last executing test programs: 11.302506047s ago: executing program 3 (id=553): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCGDEV(r0, 0x80045432, &(0x7f0000000140)) io_setup(0x3, &(0x7f0000000200)=0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) io_submit(r1, 0x5a, &(0x7f0000000a40)=[&(0x7f0000000840)={0x0, 0x0, 0x0, 0x3, 0x1, r2, 0x0, 0x52}]) r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x2d50, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x33, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xc, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) (async) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)={0x0, 0x4, 0x57, {0x57, 0x6, "a7ea3163fd3bc518194b120c1e73d54cfc4ad2841ef4f6a3fd7c59ccb785025f2e7b3504ff87cbfd10f3c080b733000000000000000800000000000000ea7a288982d5337c364daf03bd400d66293b0a2b103dd93f"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x0, 0x3032, 0xffffffffffffffff, 0x1263b000) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165342, 0x0) write(r4, &(0x7f0000000400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a4", 0x1f000) (async) write(r4, &(0x7f0000000400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a4", 0x1f000) 11.087731464s ago: executing program 1 (id=555): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x420040, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) (async) r1 = getpid() pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r4 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r5) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000980)={0x30, r6, 0x1, 0x3, 0x100000, {{}, {}, {0x14, 0x19, {0x3, 0x1, 0x1, 0x734}}}}, 0x30}, 0x1, 0x0, 0x0, 0x24008000}, 0x9084) r7 = openat$binfmt(0xffffffffffffff9c, r4, 0x41, 0x1ff) lseek(r7, 0xffffffffffffffff, 0x4) (async) write$P9_RGETLOCK(r3, &(0x7f00000002c0)=ANY=[], 0x200002e6) read$FUSE(r2, &(0x7f0000000500)={0x2020}, 0x2020) (async) fcntl$setpipe(r3, 0x407, 0x7000000) syz_open_procfs(r1, &(0x7f0000000000)='net/psched\x00') (async) r8 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_mreq(r8, 0x29, 0x13, 0x0, &(0x7f0000000280)) (async) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000000c0)={'syz1\x00', {0xe, 0x7, 0x7, 0x81}, 0x15, [0x10001, 0x40000, 0x4, 0xf, 0x639, 0x4, 0x4, 0x6, 0x10, 0x9, 0x80000100, 0xb, 0xb0f, 0x4, 0x6, 0x2, 0x4, 0x4cb6, 0x0, 0x1, 0xa, 0x7, 0x8, 0x3, 0x10, 0x4, 0xb2f2, 0xb, 0x0, 0x9, 0x2, 0x2d, 0x0, 0x8, 0x1, 0x0, 0x5743393a, 0x1, 0x2e, 0x8000, 0x2, 0x2, 0x8, 0xf, 0x10000, 0xfffffffe, 0x3, 0x101, 0xc, 0x6, 0xc601, 0xa, 0x1, 0x5, 0x5, 0x6, 0x5, 0x6, 0xfffff2e0, 0x4, 0x9, 0x8, 0x3, 0x100], [0x6, 0xc37, 0x7, 0x4, 0x5, 0x214, 0xd25, 0xf, 0x7, 0x7, 0x7, 0x8001, 0xfffffffb, 0x1, 0x4, 0x2, 0x9, 0x6, 0xcbdb, 0x6, 0x4, 0xfc, 0xe3, 0x11, 0xa39a, 0x8, 0x73, 0x2, 0x8, 0x3, 0xa, 0x40, 0x4, 0x4, 0x0, 0x0, 0x6, 0x8001, 0x7, 0xf075, 0x3, 0x7, 0x3, 0x7d1b, 0x5, 0x5, 0x6, 0x6, 0x2, 0x2, 0x8, 0x69e, 0x6, 0x8246, 0x9, 0xacf, 0xedb, 0xe771, 0x0, 0x10000, 0xe0f9, 0x4, 0xd314], [0x5, 0x6, 0x9, 0x6, 0x6, 0x800000, 0x2, 0x0, 0x0, 0x8, 0xffff, 0x401, 0x3, 0x7f, 0xfffffff2, 0x672, 0x5, 0x0, 0x3, 0x6, 0x81000000, 0x80000002, 0x6, 0x0, 0x2, 0x4, 0xf46, 0x3, 0x8, 0x3ff, 0x6, 0x0, 0x8001, 0x33, 0x5, 0x4, 0x6, 0x4, 0x1, 0x3ff, 0x80000001, 0x0, 0x2, 0x6, 0x20000000, 0x10001, 0x10001, 0x628e, 0x7, 0x2, 0x7, 0x7fffffff, 0xe, 0x1, 0xffffffff, 0xb, 0x46, 0xa5f, 0xfff, 0x2, 0x7, 0xf, 0x1, 0x3db1], [0x0, 0x3, 0x1, 0xfffffff8, 0x3, 0x7fff, 0x4, 0x12, 0x2, 0x4, 0x9, 0x2, 0x9, 0x2, 0x3fe, 0xd, 0x1, 0x401, 0x3, 0x7ff, 0x5, 0x4, 0x4, 0xd, 0x1, 0x8, 0x80000001, 0x7f97, 0x401, 0x80000000, 0xd191, 0xe, 0x3141, 0x200, 0x5, 0x80, 0xd4, 0x9, 0x0, 0x8000, 0x1, 0x0, 0x101, 0x6, 0x8, 0x24, 0x5, 0x9, 0xffffffff, 0x80000000, 0x5c6, 0x5, 0x1, 0x9, 0xf1, 0x81, 0x9, 0x4, 0x3, 0x4, 0x1f8c, 0xffffffff, 0x5, 0x8]}, 0x45c) (async) r9 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r9, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4e24, @remote}, 0x10, &(0x7f00000002c0), 0x1, 0x0, 0x0, 0x60000000}, 0x20000004) (async) r10 = syz_pidfd_open(r1, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fd={0x66642a85, 0x0, r10}, @fda={0x66646185, 0x0, 0x0, 0x24}}, &(0x7f00000001c0)={0x61, 0x28, 0x40}}}], 0x0, 0x0, 0x0}) 11.050563897s ago: executing program 1 (id=556): creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) (async, rerun: 32) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) (rerun: 32) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4c"], 0x15) (async) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) (async) syz_usb_connect$uac1(0x6, 0xa0, &(0x7f0000000280)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8e, 0x3, 0x1, 0x80, 0xa0, 0xff, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x2, 0x4}, [@input_terminal={0xc, 0x24, 0x2, 0x6, 0x100, 0x3, 0xdd, 0xfff, 0x4}, @mixer_unit={0x8, 0x24, 0x4, 0x2, 0x7, "fc90af"}, @extension_unit={0x7, 0x24, 0x8, 0x1, 0x2, 0xa}, @processing_unit={0x8, 0x24, 0x7, 0x3, 0x3, 0xd8, '/'}, @extension_unit={0xc, 0x24, 0x8, 0x2, 0x5, 0x7f, "03ff1296aa"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x8, 0x8, 0x7, {0x7, 0x25, 0x1, 0x2, 0x7, 0x8001}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x7, 0x8, 0x4, {0x7, 0x25, 0x1, 0x80, 0x5, 0x7762}}}}}}}]}}, &(0x7f00000009c0)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x310, 0x1, 0x3, 0x3, 0x0, 0x7}, 0x6b, &(0x7f0000000340)={0x5, 0xf, 0x6b, 0x4, [@ssp_cap={0x24, 0x10, 0xa, 0x8, 0x6, 0x6, 0x0, 0xf13, [0xff30, 0xffc000, 0x3f00, 0xc0, 0xc0, 0xff3f00]}, @ssp_cap={0x20, 0x10, 0xa, 0x1, 0x5, 0x4, 0xf000, 0x5, [0x808030, 0x0, 0x3f00, 0xc0c0, 0x3f07]}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x7, 0x1, 0x3}, @ssp_cap={0x18, 0x10, 0xa, 0x6b, 0x3, 0xf3, 0xf, 0x6, [0x3f00, 0x0, 0xc0cf]}]}, 0xa, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x80c}}, {0xa4, &(0x7f0000000400)=@string={0xa4, 0x3, "ea28919e0021c61a472600ede8367db97fcb1909f1b76babe2a4a1f4af27b388b910b398f1c7724e7778954ce3c5ab0f6ad07b017ecf6d60d06c5d58dd53f64f6f6e0234a8d491a21ffed58378b8ae2e131998e7866793649dc2fc762c8bca6bfe5c0bfae20d1d75bb4899aecb7a019ef13b4efeed664182a5bf4175c4319b3773e516ce704b1ac1d23a7fb171db22e17b537562b20dd0415cc65a199f5ce5381d85"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x444}}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x444}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x140a}}, {0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x41f}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0xf0ff}}, {0xd6, &(0x7f0000000700)=@string={0xd6, 0x3, "c3aea5cba0894e8e3ef040c2adb2b0faf5085898aa03bac9e9d3c536891187b3f9343b6163843883d057e96f61ca62aa0b301815b61e55d94d53f1d77f79485d39e12df07ff3c7353977ceaac0510a7157e69e4eb81eac48f58d769204738ee4982d2660c32c6f608795700dbcfddafcb9ba769ceb5f936562428b867c524e9c6478fb1267ede41e311795e5fad635e259587e48e0412fb4be30ff8a55c322dd454127a12396ce18f903eeac1da0d97b11ce2cb1f6802c8ef8266a72373cdb6461a30478f3c032b9877c79a6fdc63f8dc1c7463b"}}, {0x9e, &(0x7f0000000a80)=ANY=[@ANYBLOB="9e03faf4baf1bf0915c5438da22b29f1cb6986fbf66cf20ab80b286b0466a2ff0232a7c608fab282275ce6809e662cd27753413ed2059a0e25d6c1e326149466eab273ccc34b24606d9486f03170353c056fa90320f926acc51ce21e8978048f550364bbb257eb5edc38edfc7b0b4c064907ad01627413d8e43c8873210e2be4ee1fda6fa773d3035398618e3aa9f7aa0797c11fc67f70be66f6dedc0b96938793f9ac3a83fa3fb8320a0b4e523308439de7a49e5463f71661994c30ebb7861dfa684bb6e8c20f820b2e3d47c258c3f51720f3a809b33d32444d086f51e8f7b178cc8b3c907afc3ab14b5b64fc3104daa9c633c58d0d8d3bd61f23cdd5db5eba6acf9e45bce6bddd15c86c9dadc78641eee324d09963d175b68cb3cfcb04e66d53b94f808481a2f8dbe2e7e60232da34caa366a06f42d13e325d220fe009bf56341172c1a8435b5fca29f55d855ef67c41c383464cd87382287b984a84904d0c2d029256e6bddf7bc7bbecad630139b80cb0b9305a6f55a43640e175f17cc13b6f165bdcf4501722779e38223bab8bc215"]}, {0xfc, &(0x7f00000008c0)=@string={0xfc, 0x3, "15755587ffda363c7deaeec49a50ac7ce47dcd045f6b02fb389256c42ed3e73d02be7799d656a8749fa449ce2a663177afcaa45fb4da49f124cb421845f6cb82bdff60b591a1ed6046a5474364f13907903aed39baabd2c27371d64c9d86b0d6ebe7a8326f141f64e744113925f4d10f0d0e52d94671a82ae1509fa1557c95d485570167d518d580e4b49e146d7a04d0990256f9c06cdb90cb960258eb452f9d5d988a9b33963f223fcf05a1a34c581d81c21e65d207f6ed22e33c3729d5eac77389bd03e184f7b4cab86f53728f79d87a1e76262d493f9af9ce3c83bc8debc45577606761a79cc4a51030c2614243d8243cec5af2a010f059c9"}}]}) (async) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="38010000fe0000"], 0x138) (async) mount$9p_fd(0x0, &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000003c0), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@aname={'aname', 0x3d, '!%()-\\)*'}}, {@debug={'debug', 0x3d, 0x4}}]}}) (async) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r3, &(0x7f00000029c0)={0x2020}, 0x2020) 1.13575759s ago: executing program 3 (id=561): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) pipe(0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000480)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="8fedcb5d07081196f37538e486dd6372ce22ff892f"], 0x36) 1.13336156s ago: executing program 1 (id=565): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x4}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@fd={0x66642a85, 0x0, r1}, @flat=@binder={0x73622a85, 0x0, 0x3}, @flat=@handle={0x73682a85, 0x100}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 1.13084477s ago: executing program 3 (id=567): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x400, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_INPUT(r1, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e57060", 0x1000}}, 0x1006) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/pm_freeze_timeout', 0x1a1081, 0x18) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r3, 0xf) wait4(r3, 0x0, 0x2, 0x0) sched_setaffinity(r3, 0x8, &(0x7f00000000c0)=0x7fffffffffffffff) syz_clone(0x2204000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_freezer_state(r4, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r5, &(0x7f0000000040)='FROZEN\x00', 0x7) write$cgroup_freezer_state(r5, &(0x7f0000000080)='FROZEN\x00', 0x7) write$khugepaged_scan(r2, &(0x7f0000000000), 0x8) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 987.911671ms ago: executing program 1 (id=570): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0xa6883, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000440)=""/4096) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) 890.108909ms ago: executing program 3 (id=573): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) memfd_secret(0x80000) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000d80), 0x8000, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x10001) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000180)={0x3, {{0xa, 0x4e20, 0xa3f, @mcast1, 0xbfd}}, {{0xa, 0x4e23, 0x4000, @empty, 0xfffffe01}}}, 0x108) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) getsockopt$inet6_buf(r2, 0x29, 0x30, &(0x7f0000000180)=""/214, &(0x7f0000000080)=0xd6) read$msr(r1, &(0x7f0000000dc0)=""/102394, 0x18ffa) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305839, &(0x7f00000000c0)={0x0, 0x1}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="020300021000000000000000000000000200080008000000fd0000000000000005000600000000000a0000000000000000000000000000000000000000000001000000000000000002000100000000000000fefcb99ffe7527f9beaf000000006f7737e20a32eea9fe80001241570c5ff3732b8829a100"/128], 0x80}, 0x1, 0x7}, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f00000001c0)=0x7ff, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000180)={0x0, 0x0}) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x8, 0x2010, r0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.swap.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x2000006, 0x50012, r6, 0x0) socket$nl_audit(0x10, 0x3, 0x9) write$P9_RMKNOD(r4, &(0x7f00000000c0)={0x14, 0x13, 0x2, {0x0, 0x2, 0x1}}, 0x14) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x58}}, 0x4040800) mprotect(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x2000003) epoll_create1(0x0) 867.947471ms ago: executing program 3 (id=574): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000004200)={{0x12, 0x1, 0x0, 0xe2, 0x79, 0x3b, 0x10, 0x5d1, 0x2001, 0x900, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x4d, 0x2f, 0x9c}}]}}]}}, 0x0) madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f0000000000)=']') r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f00000000c0)=@req={0x0, 0x7b3, 0x8, 0x6}, 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000500)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffff77, 0x0, 0x0}, &(0x7f0000000000)=0x40) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000680)=ANY=[@ANYBLOB="0006440000006340dcf0bf085a22d45d400de4d99546b5248bbabe9e9e049174fa22d1d1a46669aa14ab557ae0410ad0638ec6cf2b44af31262ac4f9edd1e76a3d6333719b3dca79d9b9"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="60eca34571b4ac1e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r3 = syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100)=""/4096, 0x1000}, {&(0x7f0000001100)=""/69, 0x45}], 0x2, &(0x7f0000003480)=[{&(0x7f00000023c0)=""/4096, 0x1000}], 0x1, 0x0) madvise(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x3) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x88602, 0x0) 464.211233ms ago: executing program 2 (id=581): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_SET_VRING_NUM(r0, 0x4008af10, &(0x7f0000000040)={0x1, 0x40}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x50, r2, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}]}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0x10, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x800}]}]}, 0x50}}, 0xc0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000240)=&(0x7f0000000200)) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000280)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x7, 0x1, 0x4, 0x3, {0xa, 0x4e22, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}, 0xf}}}, 0x32) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r1) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x100000d) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000300), 0x22582, 0x0) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x400, 0x0) ioctl$PTP_PIN_GETFUNC2(r4, 0xc0603d0f, &(0x7f0000000380)={'\x00', 0x5, 0x3, 0xffffffff}) r5 = signalfd(r1, &(0x7f0000000400)={[0x5]}, 0x8) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x50, r5, 0x53864000) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x2f) ioctl$KVM_XEN_HVM_CONFIG(r6, 0x4038ae7a, &(0x7f00000005c0)={0x8, 0x399, &(0x7f0000000440)="2df9c8ce380e1c8d619d571854b63b5e5ab2cc7dc703f0f3d6a060247b8a541e9e27e6d37b6456f9a5b4d953e371bb5dea32d7a8df7ccef538112f08918c5af5beaf", &(0x7f00000004c0)="c93da081ae8a0c6ca9992102d6f96dc72ee6a7e185599ed41b0ac2d44e4c94cb9c165eb74295bb5836401d1ce516a0582ba6d762df1004de825309c8ab2cbc08d7dd638b5f9a41b9592caebdb38b18367b3b24512be4c39ef31709d807881a27ae33ac4323dbffb646a286a9437e760a74171a944a46b0e8af2d4bab7fba8611cc12a5a4ee639239b1fd17e9470cb54315f2e63d40e78923aa1463df739c06b2fd920d77d43fc0987c1afd366a74a7283fa3b252b86c6b00b964939fcc8d53efa707d18edbb76de699862ffc1896f1", 0x42, 0xcf}) ioctl$AUTOFS_IOC_FAIL(r4, 0x9361, 0xa8b) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r5) r7 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCGPTPEER(r7, 0x5441, 0xc) r8 = open(&(0x7f0000000600)='./file0\x00', 0x10000, 0x100) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMK(r8, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x240010}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x44, r3, 0x4, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "65e45ee83ba967c6b70419b70b68a039"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "b644f8334805537ec35585a3d40f0476"}]}, 0x44}, 0x1, 0x0, 0x0, 0x20004000}, 0x8001) sigaltstack(&(0x7f0000000800)={&(0x7f00000007c0)=""/5, 0x5, 0x5}, &(0x7f0000000880)={&(0x7f0000000840)=""/40, 0x0, 0x28}) ioctl$SIOCGIFMTU(r8, 0x8921, &(0x7f00000008c0)={'wg1\x00'}) ioctl$TCFLSH(r8, 0x540b, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r10 = signalfd4(r7, &(0x7f0000000900)={[0x7fff]}, 0x8, 0x800) sendmsg$NL80211_CMD_SET_BEACON(r10, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x804040}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x40, r3, 0x100, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x4, 0x65}}}}, [@NL80211_ATTR_FTM_RESPONDER={0x10, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_CIVICLOC={0xc, 0x3, "c0c34420f326c412"}]}, @NL80211_ATTR_BEACON_TAIL={0xd, 0xf, [@mesh_config={0x71, 0x7, {0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x1, 0xc4, 0x61}}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000051}, 0x8000) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f0000001200)={&(0x7f0000000a40), 0xc, &(0x7f00000011c0)={&(0x7f0000000a80)={0x710, 0x0, 0x5, 0x401, 0x0, 0x0, {0x7, 0x0, 0x2}, [{{0x254, 0x1, {{0x1, 0x7}, 0x1, 0xd, 0x10, 0x7, 0x6, 'syz1\x00', "45f19fbf46a35ffeade1d2bd87573c84c88da546138248e60423695ff613772d", "69f89d4ec11228715095023869a4dd644983dc5f70ffd50220abf78d2d73acc5", [{0x7, 0xe9, {0x3, 0x7}}, {0x6, 0xfff7, {0x1, 0x6}}, {0x1, 0x5, {0x3, 0x3}}, {0x4, 0x8, {0x2, 0x8}}, {0x8, 0xf, {0x2, 0x9}}, {0x8, 0x7, {0x0, 0x1}}, {0x9, 0x7f, {0x0, 0x8}}, {0x7, 0x9, {0x0, 0x4}}, {0x9, 0x5, {0x1, 0x8000}}, {0x1, 0xdbf, {0x3, 0x9}}, {0x9, 0x1, {0x0, 0xb}}, {0x81, 0xaa9, {0x1, 0x1}}, {0x5, 0x4, {0x0, 0x8}}, {0x40, 0x200, {0x2, 0x10000}}, {0x2, 0x1, {0x3, 0x8000}}, {0x4, 0x9, {0x0, 0x3}}, {0x5, 0x1, {0x1, 0x800}}, {0x5, 0x3, {0x0, 0x7}}, {0x44c, 0x3, {0x0, 0xf}}, {0x4, 0x4, {0x3, 0x8}}, {0x3d3, 0x5, {0x2, 0x81}}, {0x7f, 0x3, {0x3, 0x34}}, {0x4, 0x6, {0x0, 0x7}}, {0x7, 0x8, {0x3}}, {0x7fff, 0x2, {0x3}}, {0x1ff, 0x4, {0x2, 0x2}}, {0x3, 0x7, {0x3, 0x6}}, {0x0, 0x22, {0x0, 0x3ff}}, {0x80, 0xff, {0x2, 0x7}}, {0x1, 0x3, {0x0, 0x6b}}, {0x9, 0x0, {0x3, 0x1}}, {0x3, 0x101, {0x3, 0x1}}, {0x9, 0x81, {0x1, 0x7fff}}, {0x8, 0x837f, {0x0, 0x3}}, {0x40, 0x0, {0x1, 0x5}}, {0x4, 0x200, {0x0, 0x7f}}, {0x7ff, 0x5, {0x1, 0x3}}, {0x2, 0xa31, {0x0, 0x9a9}}, {0xff9c, 0xb, {0x1, 0x4}}, {0x7, 0x7, {0x2, 0x4}}]}}}, {{0x254, 0x1, {{0x2, 0x8}, 0xe8, 0x1, 0x8000, 0xa, 0x10, 'syz0\x00', "3ab5f6e7d5bd08bdf5b215c9e4e2cc409d781c4887d4377155b7bc3d9fd0fafa", "ea2d7b40e55e87ea0de68e09e1a83a521f0ba11fa2e1e55d611acdab916102e7", [{0x8, 0x6d48, {0x0, 0x14}}, {0x9, 0x9, {0x0, 0x38b5}}, {0x100, 0x6, {0x0, 0x60}}, {0xfff3, 0x0, {0x1, 0x790b}}, {0x9539, 0x7, {0x2, 0x7}}, {0x2e90, 0x0, {0x3, 0x2}}, {0xffff, 0x0, {0x2, 0x3ff}}, {0x8000, 0x80, {0x0, 0x8e1}}, {0xd, 0xc, {0x0, 0x9}}, {0x6078, 0x400, {0x0, 0x5f2}}, {0x5, 0xf801, {0x0, 0x4}}, {0x2, 0x1c, {0x1, 0x696}}, {0x9, 0x4, {0x2, 0xffff}}, {0x200, 0x0, {0x1, 0x7}}, {0x41f, 0x8f0c, {0x1, 0x1}}, {0x6, 0x4, {0x2, 0x3}}, {0x3, 0x8, {0x2, 0xc}}, {0x6, 0x0, {0x1, 0x10000}}, {0x6, 0x3, {0x3, 0x8}}, {0x2, 0x7, {0x1, 0x7}}, {0x7, 0xbe91, {0x1, 0x6}}, {0x8, 0xfff, {0x1, 0xb1c}}, {0x5, 0x2, {0x3, 0xedeb}}, {0xda6f, 0x6e3, {0x0, 0x8}}, {0x3, 0x6, {0x0, 0x9}}, {0xad, 0x400, {0x1, 0x7}}, {0x0, 0x673d, {0x3, 0x2}}, {0x2, 0x3, {0x0, 0x1}}, {0xb, 0x7, {0x1, 0x2}}, {0x9, 0x6, {0x2, 0x7ea4}}, {0x8, 0x3, {0x0, 0x1}}, {0x0, 0x8, {0x3, 0x9}}, {0x5, 0x5, {0x2}}, {0x8001, 0x6, {0x3, 0x3}}, {0xd, 0x6130, {0x2, 0x7}}, {0xa, 0x53e4, {0x1, 0xda3d}}, {0x5d4a, 0x6, {0x0, 0x4}}, {0x2, 0xfff9, {0x0, 0x401}}, {0xffff, 0x3, {0x1, 0x3}}, {0x6, 0x401, {0x3, 0x9}}]}}}, {{0x254, 0x1, {{0x3, 0xff}, 0x7, 0x7, 0x4, 0x39ef, 0x8, 'syz1\x00', "c899aa6dc7d1da552c89a1ef3120db86560b57736ff01754f838ae291f2828af", "a9af17468dbb44ee1992c6b84593d3d227d9b5378202b3d8174533c36e16f19a", [{0x7, 0x0, {0x3, 0xfffffffa}}, {0xf2, 0xff97, {0x0, 0x8}}, {0x3, 0x0, {0x0, 0x81}}, {0x1, 0x1, {0x3, 0x3}}, {0x7fff, 0x1000, {0x1, 0x14}}, {0x1, 0x7ff, {0x1, 0x6}}, {0x9, 0x1b76, {0x3, 0x33b}}, {0x2, 0x5, {0x2, 0x7f}}, {0x100, 0x5, {0x3, 0xfffffff7}}, {0xb, 0x3, {0x0, 0x9}}, {0x0, 0x3, {0x3, 0x7}}, {0x4c, 0x1ff, {0x1, 0x8}}, {0xb, 0x10, {0x0, 0x8}}, {0x9, 0x0, {0x3, 0x2}}, {0x5, 0x6, {0x3, 0xef3f}}, {0x7, 0xff8a, {0x1, 0x7}}, {0xe5, 0x5, {0x3, 0x100}}, {0x2, 0x100, {0x1, 0x8}}, {0xc, 0x9, {0x0, 0xfd65}}, {0x6, 0x9, {0x2, 0x68}}, {0x7, 0x3, {0x3, 0x6}}, {0x3ff, 0x7f, {0x1, 0x3f}}, {0x7fff, 0x5, {0x1, 0x1}}, {0x7, 0x7, {0x0, 0x80000000}}, {0x8, 0x3, {0x0, 0x7ff}}, {0x7, 0x4, {0x0, 0x5d60}}, {0xe, 0x9, {0x1, 0x1000}}, {0x2, 0x341c, {0x1, 0x1}}, {0x1, 0xe3, {0x0, 0x4}}, {0x6, 0xfffd, {0x3, 0x7}}, {0x9, 0x3ff, {0x3, 0x1000}}, {0x8dd, 0x4, {0x1, 0x3}}, {0x8, 0x2, {0x3, 0x4}}, {0x3, 0x4, {0x0, 0xfffffffa}}, {0x2, 0x1, {0x3, 0x400}}, {0x8, 0x5, {0x2, 0x2}}, {0x3ff, 0x9, {0x1, 0x1}}, {0x0, 0x6, {0x3, 0xf4}}, {0x6, 0x7, {0x2, 0xd}}, {0xfff, 0x4, {0x2}}]}}}]}, 0x710}}, 0x4005) 407.560268ms ago: executing program 2 (id=582): r0 = getpid() syz_pidfd_open(r0, 0x0) pipe2$9p(0x0, 0x0) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x138) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000800000/0x800000)=nil, 0x800000}, 0x1}) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4c}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x800000)=nil, 0x800000}, 0x1}) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x400, &(0x7f0000000100)=ANY=[@ANYBLOB='noswap,huge=never,nr_blocks=G']) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0xe) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000280)=ANY=[@ANYBLOB="010000000000000004010040000000000600000000080000"]) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f0000000140)=0xa7, 0x4, 0x0) ioctl$KVM_NMI(r6, 0xae9a) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000500)={[0x7, 0x100000000, 0x0, 0x7dd, 0x100000, 0x0, 0x2004c8, 0x1, 0x0, 0x0, 0x7, 0xffffffffffffffff, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000640)={{{@in6=@mcast2, @in6=@dev}}, {{@in=@dev}, 0x0, @in6=@ipv4}}, &(0x7f0000000380)=0xe8) sendmsg$nl_netfilter(r5, &(0x7f0000000240)={&(0x7f0000000040), 0xc, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="14030000000201022bbd7000ffdb4da100000000"], 0x14}, 0x1, 0x0, 0x0, 0x41}, 0x90) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x5, 0x6, 0x4004, 0x6, 0x4, 0xefffffffffffffff, 0x2, 0x1000, 0x2000000, 0x0, 0x18, 0xffffffffffffffff, 0xffffffffffffffff, 0x6], 0x0, 0x41900}) ioctl$KVM_RUN(r6, 0xae80, 0x0) read$FUSE(r1, &(0x7f00000029c0)={0x2020}, 0x2020) 351.508582ms ago: executing program 0 (id=584): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000480)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="8fedcb5d07081196f37538e486dd6372ce22ff892f"], 0x36) 343.275563ms ago: executing program 2 (id=585): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pipe(0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000480)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r0, &(0x7f0000000380)=ANY=[], 0x3c) 324.885144ms ago: executing program 3 (id=586): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=@flushpolicy={0x40, 0x12, 0x105, 0x0, 0x25dfdbfe, "", [@proto={0x5, 0x19, 0xff}, @address_filter={0x28, 0x1a, {@in=@broadcast, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2, 0x6, 0x9}}]}, 0x40}}, 0x20040810) openat$selinux_load(0xffffffffffffff9c, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f00000000c0)={0x1, 0x5}, 0x8) close(r3) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x3, 0x0, 0x2, 0x0, {0xa, 0x4e23, 0xf, @private0, 0x3}}}, 0x3a) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='vfat\x00', 0x808081, 0x0) 284.942557ms ago: executing program 0 (id=587): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0) keyctl$search(0xa, 0x0, &(0x7f00000003c0)='asymmetric\x00', 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'pimreg\x00', 0x2bc67b5dc0ef3785}) read(r0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) 231.503682ms ago: executing program 0 (id=588): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x802, 0x0) (async, rerun: 32) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)) (async, rerun: 32) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x11, &(0x7f0000000bc0)=0x7, 0x4) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000001640)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) prlimit64(r2, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) (async) r3 = syz_open_procfs(r2, &(0x7f00000000c0)='net/ip_mr_vif\x00') (async) mknod(&(0x7f0000000000)='./file0\x00', 0x6000, 0x77b) (async, rerun: 64) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, 0x1b5) (rerun: 64) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000000000/0x400000)=nil) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000080)={'syztnl0\x00', 0x0, 0x2f, 0xff, 0x3, 0x7ff, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, 0x7, 0x7800, 0x92, 0xfffff5f0}}) (rerun: 32) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x4041009}, 0x90) (async) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000a8d0}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x2) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) (async) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0xff}) (async, rerun: 64) ioctl$KVM_RUN(r7, 0xae80, 0x0) (rerun: 64) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r10, 0xc040aed5, &(0x7f0000000000)={0x2, 0x118000}) (async) ioctl$KVM_GET_SUPPORTED_HV_CPUID_sys(r8, 0xc008aec1, &(0x7f0000000140)={0x2, 0x0, [{0xc0000000, 0x35d2, 0x7, 0xff, 0x8000, 0x1, 0x7}, {0x1, 0x0, 0x2, 0x9, 0x9, 0x5, 0x30978000}]}) r11 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r11, 0xc00caee0, &(0x7f0000000100)={0x4}) (async) close_range(r0, 0xffffffffffffffff, 0x0) 231.100182ms ago: executing program 0 (id=589): r0 = add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc1}, &(0x7f0000000080)={0x0, "5d9bc136c963254c661fb620148b6f72ca6ae2a44829bfa79ec13499f8ec9077d85d879711d98bb1687ad36dfe5f14a7b0ce15c1e6be0e7ecabfdfde0dfa00b1"}, 0x48, 0xffffffffffffffff) keyctl$setperm(0x5, r0, 0x2040403) keyctl$KEYCTL_WATCH_KEY(0x6, r0, 0xffffffffffffffff, 0x4) creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4c"], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="38010000fe0000"], 0x138) mount$9p_fd(0x0, &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000003c0), 0x14, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@access_uid}]}}) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r4, &(0x7f00000029c0)={0x2020}, 0x2020) 229.676142ms ago: executing program 2 (id=590): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x0, 0x0) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x0, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$BTRFS_IOC_BALANCE_CTL(r1, 0x40049421, 0x9f4bea4fea59bbb6) socket$inet_udp(0x2, 0x2, 0x0) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_pktinfo(r2, 0x88, 0x8, 0x0, 0x0) (async) setsockopt$inet_pktinfo(r2, 0x88, 0x8, 0x0, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000040)={0x0, 0x0, 0xbffc, 0x6}) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x40d00, 0x0) r6 = dup(r5) ioctl$KVM_CHECK_EXTENSION(r6, 0xae03, 0xd5) ioctl$RTC_AIE_OFF(r4, 0x7002) setsockopt$inet6_int(r3, 0x29, 0x4e, &(0x7f0000000000)=0x1, 0x4) ioctl$RTC_UIE_OFF(r1, 0x7004) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e29, 0x80000001, @local, 0x5}, 0x1c) (async) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e29, 0x80000001, @local, 0x5}, 0x1c) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) 160.061067ms ago: executing program 0 (id=591): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x12, r0, 0xa0e51000) add_key$fscrypt_v1(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 159.857838ms ago: executing program 2 (id=592): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async, rerun: 32) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (rerun: 32) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x4, @mcast2={0xff, 0x3}}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendto$inet6(r1, &(0x7f0000000140)="8369b66f", 0x20, 0x0, 0x0, 0x0) (async, rerun: 32) fcntl$setlease(r0, 0x400, 0x0) (async, rerun: 32) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) (async) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r3, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x4f5dd000) (async, rerun: 32) syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) (rerun: 32) close_range(r2, 0xffffffffffffffff, 0x0) (async) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r4, 0xaf01, 0x0) (async) r5 = eventfd2(0xd, 0x1) ioctl$VHOST_SET_VRING_CALL(r4, 0x4008af21, &(0x7f0000000080)={0x0, r5}) r6 = socket(0x200000000000011, 0x2, 0x8) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) (async) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xf, &(0x7f00000004c0)=0x8, 0x4) (async, rerun: 64) sendto$packet(r8, &(0x7f0000000480)="330320000c00140000007ef500005f530c0900000000000000f786dd3baa4b1f0f858c4632f47042195e6b", 0x2b, 0x40008c1, &(0x7f00000001c0)={0x11, 0x3, r7, 0x1, 0x9, 0x6, @multicast}, 0x14) (rerun: 64) ioctl$VHOST_SET_VRING_CALL(r4, 0x4008af21, &(0x7f0000000200)) (async) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000200)={{{@in=@initdev, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@empty}}, &(0x7f0000000040)=0xe8) quotactl_fd$Q_QUOTAON(r3, 0xffffffff80000201, r9, &(0x7f0000000080)='./file0\x00') 157.818708ms ago: executing program 1 (id=593): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) pipe2$9p(&(0x7f00000003c0)={0xffffffffffffffff}, 0x80000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) readv(r2, 0x0, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000280)={{0x2}, 'syz1\x00', 0x11}) ioctl$UI_DEV_CREATE(r1, 0x5501) inotify_add_watch(0xffffffffffffffff, 0x0, 0x1400037e) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x10) mount$incfs(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) chroot(&(0x7f0000000480)='./file0/file0\x00') pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00') syz_open_dev$evdev(&(0x7f0000000340), 0x3f, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 146.340319ms ago: executing program 2 (id=594): r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) pipe2(0x0, 0x0) tee(0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffc01, 0x0) capset(0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder1\x00', 0x802, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240040c0}, 0x20000000) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYRES8=r4, @ANYRESHEX=r0]) close_range(r1, 0xffffffffffffffff, 0x0) 97.193623ms ago: executing program 1 (id=595): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000480)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="8fedcb5d07081196f37538e486dd6372ce22ff892f"], 0x36) 0s ago: executing program 0 (id=596): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) copy_file_range(r1, 0x0, r1, 0x0, 0x101, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000002600)={0x400000, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_ALLOW_SUSPEND(r0, 0x5522) r2 = syz_open_dev$usbfs(&(0x7f0000000340), 0x206, 0x8401) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETTXFILTER(r3, 0x400454ca, &(0x7f0000000100)=ANY=[@ANYBLOB="2e02"]) ioctl$USBDEVFS_SETINTERFACE(r2, 0x80085504, &(0x7f0000000080)={0xff, 0x42}) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000000)={[], [{@flag='rw'}]}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.56' (ED25519) to the list of known hosts. [ 22.199713][ T36] audit: type=1400 audit(1756314611.300:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.201159][ T281] cgroup: Unknown subsys name 'net' [ 22.222566][ T36] audit: type=1400 audit(1756314611.300:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.250035][ T36] audit: type=1400 audit(1756314611.340:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.250246][ T281] cgroup: Unknown subsys name 'devices' [ 22.456541][ T281] cgroup: Unknown subsys name 'hugetlb' [ 22.462192][ T281] cgroup: Unknown subsys name 'rlimit' [ 22.557595][ T36] audit: type=1400 audit(1756314611.660:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.580848][ T36] audit: type=1400 audit(1756314611.660:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.600660][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.606063][ T36] audit: type=1400 audit(1756314611.660:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.637598][ T36] audit: type=1400 audit(1756314611.720:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.663006][ T36] audit: type=1400 audit(1756314611.720:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.665007][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.688579][ T36] audit: type=1400 audit(1756314611.760:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.723075][ T36] audit: type=1400 audit(1756314611.760:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.563397][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.570478][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.577767][ T290] bridge_slave_0: entered allmulticast mode [ 23.584177][ T290] bridge_slave_0: entered promiscuous mode [ 23.597070][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.604164][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.611340][ T290] bridge_slave_1: entered allmulticast mode [ 23.617805][ T290] bridge_slave_1: entered promiscuous mode [ 23.624902][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.631943][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.639193][ T288] bridge_slave_0: entered allmulticast mode [ 23.645601][ T288] bridge_slave_0: entered promiscuous mode [ 23.652091][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.659185][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.666323][ T288] bridge_slave_1: entered allmulticast mode [ 23.672559][ T288] bridge_slave_1: entered promiscuous mode [ 23.735321][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.742473][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.749701][ T291] bridge_slave_0: entered allmulticast mode [ 23.756144][ T291] bridge_slave_0: entered promiscuous mode [ 23.765827][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.772895][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.780023][ T289] bridge_slave_0: entered allmulticast mode [ 23.786372][ T289] bridge_slave_0: entered promiscuous mode [ 23.796368][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.803428][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.810572][ T291] bridge_slave_1: entered allmulticast mode [ 23.816918][ T291] bridge_slave_1: entered promiscuous mode [ 23.828489][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.835705][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.842801][ T289] bridge_slave_1: entered allmulticast mode [ 23.849431][ T289] bridge_slave_1: entered promiscuous mode [ 24.000883][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.008196][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.015539][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.022583][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.035000][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.042072][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.049382][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.056439][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.094934][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.102010][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.109427][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.116485][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.128050][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.135142][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.142427][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.149485][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.185309][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.193100][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.201034][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.208275][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.215919][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.223140][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.230487][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.256988][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.264083][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.272037][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.279131][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.287147][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.294529][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.318768][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.325839][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.348808][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.355889][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.378389][ T288] veth0_vlan: entered promiscuous mode [ 24.393357][ T328] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.400446][ T328] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.418002][ T290] veth0_vlan: entered promiscuous mode [ 24.427130][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.434220][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.454878][ T288] veth1_macvtap: entered promiscuous mode [ 24.467803][ T290] veth1_macvtap: entered promiscuous mode [ 24.477038][ T291] veth0_vlan: entered promiscuous mode [ 24.516975][ T291] veth1_macvtap: entered promiscuous mode [ 24.526985][ T289] veth0_vlan: entered promiscuous mode [ 24.538030][ T288] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 24.592190][ T331] can0: slcan on ptm0. [ 24.595331][ T289] veth1_macvtap: entered promiscuous mode [ 24.667325][ T343] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 24.667389][ T343] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:2 [ 24.704562][ T345] can: request_module (can-proto-0) failed. [ 24.767013][ T330] can0 (unregistered): slcan off ptm0. [ 24.867683][ T365] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.029922][ T384] mmap: syz.2.10 (384) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 25.043079][ T333] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.157419][ T391] kvm: kvm [390]: vcpu2, guest rIP: 0x9134 Unhandled WRMSR(0x11e) = 0xc88e0137 [ 25.170184][ T391] kvm: kvm [390]: vcpu2, guest rIP: 0x9134 Unhandled WRMSR(0x186) = 0xc88e0137 [ 25.180569][ T391] kvm: kvm [390]: vcpu2, guest rIP: 0x9134 Unhandled WRMSR(0x187) = 0xc88e0137 [ 25.192396][ T391] kvm_intel: kvm [390]: vcpu2, guest rIP: 0x9134 Unhandled WRMSR(0x1d9) = 0xc88e0137 [ 25.203897][ T333] usb 1-1: Using ep0 maxpacket: 16 [ 25.214538][ T333] usb 1-1: config 1 has an invalid interface number: 105 but max is 0 [ 25.222754][ T333] usb 1-1: config 1 has no interface number 0 [ 25.243911][ T333] usb 1-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 25.255489][ T333] usb 1-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 25.265797][ T333] usb 1-1: config 1 interface 105 has no altsetting 0 [ 25.275534][ T333] usb 1-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 25.286725][ T333] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.303969][ T333] usb 1-1: Product: syz [ 25.308276][ T333] usb 1-1: Manufacturer: syz [ 25.312915][ T333] usb 1-1: SerialNumber: syz [ 25.319712][ T358] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 25.329771][ T358] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 25.508631][ T401] can: request_module (can-proto-0) failed. [ 25.562503][ T403] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:7 [ 25.622421][ T408] binder: Unknown parameter '' [ 25.728893][ T419] rust_binder: Read failure Err(EAGAIN) in pid:21 [ 25.729497][ T419] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:21 [ 25.738909][ T358] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 25.770865][ T358] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 25.999385][ T333] aqc111 1-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x20) reg index 0x0000: -71 [ 26.011811][ T426] ======================================================= [ 26.011811][ T426] WARNING: The mand mount option has been deprecated and [ 26.011811][ T426] and is ignored by this kernel. Remove the mand [ 26.011811][ T426] option from the mount to silence this warning. [ 26.011811][ T426] ======================================================= [ 26.046934][ T333] aqc111 1-1:1.105: probe with driver aqc111 failed with error -71 [ 26.056756][ T333] usb 1-1: USB disconnect, device number 2 [ 26.166819][ T432] can: request_module (can-proto-0) failed. [ 26.188925][ T434] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.202042][ T435] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 26.378023][ T447] SELinux: policydb version 1762826906 does not match my version range 15-33 [ 26.396185][ T447] SELinux: failed to load policy [ 26.425151][ T443] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 4256, size: 18446744073709551610) [ 26.425184][ T443] rust_binder: Error while translating object. [ 26.437385][ T443] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 26.443592][ T443] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:23 [ 26.582073][ T452] rust_binder: 11: no such ref 3 [ 26.644812][ T45] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.733969][ T333] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 26.774587][ T467] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 26.774615][ T467] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:14 [ 26.784424][ T467] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 26.793459][ T467] rust_binder: Read failure Err(EFAULT) in pid:14 [ 26.805267][ T45] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 26.822147][ T45] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 26.833043][ T45] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 26.842262][ T45] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 26.850582][ T45] usb 3-1: Product: syz [ 26.855053][ T45] usb 3-1: Manufacturer: syz [ 26.859805][ T45] usb 3-1: SerialNumber: syz [ 26.895720][ T333] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 26.909297][ T471] bpf: Bad value for 'uid' [ 26.913182][ T333] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 26.925185][ T333] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 26.935407][ T333] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 26.948567][ T333] usb 2-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 26.957980][ T333] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.969932][ T333] usb 2-1: config 0 descriptor?? [ 27.073044][ T45] usb 3-1: 0:2 : does not exist [ 27.078836][ T333] usb 2-1: MIDIStreaming interface descriptor not found [ 27.089668][ T45] usb 3-1: cannot find UAC_HEADER [ 27.100748][ T45] snd-usb-audio 3-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 27.111459][ T45] usb 3-1: USB disconnect, device number 2 [ 27.127045][ T427] udevd[427]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 27.185332][ T450] netlink: 88 bytes leftover after parsing attributes in process `syz.1.32'. [ 27.198366][ T333] usb 2-1: USB disconnect, device number 2 [ 27.508619][ T36] kauditd_printk_skb: 118 callbacks suppressed [ 27.508638][ T36] audit: type=1400 audit(1756314616.610:192): avc: denied { ioctl } for pid=475 comm="syz.3.41" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=4684 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 27.546742][ T36] audit: type=1400 audit(1756314616.650:193): avc: denied { bind } for pid=475 comm="syz.3.41" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 27.567028][ T476] rust_binder: Write failure EINVAL in pid:38 [ 27.567059][ T477] rust_binder: Write failure EINVAL in pid:38 [ 27.568294][ T36] audit: type=1400 audit(1756314616.650:195): avc: denied { name_bind } for pid=475 comm="syz.3.41" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 27.600160][ T36] audit: type=1400 audit(1756314616.650:194): avc: denied { name_bind } for pid=475 comm="syz.3.41" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 27.621053][ T36] audit: type=1400 audit(1756314616.650:196): avc: denied { node_bind } for pid=475 comm="syz.3.41" saddr=ff01::1 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 27.643710][ T36] audit: type=1400 audit(1756314616.650:197): avc: denied { node_bind } for pid=475 comm="syz.3.41" saddr=ff01::1 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 27.707656][ T36] audit: type=1400 audit(1756314616.810:198): avc: denied { mount } for pid=480 comm="syz.2.42" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 27.734141][ T482] overlayfs: workdir and upperdir must be separate subtrees [ 27.753245][ T485] binder: Unknown parameter 'sta [ 27.753245][ T485] \ʗKȵ ' [ 27.756482][ T36] audit: type=1400 audit(1756314616.850:199): avc: denied { bind } for pid=484 comm="syz.1.43" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 27.792585][ T36] audit: type=1400 audit(1756314616.850:200): avc: denied { listen } for pid=484 comm="syz.1.43" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 27.814601][ T36] audit: type=1400 audit(1756314616.850:201): avc: denied { ioctl } for pid=484 comm="syz.1.43" path="socket:[3947]" dev="sockfs" ino=3947 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 27.833272][ T493] can0: slcan on ptm0. [ 27.865538][ T493] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 27.865578][ T493] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:35 [ 27.912154][ T492] can0 (unregistered): slcan off ptm0. [ 27.958760][ T500] rust_binder: Failed copying into alloc: EFAULT [ 27.958785][ T500] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 27.973924][ T500] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 27.982314][ T500] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:23 [ 28.043942][ T45] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 28.263988][ T45] usb 2-1: Using ep0 maxpacket: 32 [ 28.273739][ T45] usb 2-1: config 1 interface 0 altsetting 16 bulk endpoint 0x1 has invalid maxpacket 1024 [ 28.284507][ T45] usb 2-1: config 1 interface 0 altsetting 16 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 28.297817][ T45] usb 2-1: config 1 interface 0 has no altsetting 0 [ 28.306648][ T45] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 28.316336][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.324512][ T45] usb 2-1: Product: 䖦컃펣淽戔╡폵힤喼ڎ˨빡옇彪퀝囍빪撵ﯹ哭ୡ셻촅㠎誫볜藤냎腜鿗ᕸ슨蝬馆臦핗쨁ᐹ킉䘏ഠ슴쁼ᄗ⎯홁凖᪔⯝㧜좶 [ 28.343567][ T45] usb 2-1: Manufacturer: С [ 28.348279][ T45] usb 2-1: SerialNumber: 郛ṹ隣䘜쫠鮁뗥괦䨕蹩㭀㌡ [ 28.357457][ T491] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 28.364682][ T491] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 28.776917][ T45] usb 2-1: USB disconnect, device number 3 [ 29.161521][ T553] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 29.264296][ T45] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 29.343925][ T64] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 29.415495][ T45] usb 1-1: unable to get BOS descriptor or descriptor too short [ 29.423629][ T45] usb 1-1: not running at top speed; connect to a high speed hub [ 29.432281][ T45] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 34879, setting to 1023 [ 29.445396][ T45] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.fb [ 29.454573][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.462575][ T45] usb 1-1: Product: syz [ 29.466924][ T45] usb 1-1: Manufacturer: syz [ 29.471550][ T45] usb 1-1: SerialNumber: syz [ 29.495238][ T64] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 29.503409][ T64] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 29.513828][ T64] usb 3-1: config 0 has no interface number 0 [ 29.522341][ T64] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07 [ 29.531563][ T31] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 29.541950][ T64] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.550331][ T64] usb 3-1: Product: syz [ 29.554613][ T64] usb 3-1: Manufacturer: syz [ 29.559234][ T64] usb 3-1: SerialNumber: syz [ 29.570697][ T64] usb 3-1: config 0 descriptor?? [ 29.685684][ T546] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 29.693461][ T546] rust_binder: 28: no such ref 2 [ 29.699406][ T546] rust_binder: 28: no such ref 3 [ 29.704651][ T546] rust_binder: 28: no such ref 1 [ 29.714153][ T31] usb 4-1: device descriptor read/64, error -71 [ 29.720570][ T578] process 'syz.1.67' launched './file1' with NULL argv: empty string added [ 29.730483][ T45] usb 1-1: 2:1: invalid format type 0xaf4f is detected, processed as PCM [ 29.743927][ T45] usb 1-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 29.759284][ T585] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 29.759307][ T585] rust_binder: Read failure Err(EFAULT) in pid:50 [ 29.769577][ T45] usb 1-1: USB disconnect, device number 3 [ 29.791051][ T585] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:50 [ 29.797199][ T427] udevd[427]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.875282][ T588] rust_binder: Write failure EFAULT in pid:48 [ 29.899363][ T591] rust_binder: Error while translating object. [ 29.905582][ T591] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 29.911773][ T591] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:35 [ 29.953945][ T31] usb 4-1: device descriptor read/64, error -71 [ 30.076406][ T599] rust_binder: Write failure EFAULT in pid:56 [ 30.203911][ T31] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 30.229355][ T608] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 30.229383][ T608] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 30.237856][ T608] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:63 [ 30.315481][ T612] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=612 comm=syz.1.78 [ 30.344140][ T31] usb 4-1: device descriptor read/64, error -71 [ 30.430378][ T616] FAULT_INJECTION: forcing a failure. [ 30.430378][ T616] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 30.443624][ T616] CPU: 0 UID: 0 PID: 616 Comm: syz.1.79 Not tainted syzkaller #0 a29bcd2d578c4b9493db917853c72486663e8fa1 [ 30.443663][ T616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 30.443681][ T616] Call Trace: [ 30.443687][ T616] [ 30.443708][ T616] __dump_stack+0x21/0x30 [ 30.443740][ T616] dump_stack_lvl+0x10c/0x190 [ 30.443761][ T616] ? __cfi_dump_stack_lvl+0x10/0x10 [ 30.443784][ T616] dump_stack+0x19/0x20 [ 30.443804][ T616] should_fail_ex+0x3d9/0x530 [ 30.443829][ T616] should_fail+0xf/0x20 [ 30.443855][ T616] should_fail_usercopy+0x1e/0x30 [ 30.443870][ T616] _copy_to_user+0x24/0xa0 [ 30.443887][ T616] simple_read_from_buffer+0xed/0x160 [ 30.443908][ T616] proc_fail_nth_read+0x19e/0x210 [ 30.443929][ T616] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 30.443952][ T616] ? bpf_lsm_file_permission+0xd/0x20 [ 30.443974][ T616] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 30.443994][ T616] vfs_read+0x27b/0xb60 [ 30.444018][ T616] ? __cfi_tun_chr_write_iter+0x10/0x10 [ 30.444041][ T616] ? __cfi_vfs_read+0x10/0x10 [ 30.444064][ T616] ? __kasan_check_write+0x18/0x20 [ 30.444086][ T616] ? mutex_lock+0x92/0x1c0 [ 30.444100][ T616] ? __cfi_mutex_lock+0x10/0x10 [ 30.444114][ T616] ? __fget_files+0x2c5/0x340 [ 30.444132][ T616] ksys_read+0x141/0x250 [ 30.444146][ T616] ? __cfi_ksys_read+0x10/0x10 [ 30.444160][ T616] ? __kasan_check_read+0x15/0x20 [ 30.444182][ T616] __x64_sys_read+0x7f/0x90 [ 30.444196][ T616] x64_sys_call+0x2638/0x2ee0 [ 30.444219][ T616] do_syscall_64+0x58/0xf0 [ 30.444239][ T616] ? clear_bhb_loop+0x50/0xa0 [ 30.444256][ T616] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 30.444281][ T616] RIP: 0033:0x7f77a578d5fc [ 30.444298][ T616] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 30.444312][ T616] RSP: 002b:00007f77a6515030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 30.444333][ T616] RAX: ffffffffffffffda RBX: 00007f77a59b5fa0 RCX: 00007f77a578d5fc [ 30.444346][ T616] RDX: 000000000000000f RSI: 00007f77a65150a0 RDI: 0000000000000007 [ 30.444362][ T616] RBP: 00007f77a6515090 R08: 0000000000000000 R09: 0000000000000000 [ 30.444377][ T616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 30.444391][ T616] R13: 00007f77a59b6038 R14: 00007f77a59b5fa0 R15: 00007ffd9f6ab368 [ 30.444410][ T616] [ 30.688396][ T31] usb 4-1: device descriptor read/64, error -71 [ 30.756010][ T618] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 30.764016][ T618] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 30.772659][ T618] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 30.780598][ T618] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 30.804619][ T31] usb usb4-port1: attempt power cycle [ 31.043951][ T45] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 31.143986][ T31] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 31.164988][ T31] usb 4-1: device descriptor read/8, error -71 [ 31.193971][ T45] usb 2-1: Using ep0 maxpacket: 16 [ 31.200353][ T45] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 31.209634][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.218536][ T45] usb 2-1: config 0 descriptor?? [ 31.224889][ T45] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 31.278867][ T632] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:51 [ 31.280019][ T628] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 31.290330][ T628] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 31.304134][ T628] rust_binder: Write failure EINVAL in pid:51 [ 31.305136][ T628] fuse: Bad value for 'group_id' [ 31.305406][ T31] usb 4-1: device descriptor read/8, error -71 [ 31.311485][ T628] fuse: Bad value for 'group_id' [ 31.373456][ T333] rust_binder: 627: removing orphan mapping 0:24 [ 31.387887][ T634] rust_binder: Write failure EFAULT in pid:57 [ 31.424644][ T45] usb 2-1: Detected FT232B [ 31.483030][ T640] netlink: 'syz.0.87': attribute type 13 has an invalid length. [ 31.553988][ T31] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 31.574937][ T31] usb 4-1: device descriptor read/8, error -71 [ 31.705025][ T31] usb 4-1: device descriptor read/8, error -71 [ 31.814110][ T31] usb usb4-port1: unable to enumerate USB device [ 31.825706][ T45] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 31.833330][ T45] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 31.843253][ T45] usb 2-1: USB disconnect, device number 4 [ 31.851083][ T45] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 31.860764][ T45] ftdi_sio 2-1:0.0: device disconnected [ 32.068526][ T45] usb 3-1: USB disconnect, device number 3 [ 32.083155][ T642] rust_binder: Write failure EINVAL in pid:52 [ 32.385861][ T665] rust_binder: 65: no such ref 2 [ 32.397389][ T665] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 32.407606][ T665] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 120, limit: 144, size: 97) [ 32.407630][ T665] rust_binder: Error while translating object. [ 32.422908][ T665] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 32.429669][ T665] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:65 [ 32.439461][ T672] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 32.566366][ T36] kauditd_printk_skb: 59 callbacks suppressed [ 32.566385][ T36] audit: type=1400 audit(1756314621.670:261): avc: denied { unmount } for pid=289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 32.636823][ T692] rust_binder: Failed to allocate buffer. len:216, is_oneway:false [ 32.637147][ T693] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 32.713930][ T45] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 32.727980][ T31] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 32.740479][ T700] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 32.893911][ T45] usb 3-1: Using ep0 maxpacket: 16 [ 32.904518][ T333] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 32.907269][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 32.923004][ T31] usb 4-1: config 0 has no interfaces? [ 32.923071][ T45] usb 3-1: config 0 has no interfaces? [ 32.934227][ T31] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 32.943295][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.953964][ T45] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 32.966323][ T45] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.981515][ T31] usb 4-1: config 0 descriptor?? [ 32.990556][ T45] usb 3-1: config 0 descriptor?? [ 32.995957][ T36] audit: type=1400 audit(1756314622.090:262): avc: denied { ioctl } for pid=702 comm="syz.1.107" path="/dev/input/event2" dev="devtmpfs" ino=208 ioctlcmd=0x4581 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 33.075018][ T333] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 33.086244][ T333] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 33.097106][ T333] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 33.108105][ T333] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 33.120775][ T333] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 33.129855][ T333] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.137963][ T333] usb 1-1: Product: syz [ 33.142209][ T333] usb 1-1: Manufacturer: syz [ 33.147086][ T333] usb 1-1: SerialNumber: syz [ 33.152640][ T697] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 33.160488][ T333] cdc_mbim 1-1:1.0: skipping garbage [ 33.202408][ T31] usb 4-1: USB disconnect, device number 6 [ 33.239764][ T45] usb 3-1: USB disconnect, device number 4 [ 33.283936][ T10] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 33.331079][ T36] audit: type=1400 audit(1756314622.430:263): avc: denied { bind } for pid=712 comm="syz.3.109" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 33.338389][ T713] netlink: 12 bytes leftover after parsing attributes in process `syz.3.109'. [ 33.360633][ T36] audit: type=1400 audit(1756314622.460:264): avc: denied { read write } for pid=712 comm="syz.3.109" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 33.361429][ T697] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 33.386459][ T36] audit: type=1400 audit(1756314622.460:265): avc: denied { open } for pid=712 comm="syz.3.109" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 33.392496][ T697] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 33.436194][ T36] audit: type=1400 audit(1756314622.530:266): avc: denied { setopt } for pid=714 comm="syz.3.110" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 33.462547][ T715] rust_binder: Error while translating object. [ 33.462635][ T715] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 33.469090][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 33.476478][ T715] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:78 [ 33.479331][ T10] usb 2-1: too many configurations: 65, using maximum allowed: 8 [ 33.501379][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.517740][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.528642][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.539514][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.550342][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.561236][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.572078][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.584376][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 33.594546][ T10] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 33.606993][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.616767][ T10] usb 2-1: config 0 descriptor?? [ 33.624977][ T10] hub 2-1:0.0: Invalid hub with more than one config or interface [ 33.633575][ T10] hub 2-1:0.0: probe with driver hub failed with error -22 [ 33.664271][ T722] /dev/nbd3: Can't lookup blockdev [ 33.832382][ T10] usb 2-1: USB disconnect, device number 5 [ 33.845648][ T736] overlayfs: missing 'lowerdir' [ 33.853521][ T736] rust_binder: Write failure EFAULT in pid:79 [ 34.038622][ T697] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 34.052469][ T697] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 34.062753][ T333] cdc_mbim 1-1:1.0: setting rx_max = 16384 [ 34.102473][ T36] audit: type=1400 audit(1756314623.200:267): avc: denied { read } for pid=744 comm="syz.3.122" name="msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 34.124985][ T36] audit: type=1400 audit(1756314623.200:268): avc: denied { open } for pid=744 comm="syz.3.122" path="/dev/cpu/0/msr" dev="devtmpfs" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 34.153188][ T749] Zero length message leads to an empty skb [ 34.222640][ T36] audit: type=1400 audit(1756314623.320:269): avc: denied { write } for pid=750 comm="syz.3.124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 34.222880][ T753] netlink: 'syz.3.124': attribute type 16 has an invalid length. [ 34.250936][ T751] netlink: 'syz.3.124': attribute type 16 has an invalid length. [ 34.251772][ T754] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.259414][ T753] rust_binder: Error while translating object. [ 34.259425][ T751] rust_binder: Error while translating object. [ 34.259447][ T751] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 34.268825][ T753] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 34.272497][ T751] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:107 [ 34.293949][ T753] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:107 [ 34.317865][ T333] cdc_mbim 1-1:1.0: setting tx_max = 16384 [ 34.340642][ T333] cdc_mbim 1-1:1.0: cdc-wdm0: USB WDM device [ 34.347535][ T333] wwan wwan0: port wwan0mbim0 attached [ 34.366166][ T333] cdc_mbim 1-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.0-1, CDC MBIM, e2:0b:25:8c:82:9f [ 34.388658][ T333] usb 1-1: USB disconnect, device number 4 [ 34.397806][ T333] cdc_mbim 1-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.0-1, CDC MBIM [ 34.479535][ T771] capability: warning: `syz.3.130' uses 32-bit capabilities (legacy support in use) [ 34.490151][ T333] wwan wwan0: port wwan0mbim0 disconnected [ 34.558036][ T36] audit: type=1400 audit(1756314623.660:270): avc: denied { getopt } for pid=775 comm="syz.3.132" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.650128][ T785] fuse: Bad value for 'user_id' [ 34.655169][ T785] fuse: Bad value for 'user_id' [ 34.673902][ T10] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 34.688976][ T785] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 34.689016][ T785] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:108 [ 34.714633][ T788] incfs: Options parsing error. -22 [ 34.729180][ T788] incfs: mount failed -22 [ 34.734133][ T788] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 34.785196][ T792] rust_binder: Write failure EINVAL in pid:111 [ 34.833909][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 34.864848][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 34.876209][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 34.886193][ T10] usb 3-1: New USB device found, idVendor=05ac, idProduct=024b, bcdDevice= 0.00 [ 34.895570][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 34.908416][ T10] usb 3-1: config 0 descriptor?? [ 35.033923][ T737] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 35.141962][ T800] rust_binder: 799 RLIMIT_NICE not set [ 35.163971][ T737] usb 4-1: device descriptor read/64, error -71 [ 35.182143][ T45] rust_binder: 798: removing orphan mapping 0:4248 [ 35.221697][ T807] IPv6: NLM_F_CREATE should be specified when creating new route [ 35.315843][ T766] binfmt_misc: register: failed to install interpreter file ./file0 [ 35.325654][ T10] apple 0003:05AC:024B.0001: unknown global tag 0xe [ 35.332500][ T10] apple 0003:05AC:024B.0001: item 0 1 1 14 parsing failed [ 35.340022][ T10] apple 0003:05AC:024B.0001: parse failed [ 35.345985][ T10] apple 0003:05AC:024B.0001: probe with driver apple failed with error -22 [ 35.413927][ T737] usb 4-1: device descriptor read/64, error -71 [ 35.534755][ T766] fuseblk: Bad value for 'group_id' [ 35.540124][ T766] fuseblk: Bad value for 'group_id' [ 35.546399][ T10] usb 3-1: USB disconnect, device number 5 [ 35.653936][ T737] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 35.793930][ T737] usb 4-1: device descriptor read/64, error -71 [ 36.033936][ T737] usb 4-1: device descriptor read/64, error -71 [ 36.085307][ T819] rust_binder: Error while translating object. [ 36.085367][ T819] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 36.091796][ T819] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:85 [ 36.097951][ T824] 9pnet_fd: Insufficient options for proto=fd [ 36.152816][ T737] usb usb4-port1: attempt power cycle [ 36.349469][ T839] rust_binder: Write failure EINVAL in pid:99 [ 36.363920][ T64] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 36.503934][ T737] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 36.524978][ T737] usb 4-1: device descriptor read/8, error -71 [ 36.533922][ T64] usb 1-1: Using ep0 maxpacket: 32 [ 36.540354][ T64] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 36.548631][ T64] usb 1-1: config 0 has no interface number 0 [ 36.556793][ T64] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 36.565815][ T852] netlink: 4 bytes leftover after parsing attributes in process `syz.2.155'. [ 36.567894][ T64] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.582938][ T64] usb 1-1: Product: syz [ 36.587183][ T64] usb 1-1: Manufacturer: syz [ 36.591799][ T64] usb 1-1: SerialNumber: syz [ 36.597251][ T64] usb 1-1: config 0 descriptor?? [ 36.603115][ T64] smsc95xx v2.0.0 [ 36.655165][ T737] usb 4-1: device descriptor read/8, error -71 [ 36.894023][ T737] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 36.915112][ T737] usb 4-1: device descriptor read/8, error -71 [ 36.973953][ T544] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 37.003495][ T64] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 37.014560][ T64] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 37.045114][ T737] usb 4-1: device descriptor read/8, error -71 [ 37.123937][ T544] usb 3-1: Using ep0 maxpacket: 16 [ 37.130320][ T544] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 37.140537][ T544] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 37.151114][ T544] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 37.160268][ T544] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.164054][ T737] usb usb4-port1: unable to enumerate USB device [ 37.168532][ T544] usb 3-1: Product: 璡띜ﴼ겜꘠쟝ྼḌꆌ㗠∩㧌됬痱ً뤰䌮囚셠鷤漰޽ᠱᏗꪑ⫫⇵⽐꠳䣼࡛굖빁颩໢ඳ韊駲糎䵻謁륮䩜◚챛瘪ի퓕㨽芠돎᳒廃삝笫㌍忝˵˩ᒄល앏돷젤ꍬ᪬陶踃옡霭悝玧穰⒡腦 [ 37.204388][ T864] rust_binder: Write failure EINVAL in pid:130 [ 37.208714][ T544] usb 3-1: Manufacturer: Ы [ 37.226593][ T544] usb 3-1: SerialNumber: 鉛ꝝਃ鿺㦈ꘆ劍͗櫢뀐灵쐲皘難鴲씨巖悈싃ᥝ仟㶱睊璭컰ￅ꫞༂簷₰Ǽ솫렍뜦돱䥀䖳䙳呾㓋휖껚↳㦩桍恈䶁 [ 37.445504][ T64] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 37.457875][ T64] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 37.467850][ T64] usb 1-1: USB disconnect, device number 5 [ 37.514149][ T737] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 37.663966][ T737] usb 2-1: Using ep0 maxpacket: 16 [ 37.669819][ T860] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.678587][ T860] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.686809][ T737] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 37.687253][ T860] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.699162][ T737] usb 2-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 37.706428][ T860] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.716505][ T737] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.730850][ T737] usb 2-1: Product: syz [ 37.735058][ T737] usb 2-1: Manufacturer: syz [ 37.739762][ T737] usb 2-1: SerialNumber: syz [ 37.745527][ T737] usb 2-1: config 0 descriptor?? [ 37.751593][ T737] hub 2-1:0.0: bad descriptor, ignoring hub [ 37.757562][ T737] hub 2-1:0.0: probe with driver hub failed with error -5 [ 37.822167][ T36] kauditd_printk_skb: 14 callbacks suppressed [ 37.822185][ T36] audit: type=1400 audit(1756314626.920:285): avc: denied { write } for pid=870 comm="syz.3.161" path="socket:[6890]" dev="sockfs" ino=6890 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.927724][ T36] audit: type=1400 audit(1756314627.030:286): avc: denied { remount } for pid=874 comm="syz.3.162" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 37.954946][ T866] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 37.954983][ T866] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:132 [ 37.978256][ T36] audit: type=1400 audit(1756314627.080:287): avc: denied { ioctl } for pid=879 comm="syz.3.163" path="socket:[6909]" dev="sockfs" ino=6909 ioctlcmd=0x8907 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 38.014093][ T36] audit: type=1400 audit(1756314627.090:288): avc: denied { create } for pid=879 comm="syz.3.163" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 38.178735][ T36] audit: type=1400 audit(1756314627.280:289): avc: denied { read write } for pid=889 comm="syz.3.167" name="uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 38.190881][ T890] UHID_CREATE from different security context by process 148 (syz.3.167), this is not allowed. [ 38.202380][ T36] audit: type=1400 audit(1756314627.280:290): avc: denied { open } for pid=889 comm="syz.3.167" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 38.243923][ T64] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 38.265284][ T36] audit: type=1400 audit(1756314627.370:291): avc: denied { create } for pid=889 comm="syz.3.167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 38.286421][ T891] rust_binder: Error in use_page_slow: ESRCH [ 38.286448][ T891] rust_binder: use_range failure ESRCH [ 38.292460][ T891] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 38.298029][ T891] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 38.305904][ T891] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:148 [ 38.405412][ T64] usb 1-1: New USB device found, idVendor=5543, idProduct=004d, bcdDevice= 0.00 [ 38.423620][ T64] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.432523][ T64] usb 1-1: config 0 descriptor?? [ 38.878770][ T64] usbhid 1-1:0.0: can't add hid device: -71 [ 38.889622][ T64] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 38.905978][ T64] usb 1-1: USB disconnect, device number 6 [ 39.105232][ T926] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:152 [ 39.151495][ T36] audit: type=1400 audit(1756314628.250:292): avc: denied { getopt } for pid=928 comm="syz.0.176" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 39.392902][ T53] Bluetooth: hci0: sending frame failed (-49) [ 39.399148][ T948] Bluetooth: hci0: Opcode 0x1003 failed: -49 [ 39.474065][ T560] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 39.628775][ T544] usb 3-1: 0:2 : does not exist [ 39.635085][ T560] usb 4-1: Using ep0 maxpacket: 32 [ 39.642383][ T544] usb 3-1: USB disconnect, device number 6 [ 39.651206][ T560] usb 4-1: config 4 has an invalid interface number: 128 but max is 0 [ 39.661009][ T737] usb 2-1: USB disconnect, device number 6 [ 39.661247][ T560] usb 4-1: config 4 has no interface number 0 [ 39.676407][ T560] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.695932][ T560] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 39.706930][ T332] udevd[332]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 39.711436][ T560] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 39.748708][ T560] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.765974][ T560] hub 4-1:4.128: USB hub found [ 39.855874][ T36] audit: type=1326 audit(1756314628.960:293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=958 comm="syz.1.183" exe="/root/syz-executor" sig=31 arch=c000003e syscall=39 compat=0 ip=0x7f77a5785ba7 code=0x0 [ 39.951922][ T36] audit: type=1400 audit(1756314629.050:294): avc: denied { mount } for pid=968 comm="syz.0.185" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 39.974616][ T560] hub 4-1:4.128: 6 ports detected [ 39.981993][ T560] hub 4-1:4.128: Using single TT (err -22) [ 39.988992][ T560] hub 4-1:4.128: insufficient power available to use all downstream ports [ 40.127022][ T989] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 40.243401][ T996] 9pnet_fd: Insufficient options for proto=fd [ 40.409198][ T1019] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:138 [ 40.415581][ T1019] SELinux: Context system_u:object_r:xen_device_t:s0 is not valid (left unmapped). [ 40.546216][ T1023] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 40.588879][ T560] usb 4-1: USB disconnect, device number 11 [ 40.659450][ T31] rust_binder: 1024: removing orphan mapping 0:24 [ 40.667033][ T31] rust_binder: 0: removing orphan mapping 24:96 [ 40.689005][ T1039] rust_binder: 144: no such ref 1 [ 40.824151][ T1071] rust_binder: Error while translating object. [ 40.824203][ T1071] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 40.830575][ T1071] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:138 [ 40.855795][ T1073] netlink: 'syz.2.220': attribute type 5 has an invalid length. [ 40.873183][ T1073] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.220'. [ 40.916642][ T1075] binder: Unknown parameter '' [ 41.053921][ T9] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 41.223901][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 41.234874][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 41.245115][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 41.255615][ T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 41.264842][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.272863][ T9] usb 2-1: Product: syz [ 41.277274][ T9] usb 2-1: Manufacturer: syz [ 41.281998][ T9] usb 2-1: SerialNumber: syz [ 41.315840][ T1099] x_tables: duplicate underflow at hook 1 [ 41.423915][ T737] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 41.491391][ T9] usb 2-1: 0:2 : does not exist [ 41.499714][ T9] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 41.511449][ T9] usb 2-1: USB disconnect, device number 7 [ 41.530178][ T757] udevd[757]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 41.583934][ T31] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 41.595417][ T737] usb 4-1: config index 0 descriptor too short (expected 8475, got 27) [ 41.603983][ T737] usb 4-1: config 0 has an invalid interface number: 200 but max is 0 [ 41.612166][ T737] usb 4-1: config 0 has no interface number 0 [ 41.618384][ T737] usb 4-1: config 0 interface 200 altsetting 2 endpoint 0x4 has invalid wMaxPacketSize 0 [ 41.628305][ T737] usb 4-1: config 0 interface 200 has no altsetting 0 [ 41.636822][ T737] usb 4-1: New USB device found, idVendor=0b57, idProduct=8528, bcdDevice=6d.1a [ 41.645966][ T737] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.654183][ T737] usb 4-1: Product: syz [ 41.658356][ T737] usb 4-1: Manufacturer: syz [ 41.662945][ T737] usb 4-1: SerialNumber: syz [ 41.668320][ T737] usb 4-1: config 0 descriptor?? [ 41.736053][ T31] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 41.746289][ T31] usb 1-1: config 1 interface 0 altsetting 181 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 41.759394][ T31] usb 1-1: config 1 interface 0 has no altsetting 0 [ 41.767576][ T31] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 41.776688][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 41.784751][ T31] usb 1-1: Product: ˝憒㑆ఠ㷆乖䢋듖略鲈䘈苬㿓鈓ꊐݜㄿ↦裌莡ꉳ咆纥㉸從ழ讧걿⨔亓뉭얄슀葋䤝빗馿㞘톷注栴享◗◧報ꓨ莏藷⢞덥ﯕ좢떸枱嘯떦摵﹧겥鈐ᜇ䤬漳 [ 41.806260][ T31] usb 1-1: SerialNumber: syz [ 42.015445][ T31] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -22 [ 42.028288][ T31] usb 1-1: USB disconnect, device number 7 [ 42.105063][ T1108] __vm_enough_memory: pid: 1108, comm: syz.1.232, bytes: 18014402804453376 not enough memory for the allocation [ 42.146245][ T737] input: Hanwang Art Master III 0906 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.200/input/input4 [ 42.175396][ T737] usb 4-1: USB disconnect, device number 12 [ 42.873715][ T1135] netlink: 16 bytes leftover after parsing attributes in process `syz.3.242'. [ 42.884394][ T1136] overlayfs: overlapping lowerdir path [ 42.914051][ T1140] rust_binder: Read failure Err(EFAULT) in pid:171 [ 42.945607][ T1142] netlink: 'syz.1.244': attribute type 4 has an invalid length. [ 42.960007][ T1142] netlink: 'syz.1.244': attribute type 21 has an invalid length. [ 42.968060][ T1142] netlink: 3657 bytes leftover after parsing attributes in process `syz.1.244'. [ 43.133958][ T737] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 43.283914][ T737] usb 4-1: Using ep0 maxpacket: 32 [ 43.290380][ T737] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 43.298820][ T737] usb 4-1: config 0 has no interface number 0 [ 43.305153][ T737] usb 4-1: config 0 interface 184 has no altsetting 0 [ 43.313424][ T737] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 43.322623][ T737] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.330680][ T737] usb 4-1: Product: syz [ 43.334933][ T737] usb 4-1: Manufacturer: syz [ 43.339546][ T737] usb 4-1: SerialNumber: syz [ 43.344998][ T737] usb 4-1: config 0 descriptor?? [ 43.351165][ T737] smsc75xx v1.0.0 [ 43.570249][ T737] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 43.583894][ T737] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 43.596100][ T737] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 43.618669][ T737] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 43.633323][ T737] usb 4-1: USB disconnect, device number 13 [ 43.707820][ T10] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 43.721828][ T10] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 43.735002][ T1164] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 43.735107][ T1164] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 43.863924][ T560] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 44.025454][ T560] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 44.034288][ T560] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 44.044469][ T560] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 44.053354][ T560] usb 1-1: config 1 has no interface number 0 [ 44.059519][ T560] usb 1-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 44.070339][ T560] usb 1-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 44.076484][ T36] kauditd_printk_skb: 17 callbacks suppressed [ 44.076506][ T36] audit: type=1400 audit(1756314633.170:312): avc: denied { block_suspend } for pid=1176 comm="syz.2.256" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 44.084997][ T560] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 44.125340][ T560] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.133449][ T560] usb 1-1: Product: syz [ 44.138544][ T560] usb 1-1: Manufacturer: syz [ 44.143231][ T560] usb 1-1: SerialNumber: syz [ 44.161958][ T36] audit: type=1400 audit(1756314633.260:313): avc: denied { create } for pid=1185 comm="syz.1.258" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 44.172222][ T1186] rust_binder: 252: no such ref 4294967293 [ 44.188765][ T36] audit: type=1400 audit(1756314633.270:314): avc: denied { write } for pid=1185 comm="syz.1.258" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_nflog_socket permissive=1 [ 44.213925][ T36] audit: type=1400 audit(1756314633.270:315): avc: denied { map } for pid=1185 comm="syz.1.258" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=9764 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 44.244395][ T36] audit: type=1400 audit(1756314633.270:316): avc: denied { read write } for pid=1185 comm="syz.1.258" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=9764 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 44.429516][ T36] audit: type=1326 audit(1756314633.530:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1223 comm="syz.1.263" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f77a578ebe9 code=0x0 [ 44.553517][ T560] usb 1-1: USB disconnect, device number 8 [ 44.590335][ T1239] capability: warning: `syz.3.268' uses deprecated v2 capabilities in a way that may be insecure [ 44.756803][ T36] audit: type=1400 audit(1756314633.860:318): avc: denied { mounton } for pid=1236 comm="syz.3.268" path="/59/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 45.270230][ T36] audit: type=1400 audit(1756314634.370:319): avc: denied { write } for pid=1252 comm="syz.2.272" name="ptype" dev="proc" ino=4026532322 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 45.293531][ T1253] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:198 [ 45.343931][ T10] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 45.518211][ T10] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 45.529231][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 45.540423][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 45.557530][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 45.571565][ T10] usb 1-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 45.585605][ T10] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 45.594069][ T10] usb 1-1: Manufacturer: syz [ 45.604360][ T10] usb 1-1: config 0 descriptor?? [ 45.633558][ T1263] netlink: 8 bytes leftover after parsing attributes in process `syz.3.276'. [ 45.662062][ T1268] rust_binder: Write failure EFAULT in pid:202 [ 45.673905][ T560] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 45.764123][ T9] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 45.843904][ T560] usb 3-1: Using ep0 maxpacket: 16 [ 45.850341][ T560] usb 3-1: config 0 has an invalid descriptor of length 224, skipping remainder of the config [ 45.860879][ T560] usb 3-1: config 0 has no interfaces? [ 45.866407][ T560] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 45.875591][ T560] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.888013][ T560] usb 3-1: config 0 descriptor?? [ 45.925049][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 45.936094][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 45.945889][ T9] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 45.957042][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.967283][ T9] usb 2-1: config 0 descriptor?? [ 46.013700][ T10] appleir 0003:05AC:8243.0003: unknown main item tag 0x0 [ 46.021087][ T10] appleir 0003:05AC:8243.0003: No inputs registered, leaving [ 46.031293][ T10] appleir 0003:05AC:8243.0003: hiddev96,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.0-1/input0 [ 46.214947][ T10] usb 1-1: USB disconnect, device number 9 [ 46.376943][ T9] pyra 0003:1E7D:2CF6.0004: unknown main item tag 0x0 [ 46.383811][ T9] pyra 0003:1E7D:2CF6.0004: unknown main item tag 0x0 [ 46.392235][ T9] pyra 0003:1E7D:2CF6.0004: unknown main item tag 0x0 [ 46.399430][ T9] pyra 0003:1E7D:2CF6.0004: unknown main item tag 0x0 [ 46.406331][ T9] pyra 0003:1E7D:2CF6.0004: unknown main item tag 0x0 [ 46.413206][ T9] pyra 0003:1E7D:2CF6.0004: unknown main item tag 0x0 [ 46.420079][ T9] pyra 0003:1E7D:2CF6.0004: unknown main item tag 0x0 [ 46.427616][ T9] pyra 0003:1E7D:2CF6.0004: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.1-1/input0 [ 46.576274][ T9] pyra 0003:1E7D:2CF6.0004: couldn't init struct pyra_device [ 46.583778][ T9] pyra 0003:1E7D:2CF6.0004: couldn't install mouse [ 46.591045][ T9] pyra 0003:1E7D:2CF6.0004: probe with driver pyra failed with error -32 [ 46.763898][ T1289] fuse: Bad value for 'fd' [ 46.768721][ T1289] fuse: Invalid rootmode [ 46.774954][ T1289] rust_binder: Read failure Err(EFAULT) in pid:171 [ 46.785911][ T1293] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.793012][ T1293] rust_binder: Failed to vm_insert_page(35184388857856): vma_addr:35184388853760 i:1 err:EFAULT [ 46.800550][ T1293] rust_binder: Error in use_page_slow: EFAULT [ 46.800801][ T1292] rust_binder: Failed to vm_insert_page(35184388857856): vma_addr:35184388853760 i:1 err:EFAULT [ 46.811075][ T1293] rust_binder: use_range failure EFAULT [ 46.817866][ T1292] rust_binder: Error in use_page_slow: EFAULT [ 46.833398][ T1292] rust_binder: use_range failure EFAULT [ 46.834790][ T1293] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 46.845445][ T1293] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 46.851150][ T1292] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 46.855731][ T1293] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:174 [ 46.863429][ T1292] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 46.880558][ T1292] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:174 [ 47.046857][ T1306] netlink: 8 bytes leftover after parsing attributes in process `syz.3.291'. [ 47.965909][ T36] audit: type=1400 audit(1756314637.070:320): avc: denied { setopt } for pid=1316 comm="syz.0.296" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 47.985576][ T36] audit: type=1400 audit(1756314637.080:321): avc: denied { write } for pid=1316 comm="syz.0.296" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 48.073660][ T1312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.083471][ T1312] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.397977][ T560] usb 3-1: USB disconnect, device number 7 [ 48.603280][ T737] usb 2-1: USB disconnect, device number 8 [ 48.668971][ T1325] SELinux: policydb table sizes (0,0) do not match mine (8,7) [ 48.687127][ T1325] SELinux: failed to load policy [ 48.895116][ T1335] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.970271][ T1343] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.977404][ T1342] netlink: 'syz.0.307': attribute type 4 has an invalid length. [ 48.992330][ T1342] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 48.999730][ T1342] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:196 [ 49.065280][ T9] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 49.179613][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 49.192476][ T1363] rust_binder: Write failure EFAULT in pid:205 [ 49.223428][ T1366] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 49.225206][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 129, changing to 11 [ 49.229781][ T1366] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:204 [ 49.237132][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 49.268821][ T9] usb 2-1: New USB device found, idVendor=2179, idProduct=0077, bcdDevice= 0.00 [ 49.278024][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.287233][ T9] usb 2-1: config 0 descriptor?? [ 49.437718][ T1374] binder: Unknown parameter 'defcontext01777777777777777777777' [ 49.477172][ T1376] rust_binder: Error while translating object. [ 49.477224][ T1376] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 49.484001][ T1376] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:213 [ 49.568808][ T36] kauditd_printk_skb: 5 callbacks suppressed [ 49.568836][ T36] audit: type=1400 audit(1756314638.670:327): avc: denied { execheap } for pid=1377 comm="syz.0.321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 49.571895][ T1379] cgroup2: Unknown parameter 'freezer' [ 49.627339][ T1382] syzkaller0: entered allmulticast mode [ 49.633189][ T1382] syzkaller0: entered promiscuous mode [ 49.640390][ T1382] syzkaller0 (unregistering): left promiscuous mode [ 49.647090][ T1382] syzkaller0 (unregistering): left allmulticast mode [ 49.700253][ T9] uclogic 0003:2179:0077.0005: interface is invalid, ignoring [ 49.727548][ T1385] netlink: 104 bytes leftover after parsing attributes in process `syz.0.323'. [ 49.727564][ T36] audit: type=1400 audit(1756314638.830:328): avc: denied { nlmsg_read } for pid=1384 comm="syz.0.323" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 49.745427][ T1385] input: syz1 as /devices/virtual/input/input5 [ 49.779328][ T1387] tipc: Can't bind to reserved service type 0 [ 49.901467][ T544] usb 2-1: USB disconnect, device number 9 [ 49.934285][ T1395] netlink: 'syz.2.328': attribute type 4 has an invalid length. [ 49.943995][ T1395] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 49.963793][ T1402] 9pnet_fd: Insufficient options for proto=fd [ 49.979529][ T36] audit: type=1400 audit(1756314639.080:329): avc: denied { write } for pid=1404 comm="syz.0.331" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 49.984554][ T1405] netlink: 8 bytes leftover after parsing attributes in process `syz.0.331'. [ 50.013675][ T1405] netlink: 20 bytes leftover after parsing attributes in process `syz.0.331'. [ 50.023128][ T36] audit: type=1400 audit(1756314639.120:330): avc: denied { append } for pid=1404 comm="syz.0.331" name="ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 50.678418][ T1424] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 50.852592][ T36] audit: type=1400 audit(1756314639.950:331): avc: denied { create } for pid=1435 comm="syz.1.343" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 50.895540][ T1438] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 50.895574][ T1438] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:216 [ 50.911875][ T36] audit: type=1400 audit(1756314640.010:332): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 51.017537][ T1441] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 51.086317][ T544] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 51.193896][ T948] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 51.193997][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 51.249084][ T544] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 51.261568][ T1453] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 51.261805][ T1453] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:229 [ 51.266385][ T544] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 51.290371][ T544] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 51.321451][ T544] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 51.332353][ T544] usb 2-1: SerialNumber: syz [ 51.542366][ T544] usb 2-1: 0:2 : does not exist [ 51.551398][ T544] usb 2-1: USB disconnect, device number 10 [ 51.563912][ T10] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 51.581638][ T757] udevd[757]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 51.723899][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 51.730264][ T10] usb 3-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 51.741307][ T10] usb 3-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 51.751163][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 51.758118][ T10] usb 3-1: New USB device found, idVendor=056a, idProduct=00bb, bcdDevice= 0.00 [ 51.767228][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.779326][ T10] usb 3-1: config 0 descriptor?? [ 51.989347][ T10] wacom 0003:056A:00BB.0006: unknown main item tag 0x0 [ 51.996921][ T10] wacom 0003:056A:00BB.0006: unknown main item tag 0x0 [ 52.004196][ T10] wacom 0003:056A:00BB.0006: unknown main item tag 0x0 [ 52.011749][ T10] wacom 0003:056A:00BB.0006: unknown main item tag 0x0 [ 52.019120][ T10] wacom 0003:056A:00BB.0006: unknown main item tag 0x0 [ 52.034187][ T10] wacom 0003:056A:00BB.0006: Unknown device_type for 'HID 056a:00bb'. Assuming pen. [ 52.048835][ T10] wacom 0003:056A:00BB.0006: hidraw0: USB HID v0.00 Device [HID 056a:00bb] on usb-dummy_hcd.2-1/input0 [ 52.093948][ T10] input: Wacom Intuos4 12x19 Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:056A:00BB.0006/input/input6 [ 52.130144][ T10] usb 3-1: USB disconnect, device number 8 [ 52.230868][ T1518] fuse: Bad value for 'rootmode' [ 52.536536][ T544] rust_binder: 1521: removing orphan mapping 0:24 [ 52.583100][ T36] audit: type=1400 audit(1756314641.680:333): avc: denied { setopt } for pid=1538 comm="syz.3.379" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 52.615399][ T1543] /dev/rnullb0: Can't open blockdev [ 52.813940][ T544] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 52.908236][ T36] audit: type=1400 audit(1756314642.010:334): avc: denied { mount } for pid=1565 comm="syz.2.388" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 52.963902][ T544] usb 4-1: device descriptor read/64, error -71 [ 53.111817][ T36] audit: type=1400 audit(1756314642.210:335): avc: denied { ioctl } for pid=1574 comm="syz.2.391" path="socket:[11939]" dev="sockfs" ino=11939 ioctlcmd=0x8981 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 53.157743][ T36] audit: type=1400 audit(1756314642.260:336): avc: denied { read } for pid=1576 comm="syz.1.392" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 53.203922][ T544] usb 4-1: device descriptor read/64, error -71 [ 53.233411][ T1584] tipc: Enabling of bearer rejected, media not registered [ 53.269465][ T1592] rust_binder: 331: no such ref 2 [ 53.281214][ T1594] SELinux: Context system_u:object_r:systemd_logger_exec_t:s0 is not valid (left unmapped). [ 53.313677][ T1597] __vm_enough_memory: pid: 1597, comm: syz.2.399, bytes: 18014402804453376 not enough memory for the allocation [ 53.325659][ T1597] __vm_enough_memory: pid: 1597, comm: syz.2.399, bytes: 18014402804453376 not enough memory for the allocation [ 53.337790][ T1597] __vm_enough_memory: pid: 1597, comm: syz.2.399, bytes: 18014402804453376 not enough memory for the allocation [ 53.349946][ T1597] __vm_enough_memory: pid: 1597, comm: syz.2.399, bytes: 18014402804453376 not enough memory for the allocation [ 53.362316][ T1597] __vm_enough_memory: pid: 1597, comm: syz.2.399, bytes: 18014402804453376 not enough memory for the allocation [ 53.374365][ T1597] __vm_enough_memory: pid: 1597, comm: syz.2.399, bytes: 18014402804453376 not enough memory for the allocation [ 53.386286][ T1597] __vm_enough_memory: pid: 1597, comm: syz.2.399, bytes: 18014402804453376 not enough memory for the allocation [ 53.398333][ T1597] __vm_enough_memory: pid: 1597, comm: syz.2.399, bytes: 18014402804453376 not enough memory for the allocation [ 53.410367][ T1597] __vm_enough_memory: pid: 1597, comm: syz.2.399, bytes: 18014402804453376 not enough memory for the allocation [ 53.422371][ T1597] __vm_enough_memory: pid: 1597, comm: syz.2.399, bytes: 18014402804453376 not enough memory for the allocation [ 53.453923][ T544] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 53.572986][ T1602] kvm: kvm [1601]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010015) = 0x200000000080 [ 53.585019][ T544] usb 4-1: device descriptor read/64, error -71 [ 53.683962][ T737] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 53.770360][ T1608] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 53.809800][ T1610] SELinux: policydb table sizes (0,0) do not match mine (8,7) [ 53.817508][ T1610] SELinux: failed to load policy [ 53.822722][ T1610] hub 6-0:1.0: USB hub found [ 53.827387][ T544] usb 4-1: device descriptor read/64, error -71 [ 53.827870][ T1610] hub 6-0:1.0: 1 port detected [ 53.843904][ T737] usb 3-1: Using ep0 maxpacket: 16 [ 53.850314][ T737] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 53.860455][ T737] usb 3-1: New USB device found, idVendor=04b3, idProduct=3103, bcdDevice= 0.00 [ 53.869790][ T737] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.879064][ T737] usb 3-1: config 0 descriptor?? [ 53.934069][ T544] usb usb4-port1: attempt power cycle [ 54.116422][ T1619] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:333 [ 54.283915][ T544] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 54.315133][ T544] usb 4-1: device descriptor read/8, error -71 [ 54.444973][ T544] usb 4-1: device descriptor read/8, error -71 [ 54.543925][ T737] usbhid 3-1:0.0: can't add hid device: -71 [ 54.550029][ T737] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 54.559785][ T737] usb 3-1: USB disconnect, device number 9 [ 54.683940][ T544] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 54.704966][ T544] usb 4-1: device descriptor read/8, error -71 [ 54.805316][ T36] kauditd_printk_skb: 8 callbacks suppressed [ 54.805334][ T36] audit: type=1400 audit(1756314643.910:345): avc: denied { accept } for pid=1630 comm="syz.0.412" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 54.838878][ T1634] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 54.838916][ T1634] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:280 [ 54.856529][ T544] usb 4-1: device descriptor read/8, error -71 [ 54.880901][ T1643] binder: Unknown parameter 'Z10'쵕' [ 54.994011][ T544] usb usb4-port1: unable to enumerate USB device [ 55.017025][ T1657] incfs: Options parsing error. -22 [ 55.022328][ T1657] incfs: mount failed -22 [ 55.121602][ T1665] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 55.121633][ T1665] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:358 [ 55.177766][ T1667] rust_binder: 360: no such ref 2 [ 55.303932][ T737] usb 3-1: new low-speed USB device number 10 using dummy_hcd [ 55.453903][ T737] usb 3-1: Invalid ep0 maxpacket: 64 [ 55.593947][ T737] usb 3-1: new low-speed USB device number 11 using dummy_hcd [ 55.641675][ T36] audit: type=1400 audit(1756314644.740:346): avc: denied { mount } for pid=1677 comm="syz.0.429" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 55.664397][ T1678] incfs: Can't find or create .index dir in ./bus [ 55.670993][ T1678] incfs: mount failed -1 [ 55.675868][ T1678] incfs: Can't find or create .index dir in ./bus [ 55.682453][ T1678] incfs: mount failed -1 [ 55.687422][ T36] audit: type=1400 audit(1756314644.770:347): avc: denied { mounton } for pid=1677 comm="syz.0.429" path="/bus" dev="sysfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 55.722169][ T36] audit: type=1326 audit(1756314644.820:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1682 comm="syz.0.430" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0b0b18ebe9 code=0x0 [ 55.763899][ T737] usb 3-1: Invalid ep0 maxpacket: 64 [ 55.769368][ T737] usb usb3-port1: attempt power cycle [ 55.871317][ T36] audit: type=1400 audit(1756314644.970:349): avc: denied { create } for pid=1695 comm="syz.0.433" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 55.898182][ T36] audit: type=1400 audit(1756314645.000:350): avc: denied { create } for pid=1695 comm="syz.0.433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 55.918598][ T36] audit: type=1400 audit(1756314645.020:351): avc: denied { sys_admin } for pid=1695 comm="syz.0.433" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 55.994267][ T10] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 56.113903][ T737] usb 3-1: new low-speed USB device number 12 using dummy_hcd [ 56.129303][ T1708] netlink: 'syz.0.437': attribute type 9 has an invalid length. [ 56.144299][ T737] usb 3-1: Invalid ep0 maxpacket: 64 [ 56.153914][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 56.160230][ T10] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 56.169551][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 56.178706][ T10] usb 4-1: config 0 descriptor?? [ 56.189360][ T1709] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 56.273893][ T737] usb 3-1: new low-speed USB device number 13 using dummy_hcd [ 56.304399][ T737] usb 3-1: Invalid ep0 maxpacket: 64 [ 56.334264][ T737] usb usb3-port1: unable to enumerate USB device [ 56.394091][ T10] asix 4-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 56.588324][ T10] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 56.598656][ T10] asix 4-1:0.0: probe with driver asix failed with error -61 [ 56.610635][ T10] usb 4-1: USB disconnect, device number 19 [ 56.823046][ T1732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 56.832173][ T737] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 56.841044][ T1732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 56.986026][ T737] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 56.994901][ T737] usb 2-1: config 1 has an invalid descriptor of length 248, skipping remainder of the config [ 57.005797][ T737] usb 2-1: config 1 interface 0 altsetting 181 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 57.018923][ T737] usb 2-1: config 1 interface 0 has no altsetting 0 [ 57.027549][ T737] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 57.036936][ T737] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.045446][ T737] usb 2-1: Product: ˝榒㑆ఠ㷆乖䢋듖略鲈鈓ꊐݜㄿ↦裌莡ꉳ咆纥㉸從ழ讧걿⨔亓뉭얄슀葋䤝빗馿㞘톷注栴享◗◧報ꓨ莏藷⢞덥ﯕ좢떸枱嘯떦摵﹧겥鈐ᜇ䤬漳ÿ [ 57.066471][ T737] usb 2-1: SerialNumber: syz [ 57.331452][ T737] cdc_ether 2-1:1.0: skipping garbage [ 57.337584][ T737] cdc_ether 2-1:1.0: skipping garbage [ 57.345761][ T737] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 57.355094][ T737] usb 2-1: USB disconnect, device number 11 [ 57.363917][ T9] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 57.404716][ T36] audit: type=1326 audit(1756314902.508:352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1748 comm="syz.1.448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f77a578ebe9 code=0x7fc00000 [ 57.428020][ T36] audit: type=1326 audit(1756314902.508:353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1748 comm="syz.1.448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f77a578ebe9 code=0x7fc00000 [ 57.451447][ T36] audit: type=1326 audit(1756314902.508:354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1748 comm="syz.1.448" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f77a578ebe9 code=0x7fc00000 [ 57.525275][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 57.535601][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 57.545352][ T9] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 57.554536][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 57.555484][ T1757] rust_binder: 1756 RLIMIT_NICE not set [ 57.562554][ T9] usb 1-1: SerialNumber: syz [ 57.579485][ T560] rust_binder: 1755: removing orphan mapping 0:4248 [ 57.714912][ T1775] netlink: 12 bytes leftover after parsing attributes in process `syz.3.456'. [ 57.779521][ T1744] incfs: Error accessing: ./file0. [ 57.784753][ T1744] incfs: mount failed -20 [ 57.793475][ T9] usb 1-1: 0:2 : does not exist [ 57.801328][ T9] usb 1-1: USB disconnect, device number 10 [ 57.813095][ T757] udevd[757]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 57.882010][ T1785] netlink: 'syz.3.460': attribute type 27 has an invalid length. [ 58.000498][ T1805] rust_binder: 414: no such ref 0 [ 58.099457][ T1811] futex_wake_op: syz.2.469 tries to shift op by 144; fix this program [ 58.108141][ T1811] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 58.108647][ T1811] rust_binder: Failed to allocate buffer. len:1024, is_oneway:true [ 58.156731][ T1816] /dev/rnullb0: Can't open blockdev [ 58.205575][ T1820] incfs: Backing dir is not set, filesystem can't be mounted. [ 58.213116][ T1820] incfs: mount failed -2 [ 58.283918][ T544] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 58.435460][ T544] usb 2-1: unable to get BOS descriptor or descriptor too short [ 58.443706][ T544] usb 2-1: not running at top speed; connect to a high speed hub [ 58.454537][ T544] usb 2-1: config 1 has an invalid descriptor of length 157, skipping remainder of the config [ 58.475011][ T544] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 58.494473][ T544] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 58.523601][ T544] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 58.533347][ T544] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.549487][ T544] usb 2-1: SerialNumber: syz [ 58.554267][ T560] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 58.724967][ T560] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 58.743316][ T1842] overlayfs: conflicting options: verity=require,redirect_dir=follow [ 58.751738][ T560] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 58.763731][ T560] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 58.791607][ T560] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 58.801662][ T560] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 58.819409][ T560] usb 1-1: Product: syz [ 58.828063][ T560] usb 1-1: Manufacturer: syz [ 58.838195][ T560] usb 1-1: SerialNumber: syz [ 59.107799][ T560] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 11 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 59.120517][ T1809] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.131023][ T1809] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.149258][ T1809] rust_binder: Write failure EFAULT in pid:418 [ 59.150806][ T544] cdc_ncm 2-1:1.0: invalid descriptor buffer length [ 59.168921][ T544] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 59.176028][ T544] cdc_ncm 2-1:1.0: bind() failure [ 59.183648][ T544] usb 2-1: USB disconnect, device number 12 [ 59.310779][ T1830] rust_binder: Error in use_page_slow: ESRCH [ 59.310806][ T1830] rust_binder: use_range failure ESRCH [ 59.318038][ T1830] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 59.325239][ T1830] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 59.333533][ T1830] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:333 [ 59.343730][ T64] usb 1-1: USB disconnect, device number 11 [ 59.368651][ T64] usblp0: removed [ 59.793959][ T64] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 59.953900][ T64] usb 3-1: Using ep0 maxpacket: 16 [ 59.960954][ T64] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 59.970416][ T64] usb 3-1: config 0 has no interface number 0 [ 59.976751][ T64] usb 3-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 59.987456][ T64] usb 3-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 59.995161][ T1918] netlink: 20 bytes leftover after parsing attributes in process `syz.3.508'. [ 59.999260][ T64] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 60.016259][ T64] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 60.024532][ T64] usb 3-1: Product: syz [ 60.028745][ T64] usb 3-1: Manufacturer: syz [ 60.034192][ T64] usb 3-1: SerialNumber: syz [ 60.047666][ T64] usb 3-1: config 0 descriptor?? [ 60.052945][ T1871] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 60.061941][ T1871] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 60.270146][ T1871] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 60.277412][ T1871] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 60.619666][ T36] kauditd_printk_skb: 70 callbacks suppressed [ 60.619695][ T36] audit: type=1400 audit(1756314905.718:425): avc: denied { connect } for pid=1963 comm="syz.1.522" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 60.654258][ T1968] syz.1.523 uses obsolete (PF_INET,SOCK_PACKET) [ 60.661449][ T36] audit: type=1400 audit(1756314905.758:426): avc: denied { accept } for pid=1967 comm="syz.1.523" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 60.718460][ T36] audit: type=1400 audit(1756314905.818:427): avc: denied { getopt } for pid=1969 comm="syz.1.524" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 60.895666][ T64] asix 3-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 60.905896][ T64] asix 3-1:0.251 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 60.916393][ T64] asix 3-1:0.251: probe with driver asix failed with error -71 [ 60.927014][ T64] usb 3-1: USB disconnect, device number 14 [ 61.210629][ T1974] netlink: 36 bytes leftover after parsing attributes in process `syz.3.525'. [ 61.310611][ T1991] bridge0: port 3(veth0_to_bond) entered blocking state [ 61.317685][ T1991] bridge0: port 3(veth0_to_bond) entered disabled state [ 61.324749][ T1991] veth0_to_bond: entered allmulticast mode [ 61.331099][ T1991] veth0_to_bond: entered promiscuous mode [ 61.420054][ T2007] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 61.475862][ T36] audit: type=1400 audit(1756314906.578:428): avc: denied { getopt } for pid=2019 comm="syz.3.541" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 61.556636][ T36] audit: type=1400 audit(1756314906.658:429): avc: denied { setattr } for pid=2030 comm="syz.1.545" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 61.579632][ T36] audit: type=1400 audit(1756314906.658:430): avc: denied { listen } for pid=2032 comm="syz.3.546" path=2F3136302FE91F7189591E9233614B scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 61.579999][ T2034] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 61.602728][ T2034] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 61.617547][ T2034] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:325 [ 61.637283][ T36] audit: type=1400 audit(1756314906.738:431): avc: denied { watch_reads } for pid=2035 comm="syz.1.547" path="/140" dev="tmpfs" ino=784 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 61.961641][ T2064] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 61.961670][ T2064] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:446 [ 62.218983][ T36] audit: type=1400 audit(1756314907.318:432): avc: denied { setopt } for pid=2071 comm="syz.0.557" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 62.238625][ T2072] netlink: 4 bytes leftover after parsing attributes in process `syz.0.557'. [ 71.900931][ T2099] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 71.905231][ T2101] rust_binder: Write failure EFAULT in pid:337 [ 71.908604][ T2097] input: syz1 as /devices/virtual/input/input10 [ 71.908829][ T2101] rust_binder: Failed copying into alloc: EFAULT [ 71.923015][ T2101] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 71.923428][ T2099] rust_binder: Error while translating object. [ 71.933106][ T2101] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 71.941998][ T2099] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 71.954181][ T2101] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:337 [ 71.968889][ T2099] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:454 [ 71.972199][ T2108] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 72.006282][ T2107] netlink: 32 bytes leftover after parsing attributes in process `syz.0.568'. [ 72.014204][ T2113] 9pnet_fd: Insufficient options for proto=fd [ 72.022233][ T2107] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:385 [ 72.031141][ T2113] bridge0: port 3(veth0_to_bond) entered blocking state [ 72.047347][ T2113] bridge0: port 3(veth0_to_bond) entered disabled state [ 72.054396][ T2113] veth0_to_bond: entered allmulticast mode [ 72.060788][ T2113] veth0_to_bond: entered promiscuous mode [ 72.455768][ T2141] netlink: 'syz.0.579': attribute type 22 has an invalid length. [ 72.501297][ T36] audit: type=1400 audit(1756314917.598:433): avc: denied { accept } for pid=2142 comm="syz.2.580" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 72.505445][ T2143] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 72.522557][ T2143] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 72.529130][ T2143] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 72.537220][ T2143] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:352 [ 72.573739][ T36] audit: type=1400 audit(1756314917.668:434): avc: denied { append } for pid=2144 comm="syz.2.581" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 72.638379][ T2149] netlink: 68 bytes leftover after parsing attributes in process `syz.0.583'. [ 72.886857][ T2178] input: syz1 as /devices/virtual/input/input11 [ 72.981288][ T786] ------------[ cut here ]------------ [ 72.986907][ T786] WARNING: CPU: 1 PID: 786 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 72.994896][ T786] Modules linked in: [ 72.998831][ T786] CPU: 1 UID: 0 PID: 786 Comm: syz.1.136 Not tainted syzkaller #0 a29bcd2d578c4b9493db917853c72486663e8fa1 [ 73.010259][ T786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 73.020382][ T786] RIP: 0010:drop_nlink+0xce/0x110 [ 73.025476][ T786] Code: 04 00 00 be 08 00 00 00 e8 6f 48 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 d2 1c 98 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 73.045150][ T786] RSP: 0018:ffffc9000ea5f860 EFLAGS: 00010293 [ 73.051257][ T786] RAX: ffffffff81edc76e RBX: ffff888113f130c8 RCX: ffff888134391300 [ 73.059304][ T786] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 73.067323][ T786] RBP: ffffc9000ea5f888 R08: 0000000000000003 R09: 0000000000000004 [ 73.075383][ T786] R10: dffffc0000000000 R11: fffff52001d4befc R12: dffffc0000000000 [ 73.083381][ T786] R13: 1ffff110227e2622 R14: ffff888113f13110 R15: 0000000000000000 [ 73.091414][ T786] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 73.100390][ T786] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 73.107034][ T786] CR2: 000000110c2b3c36 CR3: 0000000102f8e000 CR4: 00000000003526b0 [ 73.115058][ T786] Call Trace: [ 73.118361][ T786] [ 73.121315][ T786] shmem_rmdir+0x5f/0x90 [ 73.125648][ T786] vfs_rmdir+0x3e0/0x560 [ 73.130014][ T786] incfs_kill_sb+0x109/0x230 [ 73.134680][ T786] deactivate_locked_super+0xd5/0x2a0 [ 73.140099][ T786] deactivate_super+0xb8/0xe0 [ 73.144929][ T786] cleanup_mnt+0x3f1/0x480 [ 73.149372][ T786] __cleanup_mnt+0x1d/0x40 [ 73.153823][ T786] task_work_run+0x1e3/0x250 [ 73.158512][ T786] ? __cfi_task_work_run+0x10/0x10 [ 73.163667][ T786] ? free_nsproxy+0x223/0x290 [ 73.168442][ T786] do_exit+0x9bc/0x2630 [ 73.172630][ T786] ? __sched_text_start+0x10/0x10 [ 73.177729][ T786] ? __cfi_do_exit+0x10/0x10 [ 73.182348][ T786] ? __kasan_check_write+0x18/0x20 [ 73.187536][ T786] ? _raw_spin_lock_irq+0x8d/0x120 [ 73.192683][ T786] ? __kasan_check_read+0x15/0x20 [ 73.197817][ T786] ? cgroup_update_frozen+0x160/0x990 [ 73.203230][ T786] do_group_exit+0x22a/0x300 [ 73.207984][ T786] ? cgroup_leave_frozen+0x16c/0x2b0 [ 73.213300][ T786] get_signal+0x139d/0x14f0 [ 73.217869][ T786] arch_do_signal_or_restart+0x96/0x720 [ 73.223448][ T786] ? common_nsleep+0x93/0xb0 [ 73.228120][ T786] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 73.234338][ T786] ? __se_sys_clock_nanosleep+0x300/0x390 [ 73.240101][ T786] ? __kasan_check_read+0x15/0x20 [ 73.245190][ T786] ? fpregs_assert_state_consistent+0xb7/0xe0 [ 73.251292][ T786] syscall_exit_to_user_mode+0x58/0xb0 [ 73.256848][ T786] do_syscall_64+0x64/0xf0 [ 73.261307][ T786] ? clear_bhb_loop+0x50/0xa0 [ 73.266070][ T786] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 73.272023][ T786] RIP: 0033:0x7f77a57c14a5 [ 73.276652][ T786] Code: Unable to access opcode bytes at 0x7f77a57c147b. [ 73.283697][ T786] RSP: 002b:00007f77a6514f80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 [ 73.292216][ T786] RAX: fffffffffffffdfc RBX: 00007f77a59b5fa0 RCX: 00007f77a57c14a5 [ 73.300521][ T786] RDX: 00007f77a6514fc0 RSI: 0000000000000000 RDI: 0000000000000000 [ 73.308771][ T786] RBP: 00007f77a5811e19 R08: 0000000000000000 R09: 0000000000000000 [ 73.316826][ T786] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 73.324880][ T786] R13: 00007f77a59b6038 R14: 00007f77a59b5fa0 R15: 00007ffd9f6ab368 [ 73.332896][ T786] [ 73.335968][ T786] ---[ end trace 0000000000000000 ]--- [ 73.341645][ T786] ================================================================== [ 73.349744][ T786] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 73.356014][ T786] Write of size 4 at addr 0000000000000168 by task syz.1.136/786 [ 73.363740][ T786] [ 73.366094][ T786] CPU: 1 UID: 0 PID: 786 Comm: syz.1.136 Tainted: G W syzkaller #0 a29bcd2d578c4b9493db917853c72486663e8fa1 [ 73.366125][ T786] Tainted: [W]=WARN [ 73.366131][ T786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 73.366144][ T786] Call Trace: [ 73.366151][ T786] [ 73.366160][ T786] __dump_stack+0x21/0x30 [ 73.366188][ T786] dump_stack_lvl+0x10c/0x190 [ 73.366212][ T786] ? __cfi_dump_stack_lvl+0x10/0x10 [ 73.366237][ T786] print_report+0x3d/0x70 [ 73.366257][ T786] kasan_report+0x163/0x1a0 [ 73.366277][ T786] ? ihold+0x24/0x70 [ 73.366296][ T786] ? _raw_spin_unlock+0x45/0x60 [ 73.366319][ T786] ? ihold+0x24/0x70 [ 73.366337][ T786] kasan_check_range+0x299/0x2a0 [ 73.366358][ T786] __kasan_check_write+0x18/0x20 [ 73.366383][ T786] ihold+0x24/0x70 [ 73.366400][ T786] vfs_rmdir+0x26a/0x560 [ 73.366424][ T786] incfs_kill_sb+0x109/0x230 [ 73.366451][ T786] deactivate_locked_super+0xd5/0x2a0 [ 73.366475][ T786] deactivate_super+0xb8/0xe0 [ 73.366497][ T786] cleanup_mnt+0x3f1/0x480 [ 73.366519][ T786] __cleanup_mnt+0x1d/0x40 [ 73.366537][ T786] task_work_run+0x1e3/0x250 [ 73.366559][ T786] ? __cfi_task_work_run+0x10/0x10 [ 73.366580][ T786] ? free_nsproxy+0x223/0x290 [ 73.366606][ T786] do_exit+0x9bc/0x2630 [ 73.366628][ T786] ? __sched_text_start+0x10/0x10 [ 73.366654][ T786] ? __cfi_do_exit+0x10/0x10 [ 73.366675][ T786] ? __kasan_check_write+0x18/0x20 [ 73.366700][ T786] ? _raw_spin_lock_irq+0x8d/0x120 [ 73.366723][ T786] ? __kasan_check_read+0x15/0x20 [ 73.366747][ T786] ? cgroup_update_frozen+0x160/0x990 [ 73.366784][ T786] do_group_exit+0x22a/0x300 [ 73.366806][ T786] ? cgroup_leave_frozen+0x16c/0x2b0 [ 73.366823][ T786] get_signal+0x139d/0x14f0 [ 73.366848][ T786] arch_do_signal_or_restart+0x96/0x720 [ 73.366874][ T786] ? common_nsleep+0x93/0xb0 [ 73.366889][ T786] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 73.366915][ T786] ? __se_sys_clock_nanosleep+0x300/0x390 [ 73.366947][ T786] ? __kasan_check_read+0x15/0x20 [ 73.366971][ T786] ? fpregs_assert_state_consistent+0xb7/0xe0 [ 73.366993][ T786] syscall_exit_to_user_mode+0x58/0xb0 [ 73.367012][ T786] do_syscall_64+0x64/0xf0 [ 73.367034][ T786] ? clear_bhb_loop+0x50/0xa0 [ 73.367052][ T786] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 73.367080][ T786] RIP: 0033:0x7f77a57c14a5 [ 73.367095][ T786] Code: Unable to access opcode bytes at 0x7f77a57c147b. [ 73.367104][ T786] RSP: 002b:00007f77a6514f80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 [ 73.367123][ T786] RAX: fffffffffffffdfc RBX: 00007f77a59b5fa0 RCX: 00007f77a57c14a5 [ 73.367137][ T786] RDX: 00007f77a6514fc0 RSI: 0000000000000000 RDI: 0000000000000000 [ 73.367149][ T786] RBP: 00007f77a5811e19 R08: 0000000000000000 R09: 0000000000000000 [ 73.367161][ T786] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 73.367172][ T786] R13: 00007f77a59b6038 R14: 00007f77a59b5fa0 R15: 00007ffd9f6ab368 [ 73.367187][ T786] [ 73.367194][ T786] ================================================================== [ 73.666257][ T786] Disabling lock debugging due to kernel taint [ 73.697912][ T786] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 73.705797][ T786] #PF: supervisor write access in kernel mode [ 73.711896][ T786] #PF: error_code(0x0002) - not-present page [ 73.717907][ T786] PGD 800000011c99e067 P4D 800000011c99e067 PUD 0 [ 73.724478][ T786] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 73.730630][ T786] CPU: 1 UID: 0 PID: 786 Comm: syz.1.136 Tainted: G B W syzkaller #0 a29bcd2d578c4b9493db917853c72486663e8fa1 [ 73.743545][ T786] Tainted: [B]=BAD_PAGE, [W]=WARN [ 73.748596][ T786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 73.758739][ T786] RIP: 0010:ihold+0x2a/0x70 [ 73.763300][ T786] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 bd 13 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 2c 3f ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 cd [ 73.783035][ T786] RSP: 0018:ffffc9000ea5f8a0 EFLAGS: 00010246 [ 73.789154][ T786] RAX: ffff888134391300 RBX: 0000000000000000 RCX: ffff888134391300 [ 73.797346][ T786] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 73.805356][ T786] RBP: ffffc9000ea5f8b0 R08: ffffffff8896a947 R09: 1ffffffff112d528 [ 73.813454][ T786] R10: dffffc0000000000 R11: fffffbfff112d529 R12: ffff888113f130d4 [ 73.821463][ T786] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 73.829471][ T786] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 73.838441][ T786] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 73.845056][ T786] CR2: 0000000000000168 CR3: 000000010ebd0000 CR4: 00000000003526b0 [ 73.853075][ T786] Call Trace: [ 73.856387][ T786] [ 73.859366][ T786] vfs_rmdir+0x26a/0x560 [ 73.863659][ T786] incfs_kill_sb+0x109/0x230 [ 73.868399][ T786] deactivate_locked_super+0xd5/0x2a0 [ 73.873819][ T786] deactivate_super+0xb8/0xe0 [ 73.878545][ T786] cleanup_mnt+0x3f1/0x480 [ 73.883004][ T786] __cleanup_mnt+0x1d/0x40 [ 73.887475][ T786] task_work_run+0x1e3/0x250 [ 73.892156][ T786] ? __cfi_task_work_run+0x10/0x10 [ 73.897323][ T786] ? free_nsproxy+0x223/0x290 [ 73.902047][ T786] do_exit+0x9bc/0x2630 [ 73.906249][ T786] ? __sched_text_start+0x10/0x10 [ 73.911324][ T786] ? __cfi_do_exit+0x10/0x10 [ 73.915963][ T786] ? __kasan_check_write+0x18/0x20 [ 73.921133][ T786] ? _raw_spin_lock_irq+0x8d/0x120 [ 73.926297][ T786] ? __kasan_check_read+0x15/0x20 [ 73.931375][ T786] ? cgroup_update_frozen+0x160/0x990 [ 73.933906][ T36] audit: type=1400 audit(1756314918.888:435): avc: denied { read } for pid=91 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 73.936776][ T786] do_group_exit+0x22a/0x300 [ 73.963176][ T786] ? cgroup_leave_frozen+0x16c/0x2b0 [ 73.965994][ T36] audit: type=1400 audit(1756314918.888:436): avc: denied { search } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 73.968494][ T786] get_signal+0x139d/0x14f0 [ 73.994376][ T786] arch_do_signal_or_restart+0x96/0x720 [ 73.999962][ T786] ? common_nsleep+0x93/0xb0 [ 74.004574][ T786] ? __cfi_arch_do_signal_or_restart+0x10/0x10 [ 74.010755][ T786] ? __se_sys_clock_nanosleep+0x300/0x390 [ 74.016681][ T786] ? __kasan_check_read+0x15/0x20 [ 74.021759][ T786] ? fpregs_assert_state_consistent+0xb7/0xe0 [ 74.027842][ T786] syscall_exit_to_user_mode+0x58/0xb0 [ 74.033318][ T786] do_syscall_64+0x64/0xf0 [ 74.037757][ T786] ? clear_bhb_loop+0x50/0xa0 [ 74.042545][ T786] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 74.048465][ T786] RIP: 0033:0x7f77a57c14a5 [ 74.052894][ T786] Code: Unable to access opcode bytes at 0x7f77a57c147b. [ 74.059920][ T786] RSP: 002b:00007f77a6514f80 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 [ 74.068356][ T786] RAX: fffffffffffffdfc RBX: 00007f77a59b5fa0 RCX: 00007f77a57c14a5 [ 74.076337][ T786] RDX: 00007f77a6514fc0 RSI: 0000000000000000 RDI: 0000000000000000 [ 74.084325][ T786] RBP: 00007f77a5811e19 R08: 0000000000000000 R09: 0000000000000000 [ 74.092337][ T786] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 74.100328][ T786] R13: 00007f77a59b6038 R14: 00007f77a59b5fa0 R15: 00007ffd9f6ab368 [ 74.108325][ T786] [ 74.111353][ T786] Modules linked in: [ 74.115270][ T786] CR2: 0000000000000168 [ 74.119429][ T786] ---[ end trace 0000000000000000 ]--- [ 74.124894][ T786] RIP: 0010:ihold+0x2a/0x70 [ 74.129410][ T786] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 bd 13 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 2c 3f ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 cd [ 74.149019][ T786] RSP: 0018:ffffc9000ea5f8a0 EFLAGS: 00010246 [ 74.155098][ T786] RAX: ffff888134391300 RBX: 0000000000000000 RCX: ffff888134391300 [ 74.163072][ T786] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 74.171056][ T786] RBP: ffffc9000ea5f8b0 R08: ffffffff8896a947 R09: 1ffffffff112d528 [ 74.179044][ T786] R10: dffffc0000000000 R11: fffffbfff112d529 R12: ffff888113f130d4 [ 74.187028][ T786] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 74.195010][ T786] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 74.203951][ T786] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 74.210541][ T786] CR2: 0000000000000168 CR3: 000000010ebd0000 CR4: 00000000003526b0 [ 74.218549][ T786] Kernel panic - not syncing: Fatal exception [ 74.225001][ T786] Kernel Offset: disabled [ 74.229331][ T786] Rebooting in 86400 seconds..