 0x20) (async) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'veth1_to_batadv\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r1, &(0x7f00000001c0)={0x2c, 0x8, r3}, 0x10) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) (async) socket$packet(0x11, 0x2, 0x300) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) r6 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r6, 0x0, 0x0, 0x8044, &(0x7f00000003c0)={0x11, 0xd, r5, 0x1, 0x7, 0x6, @local}, 0x14) (async) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) (async) connect$inet(r7, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) recvmmsg(r7, &(0x7f0000002080)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x8}, {{&(0x7f0000001f40)=@in6, 0x80, 0x0, 0x0, &(0x7f0000002040)=""/58, 0x3a}, 0x81}], 0x3, 0x40000000, 0x0) shutdown(r7, 0x1) (async) mount$binderfs(0x0, &(0x7f0000000000)='./binderfs2\x00', &(0x7f00000000c0), 0x3030c86, &(0x7f00000001c0)=ANY=[]) 3.149394271s ago: executing program 0 (id=472): add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) (async) r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) request_key(&(0x7f0000000080)='trusted\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)='+:-\xd3[-\x00', 0xfffffffffffffffd) (async) r1 = request_key(&(0x7f0000000080)='trusted\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)='+:-\xd3[-\x00', 0xfffffffffffffffd) keyctl$negate(0xd, r0, 0x7, r1) r2 = add_key$user(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, &(0x7f00000001c0)="564e3a026549cbe86e64d9a3d50adddc05", 0x11, r0) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000200)={r2, 0x47, 0x1b}, 0x0, &(0x7f0000000240)="8bf8e691f7f573fafce40cf495bb3d4c66975195e4f0081eb45cd39f7ba0051bddaa332b17d007191baf4839c60e6d8796a94db5c79be164cd3ea3849ebcb1da242f7084062ebc", &(0x7f00000002c0)=""/27) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) (async) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000300), 0x40000, 0x0) ioctl$PTP_EXTTS_REQUEST(r3, 0x40103d02, &(0x7f0000000340)={0x7, 0xd}) r4 = add_key(&(0x7f0000000380)='user\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f0000000400)="c3a152fd8a949f4a037226d6c69ff1542dda2297a0f5d553abe96480a9d0d19fd7edbac86abb7474b507e0226bd75ea33b10e77e31553afc321a4bb4f96021adbca3f03fa17af2dbd18957c6e4a33aa380227a7f0316b05274681137ef63779ab2a7ae2c7d2a45931abfe4cd1d24f89654e0a0239b53b40e0698bcda1f6cba73ae3c1e1b3f0b0c8e601afc44e4c2c7d63e6dcffda58aa459e8adf733fe2a62de2db003807db73f2d8b15ba2eb7f7f8db8b340e4035deaa488364997601328c390ba0f6a223c3544e679df97d8625f1", 0xcf, r1) ioctl$PTP_EXTTS_REQUEST2(r3, 0x40103d0b, &(0x7f0000000500)={0x8}) (async) ioctl$PTP_EXTTS_REQUEST2(r3, 0x40103d0b, &(0x7f0000000500)={0x8}) clock_adjtime(0x0, &(0x7f0000000540)={0x101, 0x6, 0x78, 0xfff, 0xc6, 0x7, 0x80000001, 0x400, 0x6, 0x3, 0x4, 0x0, 0x7, 0x8, 0x5, 0xe, 0x49ee3379, 0x5, 0x1, 0x0, 0x4ecf, 0x100, 0xffffffffffffffff, 0x24, 0x1000, 0x6}) add_key$user(&(0x7f0000000640), &(0x7f0000000680)={'syz', 0x1}, &(0x7f00000006c0)="e74b1a15c6", 0x5, r1) keyctl$get_keyring_id(0x0, r0, 0x9) (async) keyctl$get_keyring_id(0x0, r0, 0x9) fsmount(0xffffffffffffffff, 0x0, 0x5) (async) r5 = fsmount(0xffffffffffffffff, 0x0, 0x5) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000780)={&(0x7f0000000700)=""/93, 0x1000000, 0x1800, 0xfffff8da, 0x3}, 0x20) openat$tun(0xffffffffffffff9c, &(0x7f00000007c0), 0x12200, 0x0) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000007c0), 0x12200, 0x0) r7 = gettid() wait4(r7, 0x0, 0x8100000f, &(0x7f0000000800)) keyctl$link(0x8, r0, r0) (async) keyctl$link(0x8, r0, r0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000008c0)='syzkaller\x00', 0x0) (async) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000008c0)='syzkaller\x00', 0x0) keyctl$get_security(0x11, r1, &(0x7f0000000900)=""/4096, 0x1000) ioctl$BTRFS_IOC_INO_PATHS(r6, 0xc0389423, &(0x7f0000001940)={0x3, 0x18, [0xc, 0x5, 0xf, 0x82], &(0x7f0000001900)=[0x0, 0x0, 0x0]}) r8 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_INFO(r8, 0x29, 0x40, &(0x7f0000001980)={'filter\x00', 0x0, [0x7, 0x9a, 0x100, 0x1, 0x2]}, &(0x7f0000001a00)=0x54) r9 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000001e00)={0x0, &(0x7f0000001a40)=[@code={0x1, 0x6e, {"c74424005f2939f1c744240200300000c7442406000000000f0114240f08b8010000000f01d92e0f07660f3a2133b6c7442400ed000000c744240200000100ff2c248f8978c6dcb805000000b90b0000000f01c1440f01c3470f784820"}}, @code={0x1, 0x4e, {"640f01c90f20e035100000000f22e0c4a3915fc5d50f22e38f2978db9a17300000f3420f01f88f8998015c050036360f205d65660fc774b2f2430f011f"}}, @uexit={0x0, 0x18, 0x8}, @code={0x1, 0x4f, {"676466440f38005942430fa165f2f20f001236f30faf330f01df960f32b9800000c00f3235008000000f30c4017de72d0000000066ba400066b8000066ef"}}, @cpuid={0x2, 0x18, {0x4, 0x5}}, @code={0x1, 0x56, {"0f0726460fb413c46202f7a4200c000000660f383fce400f01308f4878c2ff0448b86a3f0000000000000f23c00f21f83503000e000f23f80f796c6af8f20f0766ba4300ec"}}, @cpuid={0x2, 0x18, {0x4, 0x5119}}, @code={0x1, 0x6b, {"f3470f09440f01f8c744240049000000c74424020c000000c7442406000000000f011c2466b881000f00d0b8010000000f01d966450faef7b9a90b0000b803000000ba000000000f300f017d32c4010ddff7f20f019d00800000"}}, @code={0x1, 0x43, {"450f01c9360f0ff89e0f01c9450f79f0650fc7ae0f800000f30faef30f01c8260f7eea66654280bf5a00000086660fc773f4"}}, @code={0x1, 0x4c, {"360f35b9560900000f32c4a2313e020f38f92b47c7f8efb30000440f093ef3e003f3420f09650f71d3cbb9b6020000b80700c0feba000000000f30"}}, @cpuid={0x2, 0x18, {0x3, 0xbc01}}, @uexit={0x0, 0x18, 0x1}, @uexit={0x0, 0x18, 0x6}, @uexit={0x0, 0x18, 0x7}, @uexit={0x0, 0x18, 0x7}, @uexit={0x0, 0x18, 0xd}, @cpuid={0x2, 0x18, {0x7f, 0xfffffc6d}}, @uexit={0x0, 0x18, 0xfffffffffffffffd}, @uexit={0x0, 0x18, 0x5}, @code={0x1, 0x41, {"41e704470f023fd1f266ba4000b0dbee2666410f3a4019000f01dff3460f0926440ff5d866ba420066ed66b86e008ed0"}}], 0x3bc}) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(r5, 0xc02054a5, &(0x7f0000001e40)={0x7, r8, 'id0\x00'}) (async) ioctl$SNDRV_TIMER_IOCTL_CREATE(r5, 0xc02054a5, &(0x7f0000001e40)={0x7, r8, 'id0\x00'}) openat$cgroup_ro(r10, &(0x7f0000001ec0)='blkio.bfq.group_wait_time\x00', 0x0, 0x0) r11 = add_key$user(&(0x7f0000001f00), &(0x7f0000001f40)={'syz', 0x1}, &(0x7f0000001f80)="1c0fb4dc4580a42b6abec0d205ff06f2a475fe180146130bc3ea2222ddc8d2163b0376182f8e8e8f10ddcf10e6c143ce7d093ec0518c81a4c43a903e6d606fbac59c5da0b276b384db804573885e2d61b23b7951edc4b02922", 0x59, 0xfffffffffffffffc) keyctl$setperm(0x5, r11, 0x1000) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3.134156451s ago: executing program 0 (id=473): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x3a) dup3(r0, r1, 0x80000) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x20002, 0x0) ioctl$IOC_PR_RESERVE(r2, 0x401070c9, 0x0) r3 = syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0xff, 0x28bd, 0x909, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x1, 0xa0, 0x32, [{{0x9, 0x4, 0x0, 0xf, 0x2, 0x3, 0x1, 0x2, 0x2, {0x9, 0x21, 0x3, 0xf, 0x1, {0x22, 0x49b}}, {{{0x9, 0x5, 0x81, 0x3, 0x1e7, 0xbd, 0xfc, 0xae}}, [{{0x9, 0x5, 0x2, 0x3, 0x10, 0x7, 0x2, 0x7}}]}}}]}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x110, 0xd, 0x6, 0x4, 0x40, 0x4}, 0x4e, &(0x7f0000000100)={0x5, 0xf, 0x4e, 0x6, [@ptm_cap={0x3}, @ssp_cap={0x20, 0x10, 0xa, 0x6, 0x5, 0x10001, 0x0, 0xe0, [0xdfb0, 0x3f00, 0xf, 0xff, 0xff00c0]}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x5, 0x8, 0x7fff}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0xb3, 0x3, 0x1ff}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xc, 0x9, 0x3, 0x53ba}, @wireless={0xb, 0x10, 0x1, 0x4, 0xc4, 0xe, 0x1d, 0x9, 0xa}]}, 0x3, [{0xf5, &(0x7f0000000180)=@string={0xf5, 0x3, "a181194e3018653c3f82bc37b44dd22f962182773b7081c46dffd135ad58e63ecb455167d79c424d75dd8151f27b8bd3e90efe71186f7504f3c6136224975be92523d1dbbe2e37a84f720adafca9f91f1c23243605bb1894281eee0340b38ebd8c0bfe5472ea80eff61bd5e49954e93bcccf5c0149fdd8514c5ca30178d4c33d7f6461be28301ac2026f9124a17abee3bdcc4dca27c79aac3bd54c9fc7bc477252fc068bd6dd414e129ac36b871649def5425b6f515dd8290c316dae574a78909ed456861137dcb5a279cc7782024a6ac7bab4193d98223eafcd5e0ac3d958593b8bb484d4eb8f5a3c2a22853f259ca201e9a7"}}, {0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0x380a}}, {0x94, &(0x7f0000000280)=@string={0x94, 0x3, "82ee050408ba9365b0528cdeb46f24fb2a73b9dec695a1d26a284b25bb5c89a4aaa2c2df9fb231b39dabb9e7e9dc5573bc82fd6949b31bee82da7c5ab8a8644a7780764af8f91207229e35b4abf96f0f0c8d08e988a7c97f30530b2a9393bc1be49f454b0f15a73629232957da989dfea938192bad62dfc5c1bd92b81477052b5b6c2e016a11f73b8995c4a894034f1cb4da"}}]}) syz_usb_control_io$hid(r3, &(0x7f0000000480)={0x24, &(0x7f0000000380)={0x40, 0x22, 0x4, {0x4, 0x2, 'F\x00'}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x423}}, &(0x7f0000000400)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0x0, "06d4c563"}]}}, &(0x7f0000000440)={0x0, 0x21, 0x9, {0x9, 0x21, 0xf, 0x9, 0x1, {0x22, 0x124}}}}, &(0x7f0000000700)={0x2c, &(0x7f00000004c0)={0x40, 0xc, 0x9e, "1a6dc9fa389120f35fb64ca39d2cbdf07a5c0a23df339b552328fa5cb206f16afbaa0323715a68659b34dbb2c0f676bf0e3328fb4e294bc3a7921bcc04ba7d09359cc841d50d7a19fdd0258268691c4bcf613c75f4fef84f8eed186fd261a23ff53f8aa5782d58da6f74b26c5ea50ec9af45d506af1c85526967b78acf4b0ac584c6f7cbb008f5aa6ba1f5f99796904bad4fca7069b7cedb6c928ce2a6ab"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0xac}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000600)={0x20, 0x1, 0x97, "9596c8f8a7e640170f69830faafe9ab76fa76574b30fc4c48933c94c82dadbb2f9da4fb351f8f852652d877702193435bd50689e07e021c6c8588f0384344ffcef9a48e55fa62b207d3168201471b87dcf8d4b9780db81f86cf9e5cc01a5b621d0ac926b75f774ddc0ad80746b37d8f8c5c6fcd2e026a6ed5229b3d13af4540304be168a39ba385ea8f6a32d0f982082f07ce27f45c6b9"}, &(0x7f00000006c0)={0x20, 0x3, 0x1, 0xdc}}) 2.051265628s ago: executing program 3 (id=478): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000180)={0xfffc, [0xb], 0x9}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) read(0xffffffffffffffff, &(0x7f0000000000)=""/117, 0x75) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) (async) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000180)={0xfffc, [0xb], 0x9}, 0x10) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) (async) ioctl$TCFLSH(r1, 0x400455c8, 0x0) (async) read(0xffffffffffffffff, &(0x7f0000000000)=""/117, 0x75) (async) 1.769564712s ago: executing program 2 (id=479): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f00000001c0)=[@enter_looper], 0x0, 0x0, 0x0}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched_retired(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@delqdisc={0x24, 0x25, 0x1, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xa, 0xfff2}, {0x7, 0x1}, {0x9, 0xf}}}, 0x24}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r6, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000440)="ea", 0x1}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="140000"], 0x18, 0x81}, 0x4c800) setsockopt$sock_int(r7, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r7, &(0x7f0000001140), 0x700, 0x2, 0x0) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000140)={0x0, 0x1, 0x6, @local}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x33}, @fda={0x66646185, 0x5, 0x0, 0xf}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) 1.767382152s ago: executing program 2 (id=480): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x54c, 0xba0, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x20}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000000c0)={0x2c, &(0x7f0000000000)={0x40, 0xa, 0x7, {0x7, 0xb, '9-19\x00'}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000380)={0x2c, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x20, 0x1, 0x10, "cbc1ae5e7b42fc0027d5a8aaff56be54"}, 0x0}) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000340)={0x8, {{0x2, 0x8000, @multicast2}}, {{0x2, 0x0, @multicast2}}}, 0x108) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000000340)=""/225, &(0x7f0000000180)=0xe1) 832.032287ms ago: executing program 1 (id=488): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$hid(0x2, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201010200000020"], 0x0) socket$can_raw(0x1d, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) ioctl$EVIOCRMFF(r0, 0x40085507, &(0x7f0000000200)=0x2018) mount$binderfs(0x0, &(0x7f0000000580)='./binderfs\x00', 0x0, 0x4008024, &(0x7f0000000040)={[{@stats}]}) 115.608028ms ago: executing program 0 (id=489): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xcccc0000, 0x1000, &(0x7f0000f15000/0x1000)=nil}) r0 = fsopen(&(0x7f0000000280)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x1) fchdir(r1) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r2, &(0x7f0000000f80)=""/4092, 0xffc) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8500, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) recvmmsg$unix(r5, 0x0, 0x0, 0x1, 0x0) fsmount(r5, 0x1, 0x80) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0xfffffffffffffffa) ioctl$KVM_SET_GUEST_DEBUG(r6, 0x4048ae9b, &(0x7f0000000200)={0xf0003, 0x0, [0xfffffffffffffff8, 0x6, 0x200004000000000, 0x80, 0x3, 0x0, 0x10000, 0xa3f]}) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f00000002c0)=[@free_buffer={0x40086315}], 0x0, 0x0, 0x0}) 66.568999ms ago: executing program 1 (id=490): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000018c0)='/sys/kernel/fscaps', 0x40, 0x40) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_clone(0x802400, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x300000c, 0x13, r1, 0x293f000) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/zoneinfo\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r3, 0x400, 0x70bd27, 0x25dfdbff, {{}, {}, {0x14, 0x19, {0x8, 0xe56, 0x1, 0x3}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x8050}, 0x45) read$FUSE(r2, &(0x7f0000001900)={0x2020}, 0x2020) 65.791239ms ago: executing program 1 (id=491): r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r1, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x80}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) r2 = socket$igmp(0x2, 0x3, 0x2) bind$inet(r2, &(0x7f0000000140)={0x2, 0x4e21, @multicast1}, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x5c, r1, 0x4, 0x70bd25, 0x6e51, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xe}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xb}]}, 0x5c}, 0x1, 0x0, 0x0, 0x44}, 0x4000) close(r2) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(r0, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x88, r4, 0x400, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x60}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x13}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x5b}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x1f}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x57}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x3c}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0xd}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x23}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x7f}]}, 0x88}, 0x1, 0x0, 0x0, 0x40000}, 0x4001) clock_settime(0x2, &(0x7f00000004c0)={0x0, 0x3938700}) ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, &(0x7f0000000580)=@req={0x28, &(0x7f0000000540)={'veth0_virt_wifi\x00', @ifru_data=&(0x7f0000000500)="b5920c05c23913a41cfc1869105c719df0d3d374bbb16cb754c9b7161d4d7d27"}}) getsockname$netlink(r0, &(0x7f00000005c0), &(0x7f0000000600)=0xc) getsockopt$CAN_RAW_LOOPBACK(r0, 0x65, 0x3, &(0x7f0000000640), &(0x7f0000000680)=0x4) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f00000006c0)=0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_GET(r0, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x6c, 0x0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}]}]}, 0x6c}}, 0x41) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000840)=@fragment={0x3a, 0x0, 0x7, 0x1, 0x0, 0x9, 0x67}, 0x8) pipe(&(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r7, 0x89f3, &(0x7f0000000980)={'syztnl1\x00', &(0x7f0000000900)={'syztnl0\x00', 0x0, 0x4, 0x2b, 0x0, 0x9, 0xa, @mcast2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x710, 0x10, 0xcd9, 0x2}}) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f00000009c0)={'team0\x00', 0x0}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000b00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x98, r1, 0x0, 0x70bd26, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r9}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast2}}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7f}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x10}]}, 0x98}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000) r10 = mmap$binder(&(0x7f0000fee000/0x10000)=nil, 0x10000, 0x1, 0x11, r6, 0x6) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000c00)={0x20, 0x0, &(0x7f0000000b40)=[@exit_looper, @register_looper, @free_buffer={0x40086303, r10}, @release={0x40046306, 0x1}, @register_looper], 0x56, 0x0, &(0x7f0000000b80)="a88d0620a30c28bdd0413ec9a390f0e955e7a804d61c31ccd743d644b8dd874d85a6c41ff3dff7061d4ee1fee263de501091d296143c0dde36bc4df3b3ae4dbde8a1c1163b3508a8070dfd288fb84f3de61f42de12cc"}) socket$packet(0x11, 0x2, 0x300) socket$nl_generic(0x10, 0x3, 0x10) clock_adjtime(0x7, &(0x7f0000000c40)={0x7, 0x0, 0x2, 0x2, 0x81, 0x2, 0x9, 0x40, 0x2, 0x8, 0x0, 0x6, 0x100000001, 0x7, 0x7, 0x52fd, 0x400, 0x4, 0xd8, 0x800, 0x4d15, 0x3, 0x95b, 0xdfc9, 0xa93, 0x3}) fstat(r2, &(0x7f0000000d40)) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f0000000dc0)) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, 0xffffffffffffffff, &(0x7f0000000e40)={0x80000008}) 65.233659ms ago: executing program 1 (id=492): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x2c, r1, 0x801, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24008000}, 0x8000) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x2c8340, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY(r0, 0x5000940f, &(0x7f0000000580)={{r2}, "2981dea85160eaab82164bf493c9d3d5038a927a260b369390688f4d399bc1df8ac492d9ef284e198af02908b2921021d55eacbb340f2247e38546d27d08329bbeaf9593a2c6660f88891a23982bef19a5931c8b695977cc4d7cd417bda9d5ccd43d1d799448ac02bb10713b21219c0d306126274bdfbaba15b1bcf9858e13e67189aa728701b690b7e1a8f8d4e5f8cf4f90dde45a5a810426bfc4d89f219aff53a9d0e76b1cd19ed7adb7df9365493b34a56fb00c0a00dd2c4e01d42b2862881e89e7b436eaf6393d9e494723bb45a10cfc133d427bac82ea3f9d5b16a5b46043f25e0b01295e2f75266970bf4a7a8701d8ef63ea04433a05c25aacfce82110274a5b6239c8c7441327be9c9389e26520f21ad31d3e5a905856b2ea5babe6354b845c1abf1fe3c84fb477082f9225e6a568f0d992da0e4a0a99b939a9f8a419bf16298b6267c20d7ef900fdf739226e7fd7385cbc912f6ad50517a9cf55dd4e610d3a8fdc1258a7f9d08ec670fad17cfb2d87db9c7404b1e6ac167f58d4a7e5e90775a948113aac9c96c2f30d6a147bc3db8cb69d1a6e1bef589b184a13464b09901090ce6cd1efa03a8af75a25a873f6242c3246e47859ae6621d3fabef5d9520091766701e4bfbee0664f59de1656afa471f9c40ede48f9a0c9799aaa0a2ec75057a056450edc052f26cb1de544cc51d33de17fd8c52f20c49e008d979cc9fa3fe8e95e8430f7174b197725fe6568c76599e24decddb38b4ff460208877437707931695111492f903a3cf235bb2ca012bc46e67b8a3ccaedf5b3a0bde67294314b22eeebdc1ab420eb08f83d2a6b48be30fa4e956cc9516d6c6245dba4c4cef5d808abca73cb18120faaa73a22be1d9f388609a12a6e910891dc86232d95c408e067603ea8e8fa110b4c81269f67d4395c2a9b96b581d32e3683ffc3f06d22b596e2f7d032af7a40a7c3344392decde251b7aea46381f6b755248a02ff17db0149dc07af2e7346a1fa142f496cc253a7827dc5522bcf9717bd9ebde6dc488df5a16f9fb7b9e952aa2989e5f92795abea535b1fbd84a349bc907c6edb7e5977622baa8fe51769dddd8a43265d7d2d16f69eff5f45e615d461820459f888784f1ae19cfcc43261a51d497171b662a843f8b45d5914294ffd1975eba74d7bbf6bc6037c698c5e718f3184f1b848666690132789d3232f7c66e9dbaac77a5e2cdffe646486db19ae0bcd47259ae3f1f6d3e09309dc817379408330b565559d77665350e48807edbf69d87924d5b87187fc531679850123499285b495dc1b682b5936d2025117b78d61633e060781ead85aa64b52bc0ac6efffcbbb44b8922888ef918b5f88c43ee32effa3bc24372acedaa37f03a357fa4cee0809ef9179b7cb52db02170ed8fcf5890336fe656f2e988636c10b4146a968eedc5bae3b1a6de82eacf35031dccc8eb6f26c162eb962bdcbca254008d77aa2504feab9ef05ab024d100e057f6d81e1f3dac687923b6de362963a8dedeab8c1fba1a4e32c12694f1d4962b9b1ba01f9a2ef8637ca0b9a40dc9fa41b79e5ef508dc9118ddb2215060a8ea1cd621632a0f118714e0abdd0ea93398c993354a642530b13593e225829674d120c6afdda93198ab032eb10824d9a22aa47500244a89d5f9c29e2cc2b05b937760565511bd77a7d8eacd30676b0d99a2110a7bdd118faddd573e1ac46a9de22aef72d2fd5eef20f66627eeb40362818279500b332cfebc0cc29ef41dcfed7bb0adf425c30e46de9449b1620d18bf4bef59dadb46ad013bf8726b265cc515e2d29b8eb73e613b9869f9ff1cde92bda80649204a56ec3360c16e6292dd13dbf05963cff374ab1545a5409f35bd7feb9cf9dd3679b3d28f9a169846e7e83fbe91405ca3597c40b6c152b8adc43a8053960947277465d5bb6336bf503485511b2f83a2400815fbd2e080c47eb584f2bfca97df103582c0702731ccb4683262ff584c6896d75b65b6fac7c851f90ca9c121b9a7b10844dd7bc8f76678066cfee139d9f13c3ae83c3da125144724922cb28d0c1593894dd82c146285617313356af4dfeb7fbc15becd632037057d3931a9a713c7b889099166222b4cbb81c62b69978fcafacee629ca854e5a1e250c9c941ee348fe065a5d36a128f20a67e4c3ac2c6c156a56541dc4341c59ea8ad4e26f7a97fd5c3a253e5df74cb58221a56d8bd65efed6633889db2e9c84b2d53ecabd13e194994e97428c96e49f573bb172ac9bbe69cbc6480b62c209fdef39d171a22aa1f4710df00a2e7c7c356a53a3bd6a22cc0d65f33c5044e12598aae75f610dbe838430b8b33b00d08b1fb5d865a8c3bfabeed6e853a1fd1c90abf06b47698b63002b4641637b1fd148f989778efd7e584d55c25228de0c732b730631aa7ac8db7b908f9b30f119cfba03c66874f3d59caae236f6b35ceab32942303f81bd6903bd7220ca213bee7e98b3192b00d0a67bc7d97796333a2a12265afec4a59fcd933c05cb1e1970ffc348ed86e0d567300c7f3a9e10c4d1040f8bf52272d2f25c4f3e77904867e3caa28c5a73aff471c49a690ad05999145f545e73a3372407ee0e50ae0909903645e8f13a78cfa42b456ec1d5b95d5cdd2120e09502655471be9cf5994511734a465b3475234bfee65375c630abb06f2ca398757c5249e56166716ced57bcdf70b10650872b88fa3b5267225278a564c981a5112b5472585145bd9de16889bae23c14b5d693d8aa06facbc0a385c3821a3d728af6bec4f7e19487a074c92827e34243337ca88c82c6a94c7ebc99a59602d29a9438b84a5b34be6d7bba17b8b623841b80ddab63a18115b66c534a7c2fd736b647e9ad25d5c2f25f2279e2bb73ae0321799e606bc287d9a6847940b45b571225d78f11180d88f53c2212c3ebe8f0e66695ec6835a83de63b3abe33a6073547ead992d7ade19e19d7622194d9eb00378aa11af569628d9f7ed84a7cf0325abc94420f5f846c394a28b7bfdc13ba937e4912eafde728009e2ab260f0992f387e63b41ffff72e6e60ea73226bd1efcc24f04df79df8b67137c47042508f45bb9e4d8a025c6952b84e33fbbba10fe8f05f6545696605e505ec042668a7b0941ca54611a40f64494d319cbf31b176cdb097baa8f44a628162046195056806786bc467dcdd6308ee90842dd0ae744de196d35eb949111ef31ff3695c52a36b5ab44014c77049f3cc2ce415e1b295aef74ea87eb0d0603b23531a3fb5e5cb0a9980222e957fd00be58a625437141470a57427cc289df7860ce2259f1f58087748d2a40fa9c62beaf21140a3ae5a8955e1f6b4df9ef2bdd77e8719e0b1d9b7c71415125ee59fde9a092f21dc83a3699660311e0481c8f035ec9c46c96355cfa0e4bea3093e345dcfd98450dda142a8577dfada0bbd28cef469f208c9f5437b04e64e218264f12ec200a57f87737a4be1c68aa38f8702d1019497260f09b418feed09103ffb47ceba77a3a2e29e6b7a1bfadb77d9bc35f00e4a9cc2f8cc6be120a271480d36fa3e2fc3e7d3704eedc14876297214ee07655d4440f7a67f4854d916623ce5890ebc6a7039dc904bc4db5d4d97c9f6eb5a49f3f9c7f8a5b9667517c934c132756f94581cb7dbbab37f0df2eedbc355ab3e0c53d18ed6e111d0baab73780fbb05e1e853baca4fa15a3711bf9bccee24ed5529cd6b07c7adf7f8d6b82c17acfbc94b18929970e73b5993952a7618368bfc450aa122e2d5a655c357c4ed7256f59393e1fdbde2d968db2641b891ca2538f6a76a060dbfbf8a9bd5e9b08dc4e5b49d95d5af9282ca6beb891d67041ed9c29c595a914fa02458d2f06a7d3c821fe59ee7873d3bdec0ddcfe5c7d3916c52232af82ff7bb15cd54428e05a954793e2cf8bb2c1e7cab87361a373cd1edc7619605d3f3f4a1fbac44b29f7d06031477fc174b70b8169374f26221583cc976c8824ef014a1705d3e03f9f2746f7af2deda9afabe93412b63b7d66bdc43c760ef6927bfd116ba211970c01b85865eb2439f330e46fae356bba790851e9c4246d6c90517ffdc72ae34acf3fda26c74dce0b5953748f6fa501da95f8ca6ce07d5965dcb2a863be6b4b09c21259e2eaa9846cc0bcd51ef2b84370dbb6a34fd39143f7e938b19ede0e281f9c1e49e898b35dacfff22915c184e636de5242acaa641a483a75b6d5436ab637b44a251327c177cbe617bf463c0717ca7fb3c86cbaf5a86a0ae8e1d73da81a823339f85ab923575915888c8087b0bf26f97ebe682a32f84fb54c7b0961085757c7a963c231f0e4ac5873396f39a21831fbefe804391a6a4ffffe84d05503da37da67b1f4645dab5c4ca1dab8b45123fdd6f730e6e4bf1cc9a0f8a08092f04233023b88b7fb4106d256465ef95fd8e92675d8263fbb0d0c731a6996c8b3adafd3bf0e45f34fe7f2b60d7c1826f164e3f7f70ce5aef043dd2cb10de2b42bdf2f5d610d5a46f03c8080ccc6082a3f3c16e631b2e178c0a6eeef20a1720227d026648de7616a77548d045607cded3b83083dc30d2a339557959c82429effc64e0fb5b66bcdd56e2523d6dcfbfee06c41de7bd0fd9cdc74ab3a379046c1c16469618d26b5301733e054f1a338f8cdb55b4ea834a75571676b76e6c38c28ed6c83b968e44809b734689e3229029774219dbf0600697fd4141f9d0e71ee1c5e593be79550f287cbcc5b08c43e7862688e4111b72636d4eb1b298fde0bcf91566a01367816b741c62e8891ec5563ca985b5b73a3e676089794716a672f9575a9190aad24406da88671028cdde7d1751821eafcc605c492028abc7017a50eb63f2cc54523872e43ed5e2e2186dc6cf716c6d21aacc41ec196cd0f2312fcb9e763dc50c312e7fa0b5753f4e0d22005111037939aaf6cefc1258ed4c12d55d5f585081ecdc77d9d23f1715362fefff6c1fea4c81895be80d8be42c78af099855fbd4bb74ba08e2ae087860917fae46555b489b7da3d33c9f503a887e84e3a54d7d6cbdd7adab67e8fee24c51876d8fc91fa6242ca97bb36f4b41b5ea0d8a7dfd7eadee7d57350257ca7a58bdb73262124585570f66759295f42b174c513bd204fa000a8c354e11e919e0e628295668850291729382ff6d52f7c0926c85728c06d3ba0a2a34b4d4a483a98791db2da68f4af5b213c99043871e1a0eb427ccc7ca1ca2bfc12c73db7c8f6602608bcc98fb76a8050c32c1ab805389c7af7c27f7cfd8a1709151cd84cd6cce7c3e189595bb3374cc57748fb0e39c6646077fb4bb6ddc4cde76749bda2d3110d719ace997dfcf6f9fc06b4c4534c24355e8023fce2aafdddc425899318c7c8ead34847c691bf9ee9529d8d537fa3a13e64e8389c66678d94a01c581495346c68358c3e45f8320359c41b3dd7e0b22545ca519ab967ec6848720870f3890c62d94f258dc4a6c0442cbd53a660ecf1e142dfc36bc9e7e298b1b6fe2d1c893093231676785ca5edf50b5f4107fc46900909855956119f75bcacc0821c77f08c63d4a758e159c0448ed95fa8b3a4cd2e5c4a25878fa0f6b75deb32c69d9b9bf43e4cb9af80e53ed5200b3da348fe02a2d42fe004148c5ad6217bc6c8e9d35c8e33b12e574d264a0548e59aacfb92d0e46b3e422b112edf04cc31e9f9c7a6a394aac8e13e6fdcb0df0fafbaad6d1e4fa55dcd8d994fdd5fad29cc4f1f9de318309a5256d55c80e40961dfe860e9a864bf84d81df64501ae058befbc7585776ed6f7961f47084dad76af112f5f7937e5bab3413962e"}) (async) ioctl$BTRFS_IOC_SNAP_DESTROY(r0, 0x5000940f, &(0x7f0000000580)={{r2}, "2981dea85160eaab82164bf493c9d3d5038a927a260b369390688f4d399bc1df8ac492d9ef284e198af02908b2921021d55eacbb340f2247e38546d27d08329bbeaf9593a2c6660f88891a23982bef19a5931c8b695977cc4d7cd417bda9d5ccd43d1d799448ac02bb10713b21219c0d306126274bdfbaba15b1bcf9858e13e67189aa728701b690b7e1a8f8d4e5f8cf4f90dde45a5a810426bfc4d89f219aff53a9d0e76b1cd19ed7adb7df9365493b34a56fb00c0a00dd2c4e01d42b2862881e89e7b436eaf6393d9e494723bb45a10cfc133d427bac82ea3f9d5b16a5b46043f25e0b01295e2f75266970bf4a7a8701d8ef63ea04433a05c25aacfce82110274a5b6239c8c7441327be9c9389e26520f21ad31d3e5a905856b2ea5babe6354b845c1abf1fe3c84fb477082f9225e6a568f0d992da0e4a0a99b939a9f8a419bf16298b6267c20d7ef900fdf739226e7fd7385cbc912f6ad50517a9cf55dd4e610d3a8fdc1258a7f9d08ec670fad17cfb2d87db9c7404b1e6ac167f58d4a7e5e90775a948113aac9c96c2f30d6a147bc3db8cb69d1a6e1bef589b184a13464b09901090ce6cd1efa03a8af75a25a873f6242c3246e47859ae6621d3fabef5d9520091766701e4bfbee0664f59de1656afa471f9c40ede48f9a0c9799aaa0a2ec75057a056450edc052f26cb1de544cc51d33de17fd8c52f20c49e008d979cc9fa3fe8e95e8430f7174b197725fe6568c76599e24decddb38b4ff460208877437707931695111492f903a3cf235bb2ca012bc46e67b8a3ccaedf5b3a0bde67294314b22eeebdc1ab420eb08f83d2a6b48be30fa4e956cc9516d6c6245dba4c4cef5d808abca73cb18120faaa73a22be1d9f388609a12a6e910891dc86232d95c408e067603ea8e8fa110b4c81269f67d4395c2a9b96b581d32e3683ffc3f06d22b596e2f7d032af7a40a7c3344392decde251b7aea46381f6b755248a02ff17db0149dc07af2e7346a1fa142f496cc253a7827dc5522bcf9717bd9ebde6dc488df5a16f9fb7b9e952aa2989e5f92795abea535b1fbd84a349bc907c6edb7e5977622baa8fe51769dddd8a43265d7d2d16f69eff5f45e615d461820459f888784f1ae19cfcc43261a51d497171b662a843f8b45d5914294ffd1975eba74d7bbf6bc6037c698c5e718f3184f1b848666690132789d3232f7c66e9dbaac77a5e2cdffe646486db19ae0bcd47259ae3f1f6d3e09309dc817379408330b565559d77665350e48807edbf69d87924d5b87187fc531679850123499285b495dc1b682b5936d2025117b78d61633e060781ead85aa64b52bc0ac6efffcbbb44b8922888ef918b5f88c43ee32effa3bc24372acedaa37f03a357fa4cee0809ef9179b7cb52db02170ed8fcf5890336fe656f2e988636c10b4146a968eedc5bae3b1a6de82eacf35031dccc8eb6f26c162eb962bdcbca254008d77aa2504feab9ef05ab024d100e057f6d81e1f3dac687923b6de362963a8dedeab8c1fba1a4e32c12694f1d4962b9b1ba01f9a2ef8637ca0b9a40dc9fa41b79e5ef508dc9118ddb2215060a8ea1cd621632a0f118714e0abdd0ea93398c993354a642530b13593e225829674d120c6afdda93198ab032eb10824d9a22aa47500244a89d5f9c29e2cc2b05b937760565511bd77a7d8eacd30676b0d99a2110a7bdd118faddd573e1ac46a9de22aef72d2fd5eef20f66627eeb40362818279500b332cfebc0cc29ef41dcfed7bb0adf425c30e46de9449b1620d18bf4bef59dadb46ad013bf8726b265cc515e2d29b8eb73e613b9869f9ff1cde92bda80649204a56ec3360c16e6292dd13dbf05963cff374ab1545a5409f35bd7feb9cf9dd3679b3d28f9a169846e7e83fbe91405ca3597c40b6c152b8adc43a8053960947277465d5bb6336bf503485511b2f83a2400815fbd2e080c47eb584f2bfca97df103582c0702731ccb4683262ff584c6896d75b65b6fac7c851f90ca9c121b9a7b10844dd7bc8f76678066cfee139d9f13c3ae83c3da125144724922cb28d0c1593894dd82c146285617313356af4dfeb7fbc15becd632037057d3931a9a713c7b889099166222b4cbb81c62b69978fcafacee629ca854e5a1e250c9c941ee348fe065a5d36a128f20a67e4c3ac2c6c156a56541dc4341c59ea8ad4e26f7a97fd5c3a253e5df74cb58221a56d8bd65efed6633889db2e9c84b2d53ecabd13e194994e97428c96e49f573bb172ac9bbe69cbc6480b62c209fdef39d171a22aa1f4710df00a2e7c7c356a53a3bd6a22cc0d65f33c5044e12598aae75f610dbe838430b8b33b00d08b1fb5d865a8c3bfabeed6e853a1fd1c90abf06b47698b63002b4641637b1fd148f989778efd7e584d55c25228de0c732b730631aa7ac8db7b908f9b30f119cfba03c66874f3d59caae236f6b35ceab32942303f81bd6903bd7220ca213bee7e98b3192b00d0a67bc7d97796333a2a12265afec4a59fcd933c05cb1e1970ffc348ed86e0d567300c7f3a9e10c4d1040f8bf52272d2f25c4f3e77904867e3caa28c5a73aff471c49a690ad05999145f545e73a3372407ee0e50ae0909903645e8f13a78cfa42b456ec1d5b95d5cdd2120e09502655471be9cf5994511734a465b3475234bfee65375c630abb06f2ca398757c5249e56166716ced57bcdf70b10650872b88fa3b5267225278a564c981a5112b5472585145bd9de16889bae23c14b5d693d8aa06facbc0a385c3821a3d728af6bec4f7e19487a074c92827e34243337ca88c82c6a94c7ebc99a59602d29a9438b84a5b34be6d7bba17b8b623841b80ddab63a18115b66c534a7c2fd736b647e9ad25d5c2f25f2279e2bb73ae0321799e606bc287d9a6847940b45b571225d78f11180d88f53c2212c3ebe8f0e66695ec6835a83de63b3abe33a6073547ead992d7ade19e19d7622194d9eb00378aa11af569628d9f7ed84a7cf0325abc94420f5f846c394a28b7bfdc13ba937e4912eafde728009e2ab260f0992f387e63b41ffff72e6e60ea73226bd1efcc24f04df79df8b67137c47042508f45bb9e4d8a025c6952b84e33fbbba10fe8f05f6545696605e505ec042668a7b0941ca54611a40f64494d319cbf31b176cdb097baa8f44a628162046195056806786bc467dcdd6308ee90842dd0ae744de196d35eb949111ef31ff3695c52a36b5ab44014c77049f3cc2ce415e1b295aef74ea87eb0d0603b23531a3fb5e5cb0a9980222e957fd00be58a625437141470a57427cc289df7860ce2259f1f58087748d2a40fa9c62beaf21140a3ae5a8955e1f6b4df9ef2bdd77e8719e0b1d9b7c71415125ee59fde9a092f21dc83a3699660311e0481c8f035ec9c46c96355cfa0e4bea3093e345dcfd98450dda142a8577dfada0bbd28cef469f208c9f5437b04e64e218264f12ec200a57f87737a4be1c68aa38f8702d1019497260f09b418feed09103ffb47ceba77a3a2e29e6b7a1bfadb77d9bc35f00e4a9cc2f8cc6be120a271480d36fa3e2fc3e7d3704eedc14876297214ee07655d4440f7a67f4854d916623ce5890ebc6a7039dc904bc4db5d4d97c9f6eb5a49f3f9c7f8a5b9667517c934c132756f94581cb7dbbab37f0df2eedbc355ab3e0c53d18ed6e111d0baab73780fbb05e1e853baca4fa15a3711bf9bccee24ed5529cd6b07c7adf7f8d6b82c17acfbc94b18929970e73b5993952a7618368bfc450aa122e2d5a655c357c4ed7256f59393e1fdbde2d968db2641b891ca2538f6a76a060dbfbf8a9bd5e9b08dc4e5b49d95d5af9282ca6beb891d67041ed9c29c595a914fa02458d2f06a7d3c821fe59ee7873d3bdec0ddcfe5c7d3916c52232af82ff7bb15cd54428e05a954793e2cf8bb2c1e7cab87361a373cd1edc7619605d3f3f4a1fbac44b29f7d06031477fc174b70b8169374f26221583cc976c8824ef014a1705d3e03f9f2746f7af2deda9afabe93412b63b7d66bdc43c760ef6927bfd116ba211970c01b85865eb2439f330e46fae356bba790851e9c4246d6c90517ffdc72ae34acf3fda26c74dce0b5953748f6fa501da95f8ca6ce07d5965dcb2a863be6b4b09c21259e2eaa9846cc0bcd51ef2b84370dbb6a34fd39143f7e938b19ede0e281f9c1e49e898b35dacfff22915c184e636de5242acaa641a483a75b6d5436ab637b44a251327c177cbe617bf463c0717ca7fb3c86cbaf5a86a0ae8e1d73da81a823339f85ab923575915888c8087b0bf26f97ebe682a32f84fb54c7b0961085757c7a963c231f0e4ac5873396f39a21831fbefe804391a6a4ffffe84d05503da37da67b1f4645dab5c4ca1dab8b45123fdd6f730e6e4bf1cc9a0f8a08092f04233023b88b7fb4106d256465ef95fd8e92675d8263fbb0d0c731a6996c8b3adafd3bf0e45f34fe7f2b60d7c1826f164e3f7f70ce5aef043dd2cb10de2b42bdf2f5d610d5a46f03c8080ccc6082a3f3c16e631b2e178c0a6eeef20a1720227d026648de7616a77548d045607cded3b83083dc30d2a339557959c82429effc64e0fb5b66bcdd56e2523d6dcfbfee06c41de7bd0fd9cdc74ab3a379046c1c16469618d26b5301733e054f1a338f8cdb55b4ea834a75571676b76e6c38c28ed6c83b968e44809b734689e3229029774219dbf0600697fd4141f9d0e71ee1c5e593be79550f287cbcc5b08c43e7862688e4111b72636d4eb1b298fde0bcf91566a01367816b741c62e8891ec5563ca985b5b73a3e676089794716a672f9575a9190aad24406da88671028cdde7d1751821eafcc605c492028abc7017a50eb63f2cc54523872e43ed5e2e2186dc6cf716c6d21aacc41ec196cd0f2312fcb9e763dc50c312e7fa0b5753f4e0d22005111037939aaf6cefc1258ed4c12d55d5f585081ecdc77d9d23f1715362fefff6c1fea4c81895be80d8be42c78af099855fbd4bb74ba08e2ae087860917fae46555b489b7da3d33c9f503a887e84e3a54d7d6cbdd7adab67e8fee24c51876d8fc91fa6242ca97bb36f4b41b5ea0d8a7dfd7eadee7d57350257ca7a58bdb73262124585570f66759295f42b174c513bd204fa000a8c354e11e919e0e628295668850291729382ff6d52f7c0926c85728c06d3ba0a2a34b4d4a483a98791db2da68f4af5b213c99043871e1a0eb427ccc7ca1ca2bfc12c73db7c8f6602608bcc98fb76a8050c32c1ab805389c7af7c27f7cfd8a1709151cd84cd6cce7c3e189595bb3374cc57748fb0e39c6646077fb4bb6ddc4cde76749bda2d3110d719ace997dfcf6f9fc06b4c4534c24355e8023fce2aafdddc425899318c7c8ead34847c691bf9ee9529d8d537fa3a13e64e8389c66678d94a01c581495346c68358c3e45f8320359c41b3dd7e0b22545ca519ab967ec6848720870f3890c62d94f258dc4a6c0442cbd53a660ecf1e142dfc36bc9e7e298b1b6fe2d1c893093231676785ca5edf50b5f4107fc46900909855956119f75bcacc0821c77f08c63d4a758e159c0448ed95fa8b3a4cd2e5c4a25878fa0f6b75deb32c69d9b9bf43e4cb9af80e53ed5200b3da348fe02a2d42fe004148c5ad6217bc6c8e9d35c8e33b12e574d264a0548e59aacfb92d0e46b3e422b112edf04cc31e9f9c7a6a394aac8e13e6fdcb0df0fafbaad6d1e4fa55dcd8d994fdd5fad29cc4f1f9de318309a5256d55c80e40961dfe860e9a864bf84d81df64501ae058befbc7585776ed6f7961f47084dad76af112f5f7937e5bab3413962e"}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r3, 0x6612) (async) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r3, 0x6612) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000100)=[@register_looper], 0x50, 0x0, &(0x7f0000000340)="a89aff67520a7335b849b4f88a6db06e45e3f5e648a65b8003975be8a982d5135e161a783d3d01fddcbd838bac308358a7e349f333e620505e4cf1982c991b516a9e26b6bb537c85f5ad467697f0d78b"}) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000100)=[@register_looper], 0x50, 0x0, &(0x7f0000000340)="a89aff67520a7335b849b4f88a6db06e45e3f5e648a65b8003975be8a982d5135e161a783d3d01fddcbd838bac308358a7e349f333e620505e4cf1982c991b516a9e26b6bb537c85f5ad467697f0d78b"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x0, &(0x7f0000000480)={@fda={0x66646185, 0x3, 0x0, 0x23}, @fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x0, 0x0}}, 0x0}, 0x10}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000400)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000002c0)={@flat=@weak_binder={0x77622a85, 0x1001, 0x2}, @fd={0x66642a85, 0x0, r3}, @flat=@binder={0x73622a85, 0x110a, 0x3}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}, 0x40}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0x4c, 0x0, &(0x7f0000000400)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f00000002c0)={@flat=@weak_binder={0x77622a85, 0x1001, 0x2}, @fd={0x66642a85, 0x0, r3}, @flat=@binder={0x73622a85, 0x110a, 0x3}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}, 0x40}], 0x0, 0x0, 0x0}) 64.735629ms ago: executing program 1 (id=493): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="3db1766fda368b0145dfb5a8b16895ef14cfe436773ddf2e600813d50c8b7121d83ca533803393b5e2747a5da6b7098f2c23d2ba0bdb2ebe3a070e38e8415ca9d9b4218a7120ef35870cdbdad05199ee85a7b37f80a3ad2b33b45eac458d4c294b88d8f97bc8", @ANYRESOCT=r1, @ANYBLOB=',1']) read$FUSE(r2, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000000)={0x50, 0x0, r3, {0x7, 0x2b, 0x81, 0x60002e02, 0xa, 0x5, 0x7, 0x10, 0x0, 0x0, 0x1, 0x8}}, 0x50) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x800) r4 = syz_clone(0x20820000, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) fstat(r5, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r6) r7 = syz_pidfd_open(r4, 0x0) setns(r7, 0x24020000) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x8, 0x4) r8 = socket$netlink(0x10, 0x3, 0x4) writev(r8, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a04000800ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = socket(0x10, 0x3, 0x0) sendto$inet6(r11, &(0x7f0000000100)="c10e000018001f06b9409b0dffff110d0207be0402050605fe100a044300040018000000fac8388827a685a168d9a44604094565360c648dcaaf6c26c291214549932fde4a460c89b6ec0cff3959547f509058ba86c902fc3a10004a320c0400160012000a00000000000000000000080756ede4ccbe5880", 0xec1, 0x0, 0x0, 0x9e5e111c47e3504f) ioctl$KVM_CREATE_IRQCHIP(r10, 0xae60) r12 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r12, 0xc008ae88, &(0x7f0000000200)=ANY=[@ANYBLOB="01000000000000008a080000000000000300000000000092d90086babb7e87490c03dbddff00"]) r13 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r14 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r14, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="48000000120001000000000000000000ac141400000000000000000000000000000000000200000014000d"], 0x48}}, 0x4014) setsockopt$SO_ATTACH_FILTER(r13, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6}]}, 0x10) 0s ago: executing program 1 (id=494): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000280), 0x8800, 0x0) lseek(r1, 0x9000000, 0x2) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f00000001c0)={@flat, @flat=@weak_binder={0x77622a85, 0x100a, 0x1}, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000040)={0x2}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.15.214' (ED25519) to the list of known hosts. [ 25.372715][ T36] audit: type=1400 audit(1750658939.850:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.374207][ T281] cgroup: Unknown subsys name 'net' [ 25.396007][ T36] audit: type=1400 audit(1750658939.850:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.424825][ T36] audit: type=1400 audit(1750658939.890:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.425057][ T281] cgroup: Unknown subsys name 'devices' [ 25.609918][ T281] cgroup: Unknown subsys name 'hugetlb' [ 25.615554][ T281] cgroup: Unknown subsys name 'rlimit' [ 25.731116][ T36] audit: type=1400 audit(1750658940.210:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.754436][ T36] audit: type=1400 audit(1750658940.210:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.779181][ T36] audit: type=1400 audit(1750658940.210:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 25.809525][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 25.818549][ T36] audit: type=1400 audit(1750658940.300:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.844076][ T36] audit: type=1400 audit(1750658940.300:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.856468][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.869933][ T36] audit: type=1400 audit(1750658940.340:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.904254][ T36] audit: type=1400 audit(1750658940.340:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 27.220920][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.228622][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.235850][ T290] bridge_slave_0: entered allmulticast mode [ 27.243139][ T290] bridge_slave_0: entered promiscuous mode [ 27.251027][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.258226][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.265600][ T290] bridge_slave_1: entered allmulticast mode [ 27.272101][ T290] bridge_slave_1: entered promiscuous mode [ 27.338086][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.345174][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.352762][ T291] bridge_slave_0: entered allmulticast mode [ 27.359729][ T291] bridge_slave_0: entered promiscuous mode [ 27.366273][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.373528][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.380729][ T291] bridge_slave_1: entered allmulticast mode [ 27.387107][ T291] bridge_slave_1: entered promiscuous mode [ 27.463587][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.471009][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.478304][ T288] bridge_slave_0: entered allmulticast mode [ 27.484647][ T288] bridge_slave_0: entered promiscuous mode [ 27.500504][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.507759][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.515030][ T288] bridge_slave_1: entered allmulticast mode [ 27.522300][ T288] bridge_slave_1: entered promiscuous mode [ 27.547173][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.554502][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.561801][ T289] bridge_slave_0: entered allmulticast mode [ 27.568243][ T289] bridge_slave_0: entered promiscuous mode [ 27.583350][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.590505][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.598028][ T289] bridge_slave_1: entered allmulticast mode [ 27.604321][ T289] bridge_slave_1: entered promiscuous mode [ 27.694395][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.701695][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.736060][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.743426][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.751375][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.760034][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.789219][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.796470][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.804112][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.811885][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.829063][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.837252][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.845967][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.854548][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.881222][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.891145][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.901389][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.909738][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.917751][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.925499][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.933800][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.957073][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.965164][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.973531][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.980976][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.989353][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.997310][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.017972][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.025958][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.049365][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.056838][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.073122][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.081307][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.091133][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.099408][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.119094][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.127612][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.145670][ T291] veth0_vlan: entered promiscuous mode [ 28.175656][ T290] veth0_vlan: entered promiscuous mode [ 28.184449][ T291] veth1_macvtap: entered promiscuous mode [ 28.211992][ T290] veth1_macvtap: entered promiscuous mode [ 28.241296][ T289] veth0_vlan: entered promiscuous mode [ 28.256782][ T291] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 28.276251][ T288] veth0_vlan: entered promiscuous mode [ 28.295624][ T289] veth1_macvtap: entered promiscuous mode [ 28.314233][ T288] veth1_macvtap: entered promiscuous mode [ 28.385581][ T315] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4'. [ 28.422499][ T322] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 28.422761][ T323] capability: warning: `syz.2.5' uses 32-bit capabilities (legacy support in use) [ 28.478634][ T322] binder: Bad value for 'stats' [ 28.511953][ T315] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4'. [ 28.530602][ T327] 9pnet_virtio: no channels available for device syz [ 28.541956][ T327] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 28.641380][ T336] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 28.913943][ T360] kvm: kvm [358]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010005) = 0x4e7ccc9d2772fda4 [ 28.936584][ T361] Falling back ldisc for ptm0. [ 29.043974][ T380] overlayfs: failed to resolve './file1': -2 [ 29.407874][ T400] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 29.409306][ T399] rust_binder: Write failure EINVAL in pid:19 [ 29.420584][ T400] rust_binder: Write failure EFAULT in pid:19 [ 29.437369][ T401] rust_binder: Write failure EFAULT in pid:19 [ 29.972587][ T415] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 30.457296][ T36] kauditd_printk_skb: 109 callbacks suppressed [ 30.457314][ T36] audit: type=1400 audit(1750658944.930:183): avc: denied { name_bind } for pid=422 comm="syz.2.33" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 30.526392][ T36] audit: type=1400 audit(1750658944.930:184): avc: denied { node_bind } for pid=422 comm="syz.2.33" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 30.551809][ T428] support for cryptoloop has been removed. Use dm-crypt instead. [ 30.578499][ T428] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 30.578622][ T428] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 30.661363][ T36] audit: type=1400 audit(1750658945.140:185): avc: denied { create } for pid=430 comm="syz.2.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 30.708089][ T431] rust_binder: Error while translating object. [ 30.708137][ T431] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 30.714947][ T36] audit: type=1400 audit(1750658945.140:186): avc: denied { setopt } for pid=430 comm="syz.2.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 30.763487][ T431] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:44 [ 30.811516][ T36] audit: type=1400 audit(1750658945.290:187): avc: denied { setopt } for pid=439 comm="syz.2.39" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 30.901423][ T36] audit: type=1400 audit(1750658945.380:188): avc: denied { read } for pid=442 comm="syz.0.41" dev="nsfs" ino=4026532306 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 30.953671][ T36] audit: type=1400 audit(1750658945.380:189): avc: denied { open } for pid=442 comm="syz.0.41" path="net:[4026532306]" dev="nsfs" ino=4026532306 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 31.005873][ T36] audit: type=1400 audit(1750658945.380:190): avc: denied { create } for pid=442 comm="syz.0.41" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 31.040732][ T440] Zero length message leads to an empty skb [ 31.057143][ T36] audit: type=1400 audit(1750658945.410:191): avc: denied { bind } for pid=442 comm="syz.0.41" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 31.080595][ T36] audit: type=1400 audit(1750658945.520:192): avc: denied { ioctl } for pid=439 comm="syz.2.39" path="socket:[5238]" dev="sockfs" ino=5238 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 31.177347][ T45] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 31.247282][ T10] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 31.264360][ T450] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 31.264502][ T450] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 31.337276][ T45] usb 1-1: Using ep0 maxpacket: 16 [ 31.351664][ T45] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1023 [ 31.370881][ T45] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 16 [ 31.373145][ T454] fuse: Unknown parameter '' [ 31.389351][ T10] usb 4-1: device descriptor read/64, error -71 [ 31.392560][ T45] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 31.405935][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 31.415480][ T45] usb 1-1: SerialNumber: syz [ 31.428026][ T443] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 31.436057][ T45] usb 1-1: bad CDC descriptors [ 31.477116][ T356] Bluetooth: hci0: Frame reassembly failed (-84) [ 31.627495][ T10] usb 4-1: device descriptor read/64, error -71 [ 31.642430][ T443] rust_binder: Failed to allocate buffer. len:4216, is_oneway:false [ 31.642842][ T9] usb 1-1: USB disconnect, device number 2 [ 31.867495][ T10] usb 4-1: new low-speed USB device number 3 using dummy_hcd [ 31.997843][ T10] usb 4-1: device descriptor read/64, error -71 [ 32.247284][ T10] usb 4-1: device descriptor read/64, error -71 [ 32.357448][ T10] usb usb4-port1: attempt power cycle [ 32.617277][ T45] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 32.707260][ T10] usb 4-1: new low-speed USB device number 4 using dummy_hcd [ 32.738359][ T10] usb 4-1: device descriptor read/8, error -71 [ 32.780241][ T45] usb 1-1: New USB device found, idVendor=093a, idProduct=2476, bcdDevice= d.5b [ 32.789390][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.798015][ T45] usb 1-1: Product: syz [ 32.802201][ T45] usb 1-1: Manufacturer: syz [ 32.806808][ T45] usb 1-1: SerialNumber: syz [ 32.868611][ T10] usb 4-1: device descriptor read/8, error -71 [ 33.018872][ T45] usb 1-1: USB disconnect, device number 3 [ 33.107313][ T10] usb 4-1: new low-speed USB device number 5 using dummy_hcd [ 33.128490][ T10] usb 4-1: device descriptor read/8, error -71 [ 33.258456][ T10] usb 4-1: device descriptor read/8, error -71 [ 33.367475][ T10] usb usb4-port1: unable to enumerate USB device [ 33.529637][ T510] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:49 [ 33.547454][ T462] Bluetooth: hci0: command 0x1003 tx timeout [ 33.548417][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 33.595665][ T515] overlay: filesystem on ./bus not supported as upperdir [ 33.604030][ T514] fuse: Bad value for 'fd' [ 33.777289][ T45] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 33.867560][ T31] usb 3-1: new low-speed USB device number 2 using dummy_hcd [ 33.884274][ T529] rust_binder: Write failure EFAULT in pid:18 [ 33.927282][ T45] usb 1-1: Using ep0 maxpacket: 16 [ 33.940263][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 33.959913][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 33.969879][ T45] usb 1-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 33.979242][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.988300][ T45] usb 1-1: config 0 descriptor?? [ 33.998134][ T538] xt_NFQUEUE: number of total queues is 0 [ 34.030539][ T542] 9pnet_fd: Insufficient options for proto=fd [ 34.041511][ T31] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 34.051140][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.061572][ T31] usb 3-1: config 0 descriptor?? [ 34.217323][ T305] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 34.378770][ T305] usb 4-1: config 0 has an invalid interface number: 235 but max is 0 [ 34.388460][ T305] usb 4-1: config 0 has no interface number 0 [ 34.396847][ T305] usb 4-1: config 0 interface 235 altsetting 8 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 34.408369][ T305] usb 4-1: config 0 interface 235 has no altsetting 0 [ 34.418707][ T305] usb 4-1: New USB device found, idVendor=0738, idProduct=4540, bcdDevice=d8.f5 [ 34.428229][ T305] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.437170][ T305] usb 4-1: Product: syz [ 34.442755][ T305] usb 4-1: Manufacturer: syz [ 34.448203][ T305] usb 4-1: SerialNumber: syz [ 34.455234][ T305] usb 4-1: config 0 descriptor?? [ 34.475033][ T45] usbhid 1-1:0.0: can't add hid device: -71 [ 34.489731][ T45] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 34.502962][ T45] usb 1-1: USB disconnect, device number 4 [ 34.672337][ T305] usb 4-1: USB disconnect, device number 6 [ 35.050842][ T574] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:55 [ 35.080431][ T521] fuse: Unknown parameter '' [ 35.098955][ T31] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 35.109531][ T31] asix 3-1:0.0: probe with driver asix failed with error -71 [ 35.118228][ T31] usb 3-1: USB disconnect, device number 2 [ 35.212917][ T583] rust_binder: Write failure EINVAL in pid:63 [ 35.430416][ T593] overlayfs: failed to resolve './file0': -2 [ 35.526851][ T602] syzkaller0: entered promiscuous mode [ 35.532665][ T602] syzkaller0: entered allmulticast mode [ 35.595742][ T602] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:39 [ 35.616641][ T606] 9pnet_fd: Insufficient options for proto=fd [ 35.870600][ T36] kauditd_printk_skb: 33 callbacks suppressed [ 35.870617][ T36] audit: type=1400 audit(1750658950.350:226): avc: denied { getopt } for pid=614 comm="syz.3.98" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 35.897391][ T311] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 36.014833][ T36] audit: type=1400 audit(1750658950.490:227): avc: denied { getopt } for pid=621 comm="syz.0.100" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 36.058386][ T311] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.069424][ T311] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.081804][ T627] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 36.090593][ T311] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 36.103886][ T627] overlayfs: missing 'lowerdir' [ 36.110397][ T311] usb 3-1: New USB device found, idVendor=056a, idProduct=c5f0, bcdDevice= 0.00 [ 36.126024][ T311] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.140100][ T311] usb 3-1: config 0 descriptor?? [ 36.149780][ T629] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 36.212062][ T633] 9pnet_fd: Insufficient options for proto=fd [ 36.277119][ T638] netlink: 4 bytes leftover after parsing attributes in process `syz.0.106'. [ 36.289041][ T36] audit: type=1400 audit(1750658950.770:228): avc: denied { ioctl } for pid=637 comm="syz.0.106" path="socket:[4954]" dev="sockfs" ino=4954 ioctlcmd=0x52d3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 36.547971][ T311] wacom 0003:056A:C5F0.0001: unknown main item tag 0x0 [ 36.555242][ T311] wacom 0003:056A:C5F0.0001: Unknown device_type for 'HID 056a:c5f0'. Ignoring. [ 36.682452][ T36] audit: type=1400 audit(1750658951.160:229): avc: denied { create } for pid=663 comm="syz.3.114" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 36.749224][ T311] usb 3-1: USB disconnect, device number 3 [ 36.967260][ T10] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 37.006774][ T36] audit: type=1400 audit(1750658951.480:230): avc: denied { ioctl } for pid=675 comm="syz.0.119" path="socket:[5983]" dev="sockfs" ino=5983 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 37.031312][ T36] audit: type=1400 audit(1750658951.480:231): avc: denied { connect } for pid=675 comm="syz.0.119" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 37.050644][ T36] audit: type=1400 audit(1750658951.480:232): avc: denied { write } for pid=675 comm="syz.0.119" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 37.089487][ T36] audit: type=1400 audit(1750658951.570:233): avc: denied { read } for pid=677 comm="syz.0.120" path="socket:[6055]" dev="sockfs" ino=6055 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 37.127276][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 37.133489][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.149521][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 37.164213][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 37.174197][ T10] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 37.183492][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.193837][ T10] hub 4-1:1.0: bad descriptor, ignoring hub [ 37.200619][ T10] hub 4-1:1.0: probe with driver hub failed with error -5 [ 37.208200][ T10] cdc_wdm 4-1:1.0: skipping garbage [ 37.213530][ T10] cdc_wdm 4-1:1.0: skipping garbage [ 37.219326][ T10] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 37.266112][ T36] audit: type=1400 audit(1750658951.740:234): avc: denied { bind } for pid=701 comm="syz.1.128" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 37.377291][ T45] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 37.420960][ T36] audit: type=1326 audit(1750658951.900:235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=668 comm="syz.3.116" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f298418e929 code=0x0 [ 37.517784][ T727] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 37.522129][ T725] process 'syz.1.136' launched '/dev/fd/4' with NULL argv: empty string added [ 37.537325][ T45] usb 1-1: Using ep0 maxpacket: 32 [ 37.544463][ T45] usb 1-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 37.564676][ T45] usb 1-1: config 0 interface 0 has no altsetting 0 [ 37.571537][ T45] usb 1-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 37.580940][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.594443][ T45] usb 1-1: config 0 descriptor?? [ 37.781433][ T31] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 37.968495][ T31] usb 3-1: config 1 has an invalid interface association descriptor of length 3, skipping [ 37.978883][ T31] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.989477][ T31] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 38.003625][ T31] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice=26.40 [ 38.013381][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 38.024241][ T31] usb 3-1: SerialNumber: syz [ 38.087289][ T45] hid-picolcd 0003:04D8:F002.0002: No report with id 0xf3 found [ 38.103447][ T45] hid-picolcd 0003:04D8:F002.0002: No report with id 0xf4 found [ 38.224111][ T678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 38.232937][ T678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 38.249042][ T45] usb 1-1: USB disconnect, device number 5 [ 38.261135][ T730] batadv_slave_0: entered promiscuous mode [ 38.281889][ T730] rust_binder: Write failure EFAULT in pid:82 [ 38.284404][ T729] batadv_slave_0: left promiscuous mode [ 38.313766][ T31] usb 3-1: USB disconnect, device number 4 [ 39.525226][ T765] capability: warning: `syz.2.148' uses deprecated v2 capabilities in a way that may be insecure [ 39.576753][ T31] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 39.603412][ T31] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 39.829406][ T788] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 39.830270][ T788] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION already set [ 39.852162][ T788] rust_binder: Write failure EINVAL in pid:105 [ 39.869606][ T792] binder: Unknown parameter ')iats' [ 39.897341][ T10] usb 4-1: USB disconnect, device number 7 [ 40.147274][ T45] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 40.957312][ T10] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 41.109980][ T10] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 41.119227][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.127547][ T10] usb 1-1: Product: syz [ 41.131939][ T10] usb 1-1: Manufacturer: syz [ 41.136624][ T10] usb 1-1: SerialNumber: syz [ 41.224898][ T45] usb 3-1: device descriptor read/64, error -71 [ 41.346877][ T831] 9pnet_fd: Insufficient options for proto=fd [ 41.354238][ T831] overlay: ./bus is not a directory [ 41.477255][ T45] usb 3-1: device descriptor read/64, error -71 [ 41.727289][ T45] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 41.857275][ T45] usb 3-1: device descriptor read/64, error -71 [ 42.009960][ T868] overlayfs: missing 'lowerdir' [ 42.015838][ T869] overlayfs: failed to clone lowerpath [ 42.040439][ T873] netlink: 8 bytes leftover after parsing attributes in process `syz.1.188'. [ 42.078557][ T36] kauditd_printk_skb: 9 callbacks suppressed [ 42.078575][ T36] audit: type=1400 audit(1750658956.560:245): avc: denied { mount } for pid=879 comm="syz.1.190" name="/" dev="ramfs" ino=6455 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 42.106835][ T45] usb 3-1: device descriptor read/64, error -71 [ 42.152011][ T36] audit: type=1400 audit(1750658956.630:246): avc: denied { write } for pid=887 comm="syz.3.193" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 42.217358][ T45] usb usb3-port1: attempt power cycle [ 42.315448][ T36] audit: type=1400 audit(1750658956.790:247): avc: denied { create } for pid=892 comm="syz.3.195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 42.335413][ T36] audit: type=1400 audit(1750658956.790:248): avc: denied { ioctl } for pid=892 comm="syz.3.195" path="socket:[6480]" dev="sockfs" ino=6480 ioctlcmd=0x943c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 42.387559][ T899] rust_binder: Error while translating object. [ 42.387590][ T899] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 42.393782][ T899] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:106 [ 42.421212][ T36] audit: type=1400 audit(1750658956.900:249): avc: denied { read } for pid=94 comm="acpid" name="mouse4" dev="devtmpfs" ino=458 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 42.453911][ T36] audit: type=1400 audit(1750658956.900:250): avc: denied { open } for pid=94 comm="acpid" path="/dev/input/mouse4" dev="devtmpfs" ino=458 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 42.478146][ T36] audit: type=1400 audit(1750658956.900:251): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/mouse4" dev="devtmpfs" ino=458 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 42.551690][ T903] ======================================================= [ 42.551690][ T903] WARNING: The mand mount option has been deprecated and [ 42.551690][ T903] and is ignored by this kernel. Remove the mand [ 42.551690][ T903] option from the mount to silence this warning. [ 42.551690][ T903] ======================================================= [ 42.586627][ T45] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 42.602332][ T36] audit: type=1400 audit(1750658957.080:252): avc: denied { create } for pid=904 comm="syz.3.200" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 42.621687][ T36] audit: type=1400 audit(1750658957.080:253): avc: denied { read } for pid=904 comm="syz.3.200" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 42.623556][ T45] usb 3-1: device descriptor read/8, error -71 [ 42.701206][ T36] audit: type=1400 audit(1750658957.180:254): avc: denied { nlmsg_tty_audit } for pid=918 comm="syz.1.204" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 42.779026][ T45] usb 3-1: device descriptor read/8, error -71 [ 43.243395][ T944] rust_binder: Write failure EINVAL in pid:128 [ 43.316473][ T963] overlayfs: failed to clone upperpath [ 43.332714][ T964] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 43.333177][ T965] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 43.441225][ T978] overlayfs: failed to clone upperpath [ 43.699058][ T1017] SELinux: failed to load policy [ 43.814934][ T10] usb 1-1: USB disconnect, device number 6 [ 43.841454][ T1030] binder: Unknown parameter 'coyBLV"i5ntext' [ 44.380751][ T1084] overlayfs: missing 'lowerdir' [ 44.462199][ T1094] rust_binder: Write failure EINVAL in pid:164 [ 44.887770][ T1110] fuse: Bad value for 'max_read' [ 45.026373][ T1122] rust_binder: Error while translating object. [ 45.026409][ T1122] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 45.032718][ T1122] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:176 [ 45.157286][ T31] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 45.320143][ T31] usb 1-1: config 1 interface 0 altsetting 251 bulk endpoint 0x82 has invalid maxpacket 8 [ 45.331698][ T31] usb 1-1: config 1 interface 0 altsetting 251 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 45.346945][ T31] usb 1-1: config 1 interface 0 has no altsetting 0 [ 45.355828][ T31] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 45.365203][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.373265][ T31] usb 1-1: Product: ј [ 45.379883][ T31] usb 1-1: Manufacturer: э [ 45.384905][ T31] usb 1-1: SerialNumber: 䄭ᔛꭅ긺簦㍂脠譆걸댂쵳黦Ꝁ눗펑꾌稆郛鮗ꖔ츱쌤镚崥㔄뺏潷 [ 45.385978][ T1141] random: crng reseeded on system resumption [ 45.404185][ T311] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 45.412197][ T1115] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 45.419867][ T1115] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 45.489649][ T1142] netlink: 20 bytes leftover after parsing attributes in process `syz.3.277'. [ 45.499512][ T1142] tmpfs: Unknown parameter 'inode3!' [ 45.557325][ T311] usb 3-1: device descriptor read/64, error -71 [ 45.797308][ T311] usb 3-1: device descriptor read/64, error -71 [ 45.831724][ T1115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.840368][ T1115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.849282][ T1115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.858327][ T1115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.037422][ T311] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 46.067474][ T1115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.076068][ T1115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.085380][ T31] usb 1-1: bad CDC descriptors [ 46.091687][ T31] usb 1-1: USB disconnect, device number 7 [ 46.177325][ T311] usb 3-1: device descriptor read/64, error -71 [ 46.257418][ T1157] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 46.257437][ T1157] rust_binder: Read failure Err(EFAULT) in pid:196 [ 46.265977][ T1157] rust_binder: Write failure EINVAL in pid:196 [ 46.301937][ T1162] Invalid logical block size (4100) [ 46.417277][ T311] usb 3-1: device descriptor read/64, error -71 [ 46.527405][ T311] usb usb3-port1: attempt power cycle [ 46.660179][ T1183] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:120 [ 46.660307][ T1178] rust_binder: Failed to allocate buffer. len:8, is_oneway:true [ 46.670050][ T1178] rust_binder: Failure in copy_transaction_data: BR_DEAD_REPLY [ 46.678217][ T1178] rust_binder: Failure BR_DEAD_REPLY during reply - delivering BR_FAILED_REPLY to sender. [ 46.686899][ T1183] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.876090][ T1207] rust_binder: Write failure EINVAL in pid:136 [ 46.877311][ T311] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 46.882703][ T1206] rust_binder: Write failure EINVAL in pid:136 [ 46.923470][ T311] usb 3-1: device descriptor read/8, error -71 [ 47.058314][ T311] usb 3-1: device descriptor read/8, error -71 [ 47.077270][ T31] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 47.230584][ T31] usb 4-1: New USB device found, idVendor=6189, idProduct=182d, bcdDevice= 1.73 [ 47.240378][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.248909][ T31] usb 4-1: Product: syz [ 47.253562][ T31] usb 4-1: Manufacturer: syz [ 47.258747][ T31] usb 4-1: SerialNumber: syz [ 47.264270][ T31] usb 4-1: config 0 descriptor?? [ 47.297469][ T311] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 47.318809][ T311] usb 3-1: device descriptor read/8, error -71 [ 47.337278][ T45] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 47.448628][ T311] usb 3-1: device descriptor read/8, error -71 [ 47.490733][ T45] usb 1-1: New USB device found, idVendor=0b95, idProduct=772b, bcdDevice=a2.4c [ 47.500095][ T45] usb 1-1: New USB device strings: Mfr=24, Product=2, SerialNumber=3 [ 47.508438][ T45] usb 1-1: Product: syz [ 47.512835][ T45] usb 1-1: Manufacturer: syz [ 47.517766][ T45] usb 1-1: SerialNumber: syz [ 47.523428][ T45] usb 1-1: config 0 descriptor?? [ 47.557414][ T311] usb usb3-port1: unable to enumerate USB device [ 47.806020][ T1237] netlink: 220 bytes leftover after parsing attributes in process `syz.1.312'. [ 47.832372][ T36] kauditd_printk_skb: 27 callbacks suppressed [ 47.832391][ T36] audit: type=1400 audit(1750658962.310:282): avc: denied { accept } for pid=1238 comm="syz.1.313" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 47.962195][ T36] audit: type=1400 audit(1750658962.440:283): avc: denied { map } for pid=1248 comm="syz.1.317" path="socket:[8638]" dev="sockfs" ino=8638 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 47.988144][ T36] audit: type=1400 audit(1750658962.440:284): avc: denied { read } for pid=1248 comm="syz.1.317" path="socket:[8638]" dev="sockfs" ino=8638 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 48.141186][ T45] asix 1-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 48.313697][ T36] audit: type=1400 audit(1750658962.790:285): avc: denied { bind } for pid=1252 comm="syz.2.319" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 48.380777][ T45] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 48.403018][ T45] asix 1-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 48.415245][ T45] asix 1-1:0.0: probe with driver asix failed with error -71 [ 48.425085][ T45] usb 1-1: USB disconnect, device number 8 [ 48.504319][ T1261] af_packet: tpacket_rcv: packet too big, clamped from 1 to 4294967272. macoff=96 [ 48.533071][ T36] audit: type=1326 audit(1750658963.010:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1262 comm="syz.1.322" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe25618e929 code=0x0 [ 48.895465][ T1266] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.895496][ T1266] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.915779][ T36] audit: type=1400 audit(1750658963.390:287): avc: denied { create } for pid=1270 comm="syz.0.324" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmsvc_socket permissive=1 [ 48.917704][ T1272] rust_binder: Write failure EFAULT in pid:154 [ 48.957554][ T1275] netlink: 468 bytes leftover after parsing attributes in process `syz.0.325'. [ 49.100611][ T1287] rust_binder: Write failure EFAULT in pid:165 [ 49.117807][ T36] audit: type=1400 audit(1750658963.600:288): avc: denied { bind } for pid=1288 comm="syz.0.329" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 49.144921][ T36] audit: type=1400 audit(1750658963.600:289): avc: denied { name_bind } for pid=1288 comm="syz.0.329" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 49.165883][ T36] audit: type=1400 audit(1750658963.600:290): avc: denied { node_bind } for pid=1288 comm="syz.0.329" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 49.277319][ T10] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 49.417433][ T10] usb 3-1: device descriptor read/64, error -71 [ 49.438522][ T36] audit: type=1400 audit(1750658963.920:291): avc: denied { block_suspend } for pid=1296 comm="syz.1.331" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 49.497249][ T45] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 49.647360][ T45] usb 1-1: Using ep0 maxpacket: 32 [ 49.654613][ T45] usb 1-1: config 4 has an invalid interface number: 25 but max is 0 [ 49.662987][ T45] usb 1-1: config 4 contains an unexpected descriptor of type 0x2, skipping [ 49.667282][ T10] usb 3-1: device descriptor read/64, error -71 [ 49.671916][ T45] usb 1-1: config 4 contains an unexpected descriptor of type 0x1, skipping [ 49.686847][ T45] usb 1-1: config 4 contains an unexpected descriptor of type 0x2, skipping [ 49.695669][ T45] usb 1-1: config 4 has no interface number 0 [ 49.701904][ T45] usb 1-1: config 4 interface 25 altsetting 7 has a duplicate endpoint with address 0x4, skipping [ 49.712572][ T45] usb 1-1: config 4 interface 25 altsetting 7 has a duplicate endpoint with address 0x2, skipping [ 49.723476][ T45] usb 1-1: config 4 interface 25 altsetting 7 endpoint 0xE has invalid maxpacket 1023, setting to 64 [ 49.734381][ T45] usb 1-1: config 4 interface 25 altsetting 7 has a duplicate endpoint with address 0xE, skipping [ 49.745022][ T45] usb 1-1: config 4 interface 25 altsetting 7 has a duplicate endpoint with address 0x2, skipping [ 49.756035][ T45] usb 1-1: config 4 interface 25 altsetting 7 has a duplicate endpoint with address 0xE, skipping [ 49.767426][ T45] usb 1-1: config 4 interface 25 altsetting 7 has a duplicate endpoint with address 0x7, skipping [ 49.778161][ T45] usb 1-1: config 4 interface 25 altsetting 7 bulk endpoint 0xC has invalid maxpacket 72 [ 49.788202][ T45] usb 1-1: config 4 interface 25 has no altsetting 0 [ 49.796593][ T45] usb 1-1: Dual-Role OTG device on HNP port [ 49.802929][ T45] usb 1-1: New USB device found, idVendor=110a, idProduct=1150, bcdDevice=a4.48 [ 49.812199][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.820235][ T45] usb 1-1: Product: ᰉ [ 49.824439][ T45] usb 1-1: Manufacturer: 煾钊䃍ဋ椃磤譝㽈᠖疸ﴕ䏠藝陕幉␫쮼⣾졘뢽ꬮ [ 49.834835][ T45] usb 1-1: SerialNumber: 䑔኿ឲ聬줤슩駶ᷲ숙╸曈챘壍젹뉋྆黔ౝ툋᝿駈웃㪟ﺿ樒ᾼ鞎䘅픐硇ᣛ㕗辡桀䉞瞲牙㠐녟乇⢹됸ﭧފ歟旸珵颏蛩킖᎒填五渿㧐뗀ਫ琺䬚젡⏳姤䰗㰺Ꮾ瀉儼돚 [ 49.840237][ T1204] overlayfs: statfs failed on './file0' [ 49.867781][ T1295] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 49.875181][ T1295] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 49.917291][ T10] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 49.930243][ T31] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 49.942369][ T31] asix 4-1:0.0: probe with driver asix failed with error -71 [ 49.951262][ T31] usb 4-1: USB disconnect, device number 8 [ 50.057325][ T10] usb 3-1: device descriptor read/64, error -71 [ 50.095540][ T1294] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.105636][ T1294] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.120129][ T45] usb 1-1: USB disconnect, device number 9 [ 50.297375][ T10] usb 3-1: device descriptor read/64, error -71 [ 50.297375][ T31] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 50.417457][ T10] usb usb3-port1: attempt power cycle [ 50.447324][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 50.454027][ T31] usb 4-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 50.465005][ T31] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 50.477950][ T31] usb 4-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 50.486992][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 50.496338][ T31] usb 4-1: config 0 descriptor?? [ 50.502692][ T31] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 50.557310][ T45] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 50.707601][ T45] usb 1-1: Using ep0 maxpacket: 8 [ 50.713991][ T45] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 50.715275][ T311] usb 4-1: USB disconnect, device number 9 [ 50.724411][ T45] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 50.741225][ T45] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 50.757829][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.757883][ T10] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 50.766243][ T45] usb 1-1: Product: 瑼ꕵᠺ뼆㹳蕡皨꿌蛇姵÷㍙꠆䅀莓甧솤B絋騕滝ՙ虝ꛞ [ 50.775088][ T1310] rust_binder: Write failure EINVAL in pid:236 [ 50.785370][ T45] usb 1-1: Manufacturer: 壨轅鞶ﯧ誯繜⏭儶쓕訚᣼㸉쯅蝦덬⨸䓮쳳砃螗嶳䝧托䯢妑榺ꢶ⥖囍鱤䷳担硛⴩䊔ꂂ钫쥆云乩綹ꑖ璄麽ꥻ퍙襔๰ꮌ侠굧攟磵ꍋ㝛掤䤛 [ 50.821735][ T45] usb 1-1: SerialNumber: syz [ 50.831543][ T10] usb 3-1: device descriptor read/8, error -71 [ 50.841322][ T1314] fuse: Unknown parameter 'V ' [ 50.979867][ T10] usb 3-1: device descriptor read/8, error -71 [ 51.030736][ T1294] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.040500][ T1294] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.053389][ T45] usb 1-1: 0:2 : does not exist [ 51.068606][ T45] usb 1-1: USB disconnect, device number 10 [ 51.157310][ T311] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 51.227308][ T10] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 51.238129][ T441] udevd[441]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 51.258345][ T10] usb 3-1: device descriptor read/8, error -71 [ 51.297301][ T311] usb 4-1: device descriptor read/64, error -71 [ 51.389441][ T10] usb 3-1: device descriptor read/8, error -71 [ 51.497534][ T10] usb usb3-port1: unable to enumerate USB device [ 51.537394][ T311] usb 4-1: device descriptor read/64, error -71 [ 51.582581][ T1352] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 51.787304][ T311] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 51.854153][ T1380] overlayfs: failed to clone upperpath [ 51.917296][ T311] usb 4-1: device descriptor read/64, error -71 [ 51.967312][ T45] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 52.079426][ T1394] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2368351425 (9473405700 ns) > initial count (5598461268 ns). Using initial count to start timer. [ 52.118355][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 52.137244][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 52.155192][ T45] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 52.169639][ T45] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 52.177421][ T311] usb 4-1: device descriptor read/64, error -71 [ 52.207840][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 52.221811][ T45] usb 1-1: config 0 descriptor?? [ 52.297363][ T311] usb usb4-port1: attempt power cycle [ 52.648667][ T311] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 52.678272][ T311] usb 4-1: device descriptor read/8, error -71 [ 52.720073][ T45] usbhid 1-1:0.0: can't add hid device: -71 [ 52.727619][ T45] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 52.735656][ T556] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 52.750857][ T45] usb 1-1: USB disconnect, device number 11 [ 52.818290][ T311] usb 4-1: device descriptor read/8, error -71 [ 52.897240][ T556] usb 3-1: Using ep0 maxpacket: 16 [ 52.907338][ T556] usb 3-1: config 1 has an invalid interface number: 4 but max is 2 [ 52.915915][ T556] usb 3-1: config 1 has no interface number 1 [ 52.922507][ T556] usb 3-1: too many endpoints for config 1 interface 4 altsetting 0: 249, using maximum allowed: 30 [ 52.935075][ T556] usb 3-1: config 1 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 249 [ 52.954015][ T556] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 52.965042][ T556] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.979128][ T556] usb 3-1: Product: syz [ 52.983786][ T556] usb 3-1: Manufacturer: syz [ 52.992067][ T556] usb 3-1: SerialNumber: syz [ 53.014044][ T1439] tipc: Can't bind to reserved service type 0 [ 53.033153][ T1441] syz.1.379 uses obsolete (PF_INET,SOCK_PACKET) [ 53.077556][ T311] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 53.103585][ T311] usb 4-1: device descriptor read/8, error -71 [ 53.117296][ T1451] sock: sock_timestamping_bind_phc: sock not bind to device [ 53.206705][ T1427] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.217176][ T1427] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 53.241714][ T311] usb 4-1: device descriptor read/8, error -71 [ 53.266088][ T1464] incfs: Backing dir is not set, filesystem can't be mounted. [ 53.274755][ T36] kauditd_printk_skb: 13 callbacks suppressed [ 53.274776][ T36] audit: type=1400 audit(1750658967.740:305): avc: denied { mounton } for pid=1463 comm="syz.0.386" path="/file0" dev="ramfs" ino=10174 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 53.305172][ T1464] incfs: mount failed -2 [ 53.367679][ T311] usb usb4-port1: unable to enumerate USB device [ 53.415009][ T1470] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.427402][ T1470] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 53.522235][ T1473] overlay: ./file0 is not a directory [ 53.694207][ T1498] rust_binder: Failed to allocate buffer. len:4232, is_oneway:false [ 53.865133][ T556] usb 3-1: 2:1 : no UAC_FORMAT_TYPE desc [ 53.902679][ T556] usb 3-1: USB disconnect, device number 17 [ 54.008131][ T1513] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:196 [ 54.018083][ T1513] rust_binder: Read failure Err(EFAULT) in pid:196 [ 54.088676][ T1517] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.098505][ T441] udevd[441]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 54.152683][ T1520] tipc: Started in network mode [ 54.167575][ T1520] tipc: Node identity 06000000000000006068, cluster identity 4711 [ 54.227268][ T45] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 54.282809][ T36] audit: type=1400 audit(1750658968.760:306): avc: denied { audit_read } for pid=1528 comm="syz.2.407" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 54.320682][ T1534] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 54.332518][ T1533] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 54.350014][ T1534] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 54.398293][ T45] usb 1-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 54.409727][ T45] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 2 [ 54.428845][ T45] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 54.439345][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.458412][ T1542] random: crng reseeded on system resumption [ 54.477247][ T45] usb 1-1: Product: syz [ 54.481699][ T45] usb 1-1: Manufacturer: syz [ 54.487315][ T45] usb 1-1: SerialNumber: syz [ 54.612844][ T1549] SELinux: failed to load policy [ 54.723859][ T36] audit: type=1400 audit(1750658969.200:307): avc: denied { checkpoint_restore } for pid=1552 comm="syz.1.414" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 55.027303][ T311] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 55.057329][ T45] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 55.177329][ T311] usb 3-1: Using ep0 maxpacket: 16 [ 55.183880][ T311] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 55.195435][ T311] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 55.205970][ T311] usb 3-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 55.215070][ T311] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.223865][ T311] usb 3-1: config 0 descriptor?? [ 55.228521][ T45] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 55.239806][ T45] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 55.249860][ T45] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1023 [ 55.262850][ T45] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 55.272458][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.280639][ T45] usb 4-1: Product: syz [ 55.285072][ T45] usb 4-1: Manufacturer: syz [ 55.289931][ T45] usb 4-1: SerialNumber: syz [ 55.404962][ T31] usb 1-1: USB disconnect, device number 12 [ 55.448493][ T1590] SELinux: security_context_str_to_sid () failed with errno=-22 [ 55.588058][ T36] audit: type=1400 audit(1750658970.070:308): avc: denied { map } for pid=1606 comm="syz.1.435" path="socket:[11653]" dev="sockfs" ino=11653 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 55.676726][ T311] usbhid 3-1:0.0: can't add hid device: -71 [ 55.684449][ T311] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 55.694074][ T311] usb 3-1: USB disconnect, device number 18 [ 55.700985][ T1566] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 55.911958][ T1566] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.921970][ T36] audit: type=1400 audit(1750658970.390:309): avc: denied { audit_write } for pid=1565 comm="syz.3.419" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 55.928452][ T1566] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.956612][ T45] cdc_ncm 4-1:1.0: bind() failure [ 55.963017][ T45] cdc_ncm 4-1:1.1: probe with driver cdc_ncm failed with error -71 [ 55.972340][ T45] cdc_mbim 4-1:1.1: probe with driver cdc_mbim failed with error -71 [ 55.984203][ T45] usb 4-1: USB disconnect, device number 14 [ 56.024523][ T36] audit: type=1400 audit(1750658970.500:310): avc: denied { read append } for pid=1609 comm="syz.0.436" name="loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 56.050065][ T36] audit: type=1400 audit(1750658970.500:311): avc: denied { open } for pid=1609 comm="syz.0.436" path="/dev/loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 56.413741][ T1640] netlink: 28 bytes leftover after parsing attributes in process `syz.1.446'. [ 56.426672][ T1640] fuse: Bad value for 'group_id' [ 56.440135][ T1640] fuse: Bad value for 'group_id' [ 56.496404][ T36] audit: type=1400 audit(1750658970.970:312): avc: granted { setsecparam } for pid=1642 comm="syz.3.447" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security [ 56.533531][ T45] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 56.677798][ T36] audit: type=1326 audit(1750658971.160:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1644 comm="syz.3.448" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f298418e929 code=0x0 [ 56.703501][ T36] audit: type=1326 audit(1750658971.160:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1644 comm="syz.3.448" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f298418e929 code=0x0 [ 56.733426][ T45] usb 1-1: Using ep0 maxpacket: 16 [ 56.740261][ T45] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 56.749831][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 56.766104][ T45] usb 1-1: config 0 descriptor?? [ 56.778635][ T45] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 56.862508][ T1655] syz.1.450 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 56.873656][ T1657] rust_binder: Failed to allocate buffer. len:128, is_oneway:false [ 56.917724][ T1656] fuse: Bad value for 'fd' [ 56.979089][ T45] usb 1-1: Detected FT232B [ 57.025763][ T1659] SELinux: failed to load policy [ 57.040215][ T1659] rust_binder: Error in use_page_slow: ESRCH [ 57.040243][ T1659] rust_binder: use_range failure ESRCH [ 57.047007][ T1659] rust_binder: Failed to allocate buffer. len:128, is_oneway:false [ 57.062878][ T1659] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 57.077282][ T1659] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:261 [ 57.380223][ T45] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 57.581805][ T10] usb 1-1: USB disconnect, device number 13 [ 57.591739][ T10] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 57.608848][ T10] ftdi_sio 1-1:0.0: device disconnected [ 57.625542][ T1682] overlayfs: failed to clone upperpath [ 57.909689][ T1693] incfs: Options parsing error. -22 [ 57.915578][ T1693] incfs: mount failed -22 [ 57.940293][ T1696] macsec0: entered allmulticast mode [ 57.945778][ T1696] veth1_macvtap: entered allmulticast mode [ 58.277278][ T10] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 58.357276][ T305] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 58.417385][ T45] usb 1-1: new low-speed USB device number 14 using dummy_hcd [ 58.437273][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 58.444464][ T10] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 58.454261][ T10] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 58.466031][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 58.479467][ T10] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 58.489401][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.497803][ T10] usb 4-1: Product: syz [ 58.503832][ T10] usb 4-1: Manufacturer: syz [ 58.509538][ T10] usb 4-1: SerialNumber: syz [ 58.517253][ T305] usb 3-1: Using ep0 maxpacket: 8 [ 58.525649][ T305] usb 3-1: unable to get BOS descriptor or descriptor too short [ 58.537636][ T305] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 58.549071][ T305] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 58.559498][ T45] usb 1-1: device descriptor read/64, error -71 [ 58.566568][ T305] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 58.582582][ T305] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 58.591877][ T305] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.599938][ T305] usb 3-1: Product: syz [ 58.604465][ T305] usb 3-1: Manufacturer: syz [ 58.609408][ T305] usb 3-1: SerialNumber: syz [ 58.719435][ T10] usb 4-1: 0:2 : does not exist [ 58.726158][ T10] usb 4-1: USB disconnect, device number 15 [ 58.797267][ T45] usb 1-1: device descriptor read/64, error -71 [ 58.887788][ T441] udevd[441]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 58.912954][ T305] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 58.921975][ T305] cdc_ncm 3-1:1.0: bind() failure [ 58.930975][ T305] usb 3-1: USB disconnect, device number 19 [ 59.047336][ T45] usb 1-1: new low-speed USB device number 15 using dummy_hcd [ 59.177316][ T45] usb 1-1: device descriptor read/64, error -71 [ 59.328887][ T355] Bluetooth: hci0: Frame reassembly failed (-84) [ 59.417296][ T45] usb 1-1: device descriptor read/64, error -71 [ 59.527373][ T45] usb usb1-port1: attempt power cycle [ 59.757290][ T10] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 59.877268][ T45] usb 1-1: new low-speed USB device number 16 using dummy_hcd [ 59.898546][ T45] usb 1-1: device descriptor read/8, error -71 [ 59.908601][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 59.919670][ T10] usb 3-1: New USB device found, idVendor=054c, idProduct=0ba0, bcdDevice= 0.00 [ 59.921426][ T1764] tipc: Enabling of bearer rejected, failed to enable media [ 59.929001][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 59.946611][ T10] usb 3-1: config 0 descriptor?? [ 60.028673][ T45] usb 1-1: device descriptor read/8, error -71 [ 60.267297][ T45] usb 1-1: new low-speed USB device number 17 using dummy_hcd [ 60.288425][ T45] usb 1-1: device descriptor read/8, error -71 [ 60.354465][ T10] playstation 0003:054C:0BA0.0004: hidraw0: USB HID v0.00 Device [HID 054c:0ba0] on usb-dummy_hcd.2-1/input0 [ 60.418557][ T45] usb 1-1: device descriptor read/8, error -71 [ 60.527406][ T45] usb usb1-port1: unable to enumerate USB device [ 60.553399][ T10] playstation 0003:054C:0BA0.0004: Invalid reportID received, expected 18 got 203 [ 60.563020][ T10] playstation 0003:054C:0BA0.0004: Failed to retrieve DualShock4 pairing info: -22 [ 60.572888][ T10] playstation 0003:054C:0BA0.0004: Failed to get MAC address from DualShock4 [ 60.581809][ T10] playstation 0003:054C:0BA0.0004: Failed to create dualshock4. [ 60.591043][ T10] playstation 0003:054C:0BA0.0004: probe with driver playstation failed with error -22 [ 60.756282][ T9] usb 3-1: USB disconnect, device number 20 [ 61.200679][ T1776] tipc: MTU too low for tipc bearer [ 61.217667][ T1779] fuse: Bad value for 'user_id' [ 61.222597][ T1779] fuse: Bad value for 'user_id' [ 61.233123][ T36] kauditd_printk_skb: 6 callbacks suppressed [ 61.233141][ T36] audit: type=1400 audit(1750658978.716:321): avc: denied { nlmsg_read } for pid=1778 comm="syz.1.493" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 61.304673][ T36] audit: type=1400 audit(1750658978.786:322): avc: denied { create } for pid=1791 comm="syz.1.499" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 61.349259][ T1797] rust_binder: Error while translating object. [ 61.349295][ T1797] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 61.355543][ T1797] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:264 [ 61.387294][ T462] Bluetooth: hci0: command 0x1003 tx timeout [ 61.387347][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 61.413763][ T288] ------------[ cut here ]------------ [ 61.419327][ T288] WARNING: CPU: 1 PID: 288 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 61.427311][ T288] Modules linked in: [ 61.431230][ T288] CPU: 1 UID: 0 PID: 288 Comm: syz-executor Not tainted 6.12.23-syzkaller-gd9fd901baa98 #0 f1acc3ef52b3e732a05c4f7a2560722db90bb473 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=-1 (errno 104: Connection reset by peer) [ 61.445167][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 61.455389][ T288] RIP: 0010:drop_nlink+0xce/0x110 [ 61.457445][ T36] audit: type=1400 audit(1750658978.936:323): avc: denied { write } for pid=281 comm="syz-executor" path="pipe:[1538]" dev="pipefs" ino=1538 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 61.460600][ T288] Code: 04 00 00 be 08 00 00 00 e8 7f 56 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 e2 68 98 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 61.503817][ T288] RSP: 0018:ffffc9000b66fc60 EFLAGS: 00010293 [ 61.510003][ T288] RAX: ffffffff81ed146e RBX: ffff888134a04428 RCX: ffff88812320df00 [ 61.518146][ T288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 61.526329][ T288] RBP: ffffc9000b66fc88 R08: 0000000000000003 R09: 0000000000000004 [ 61.534571][ T288] R10: dffffc0000000000 R11: fffff520016cdf7c R12: dffffc0000000000 [ 61.542760][ T288] R13: 1ffff1102694088e R14: ffff888134a04470 R15: 0000000000000000 [ 61.550992][ T288] FS: 0000555573671500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 61.560059][ T288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 61.566687][ T288] CR2: 00005555736944e8 CR3: 00000001241b6000 CR4: 00000000003526b0 [ 61.574858][ T288] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 61.582910][ T288] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 61.590962][ T288] Call Trace: [ 61.594274][ T288] [ 61.597266][ T288] shmem_rmdir+0x5f/0x90 [ 61.601545][ T288] vfs_rmdir+0x3dd/0x560 [ 61.605996][ T288] incfs_kill_sb+0x109/0x230 [ 61.610680][ T288] deactivate_locked_super+0xd5/0x2a0 [ 61.616083][ T288] deactivate_super+0xb8/0xe0 [ 61.620841][ T288] cleanup_mnt+0x3f1/0x480 [ 61.625293][ T288] __cleanup_mnt+0x1d/0x40 [ 61.630097][ T288] task_work_run+0x1e0/0x250 [ 61.634730][ T288] ? __cfi_task_work_run+0x10/0x10 [ 61.640273][ T288] ? __x64_sys_umount+0x126/0x170 [ 61.645339][ T288] ? __cfi___x64_sys_umount+0x10/0x10 [ 61.650846][ T288] ? __kasan_check_read+0x15/0x20 [ 61.655985][ T288] resume_user_mode_work+0x36/0x50 [ 61.661258][ T288] syscall_exit_to_user_mode+0x64/0xb0 [ 61.666760][ T288] do_syscall_64+0x64/0xf0 [ 61.671251][ T288] ? clear_bhb_loop+0x35/0x90 [ 61.675965][ T288] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 61.682011][ T288] RIP: 0033:0x7fc1e1d8fc57 [ 61.686460][ T288] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 61.706569][ T288] RSP: 002b:00007ffd25dca028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 61.715072][ T288] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fc1e1d8fc57 [ 61.723112][ T288] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd25dca0e0 [ 61.731144][ T288] RBP: 00007ffd25dca0e0 R08: 0000000000000000 R09: 0000000000000000 [ 61.739164][ T288] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd25dcb170 [ 61.747586][ T288] R13: 00007fc1e1e10925 R14: 000000000000efc3 R15: 00007ffd25dcb1b0 [ 61.755600][ T288] [ 61.758805][ T288] ---[ end trace 0000000000000000 ]--- [ 61.764646][ T288] ================================================================== [ 61.772843][ T288] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 61.779139][ T288] Write of size 4 at addr 0000000000000168 by task syz-executor/288 [ 61.787150][ T288] [ 61.789504][ T288] CPU: 1 UID: 0 PID: 288 Comm: syz-executor Tainted: G W 6.12.23-syzkaller-gd9fd901baa98 #0 f1acc3ef52b3e732a05c4f7a2560722db90bb473 [ 61.789534][ T288] Tainted: [W]=WARN [ 61.789547][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 61.789558][ T288] Call Trace: [ 61.789564][ T288] [ 61.789572][ T288] __dump_stack+0x21/0x30 [ 61.789597][ T288] dump_stack_lvl+0x10c/0x190 [ 61.789616][ T288] ? __cfi_dump_stack_lvl+0x10/0x10 [ 61.789638][ T288] print_report+0x3d/0x70 [ 61.789653][ T288] kasan_report+0x163/0x1a0 [ 61.789677][ T288] ? ihold+0x24/0x70 [ 61.789700][ T288] ? _raw_spin_unlock+0x45/0x60 [ 61.789722][ T288] ? ihold+0x24/0x70 [ 61.789743][ T288] kasan_check_range+0x299/0x2a0 [ 61.789767][ T288] __kasan_check_write+0x18/0x20 [ 61.789786][ T288] ihold+0x24/0x70 [ 61.789809][ T288] vfs_rmdir+0x26a/0x560 [ 61.789824][ T288] incfs_kill_sb+0x109/0x230 [ 61.789843][ T288] deactivate_locked_super+0xd5/0x2a0 [ 61.789860][ T288] deactivate_super+0xb8/0xe0 [ 61.789876][ T288] cleanup_mnt+0x3f1/0x480 [ 61.789900][ T288] __cleanup_mnt+0x1d/0x40 [ 61.789921][ T288] task_work_run+0x1e0/0x250 [ 61.789938][ T288] ? __cfi_task_work_run+0x10/0x10 [ 61.789953][ T288] ? __x64_sys_umount+0x126/0x170 [ 61.789970][ T288] ? __cfi___x64_sys_umount+0x10/0x10 [ 61.789988][ T288] ? __kasan_check_read+0x15/0x20 [ 61.790007][ T288] resume_user_mode_work+0x36/0x50 [ 61.790023][ T288] syscall_exit_to_user_mode+0x64/0xb0 [ 61.790042][ T288] do_syscall_64+0x64/0xf0 [ 61.790063][ T288] ? clear_bhb_loop+0x35/0x90 [ 61.790089][ T288] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 61.790113][ T288] RIP: 0033:0x7fc1e1d8fc57 [ 61.790128][ T288] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 61.790142][ T288] RSP: 002b:00007ffd25dca028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 61.790161][ T288] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fc1e1d8fc57 [ 61.790172][ T288] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd25dca0e0 [ 61.790183][ T288] RBP: 00007ffd25dca0e0 R08: 0000000000000000 R09: 0000000000000000 [ 61.790194][ T288] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd25dcb170 [ 61.790206][ T288] R13: 00007fc1e1e10925 R14: 000000000000efc3 R15: 00007ffd25dcb1b0 [ 61.790221][ T288] [ 61.790227][ T288] ================================================================== [ 62.042751][ T288] Disabling lock debugging due to kernel taint [ 62.049879][ T288] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 62.057717][ T288] #PF: supervisor write access in kernel mode [ 62.063815][ T288] #PF: error_code(0x0002) - not-present page [ 62.069906][ T288] PGD 800000010c343067 P4D 800000010c343067 PUD 0 [ 62.076546][ T288] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 62.082744][ T288] CPU: 1 UID: 0 PID: 288 Comm: syz-executor Tainted: G B W 6.12.23-syzkaller-gd9fd901baa98 #0 f1acc3ef52b3e732a05c4f7a2560722db90bb473 [ 62.097822][ T288] Tainted: [B]=BAD_PAGE, [W]=WARN [ 62.102868][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 62.112972][ T288] RIP: 0010:ihold+0x2a/0x70 [ 62.117646][ T288] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 cd 5f 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 3c 4d ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 dd [ 62.137642][ T288] RSP: 0018:ffffc9000b66fca0 EFLAGS: 00010246 [ 62.143768][ T288] RAX: ffff88812320df00 RBX: 0000000000000000 RCX: ffff88812320df00 [ 62.151760][ T288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 62.159826][ T288] RBP: ffffc9000b66fcb0 R08: ffffffff88954947 R09: 1ffffffff112a928 [ 62.167814][ T288] R10: dffffc0000000000 R11: fffffbfff112a929 R12: ffff888134a04434 [ 62.176076][ T288] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 62.184231][ T288] FS: 0000555573671500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 62.193174][ T288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.199791][ T288] CR2: 0000000000000168 CR3: 00000001241b6000 CR4: 00000000003526b0 [ 62.207969][ T288] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 62.215962][ T288] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 62.224046][ T288] Call Trace: [ 62.227443][ T288] [ 62.230412][ T288] vfs_rmdir+0x26a/0x560 [ 62.234780][ T288] incfs_kill_sb+0x109/0x230 [ 62.239441][ T288] deactivate_locked_super+0xd5/0x2a0 [ 62.244848][ T288] deactivate_super+0xb8/0xe0 [ 62.249742][ T288] cleanup_mnt+0x3f1/0x480 [ 62.254188][ T288] __cleanup_mnt+0x1d/0x40 [ 62.259328][ T288] task_work_run+0x1e0/0x250 [ 62.263962][ T288] ? __cfi_task_work_run+0x10/0x10 [ 62.269105][ T288] ? __x64_sys_umount+0x126/0x170 [ 62.274148][ T288] ? __cfi___x64_sys_umount+0x10/0x10 [ 62.279542][ T288] ? __kasan_check_read+0x15/0x20 [ 62.284580][ T288] resume_user_mode_work+0x36/0x50 [ 62.289803][ T288] syscall_exit_to_user_mode+0x64/0xb0 [ 62.295287][ T288] do_syscall_64+0x64/0xf0 [ 62.299827][ T288] ? clear_bhb_loop+0x35/0x90 [ 62.304544][ T288] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 62.310550][ T288] RIP: 0033:0x7fc1e1d8fc57 [ 62.314977][ T288] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 62.334690][ T288] RSP: 002b:00007ffd25dca028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 62.343138][ T288] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fc1e1d8fc57 [ 62.351230][ T288] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd25dca0e0 [ 62.359428][ T288] RBP: 00007ffd25dca0e0 R08: 0000000000000000 R09: 0000000000000000 [ 62.367695][ T288] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd25dcb170 [ 62.375978][ T288] R13: 00007fc1e1e10925 R14: 000000000000efc3 R15: 00007ffd25dcb1b0 [ 62.384507][ T288] [ 62.387551][ T288] Modules linked in: [ 62.391641][ T288] CR2: 0000000000000168 [ 62.396417][ T288] ---[ end trace 0000000000000000 ]--- [ 62.402331][ T288] RIP: 0010:ihold+0x2a/0x70 [ 62.406994][ T288] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 cd 5f 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 3c 4d ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 dd [ 62.428578][ T288] RSP: 0018:ffffc9000b66fca0 EFLAGS: 00010246 [ 62.435981][ T288] RAX: ffff88812320df00 RBX: 0000000000000000 RCX: ffff88812320df00 [ 62.444154][ T288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 62.452241][ T288] RBP: ffffc9000b66fcb0 R08: ffffffff88954947 R09: 1ffffffff112a928 [ 62.460381][ T288] R10: dffffc0000000000 R11: fffffbfff112a929 R12: ffff888134a04434 [ 62.468591][ T288] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 62.478623][ T288] FS: 0000555573671500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 62.488091][ T288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.494795][ T288] CR2: 0000000000000168 CR3: 00000001241b6000 CR4: 00000000003526b0 [ 62.502796][ T288] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 62.510885][ T288] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 62.519059][ T288] Kernel panic - not syncing: Fatal exception [ 62.525646][ T288] Kernel Offset: disabled [ 62.530071][ T288] Rebooting in 86400 seconds..