last executing test programs: 1m37.094220341s ago: executing program 0 (id=686): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_X86_SETUP_MCE(r3, 0x4008ae9c, &(0x7f0000000400)={0x14, 0x1, 0xfe}) ioctl$KVM_X86_SET_MCE(r3, 0x4040ae9e, &(0x7f00000001c0)={0xa100000000000000, 0x2000, 0x0, 0x1, 0x12}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000280), 0x8800, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_int(r5, &(0x7f0000000080)='cpuset.cpus\x00', 0x2, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$cgroup_pid(r6, &(0x7f0000000000), 0x2a979d) write$cgroup_subtree(r6, &(0x7f0000000040)=ANY=[@ANYBLOB="f90ceeabd7b09b03bc94f44e2d4e3a", @ANYBLOB='N'], 0x6a) read(r4, &(0x7f0000000080)=""/93, 0xffffff6c) 1m37.093073651s ago: executing program 0 (id=687): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}, 0x1, 0x0, 0x0, 0x68840}, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r1) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)={0x14, r2, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x8804}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000004200)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0x2705ca3409e73b94, 0x2f, 0x1, 0x4, 0xc}}, 0x50) syz_fuse_handle_req(r3, &(0x7f00000066c0)="a062030607792c01386f28a428828947de99f79cc542703d923c7cb9d4e1f6fd95fbf2f747ab32f6fb041861fb3f87a88cb85405b4e73c0b6b12c81e42a9f13d82c32b7ddb172bcb03dfc5c38f083747ac179f08d4d6d342a87ba8dd9bb7a9680f27433c3357b4f6ac97b19a973592f1ac6e7853a0b15ba42a28efb9cc30b146346b546018966e94976ca28f26a1950dd64c0adbb0c2e09bbd9caa9e7886a2b3d6e2b6d6616b718f1322ea2881ca59ef73948b1bcdc2dd3970e63cbc1043ce42af0ea1f95d17268cbc3ef062c8c31a537e94a20c1c505a6022d5ece7f51bd9c754d8c47cbe80bbb30b2159991a94dd3a25e64aff8a7a17374b5a71e0c7c241cbfd7f084e18a50bea512ada902210a3881ffcd42071ab09c4d80139d8980d6dc5d12c2595ced445caf22f80d8fb1a4c243da47fadb8e28e9c04fea820a8a2f032f5adff8b7d9269e63db68d196bf7f416405e52b6b8abd8bb9d9694b8b5eddae348209963738cd9710bd6c291af1c8eaf0e52d2f2f24bef8c8bc9f77eed40104e07c8ee1b4cb358fc73e2653fef6232b5e9f5d0be26b91a0b7967ed5e3bf10c449424ff4d11951d963677001d9576425d6a9c4503268a407d74854f5e1caacc0ccc463dc56e684db1d80b370da238915579ab82cdbd7d155adf10b96ed71100ea92834e8a4e4f5b7b831bff6fb4febe01bb398ea4065446f277f107aa3cc06e0b7a6e98434bf57744ba9ecb8effe704d7f852e16bc33ac113649f7548b7a7a67cf5493b400ce06e571d485af1732938b79ded4de7dad97a7e1c0be7bd479dc264647bb76503168423e3f6fc95f8ac8ea35e39f476ab54e88286fcf73eead1f794784465592fe4ad112ac63bbc3b3f35b87c40bc5fa6e3ca6cad878f9772a61a23aa00491a9e2442eb90a32af2bd74e99d075bcda20288bfc30f3b00a7e8e1a0b4791573abd65284bbb53e2b7d667239b95b332dd423e4d7c512de559bd53fde5285add9795bda81ec142620e693af9c787a4499dd76ca0d77d9c7c4043e537ec6c1cd0b9a642b12adc782a0e00f6c1ed7379d5fff4c2feb19182db977f657b195e4710ff00f78e35a146119897495b0e1a0068a6606292ee72bf65adcd2cd29b4e59a4b3f82eac77d5254013d03d2fb2511975558906741912d09304f0d4cf08c8f62690c67968c869f75a4025224d8e84baf7a42e01b4ecf7e55d7c45839778c2266880d1bb73e3aad618d1a4f8d5a16914d64d70438a88512649fd4caa90506e5a2d58a33ecaebc9b2e5f8a4fbeca57c829ae02fd2dc146e939c3d295ada7df4a07e74b356c6ffd7a9c546b9eddf7e013cbcb2b57ae0d225249f7e06a415681d9f597a060fd55e39bd56f04b863efeca458a0cbc54b660db50ca40d27a3fda3416860e691cfc780593f06b467700968bb918c32547e378b14b4e0dcd11cb0b2fb36ea70946ac62290184b4eed38b51c322a75367b50f558e063bf363341a17c28ddcbf9ce53da06f26303fd156423a25f686809bc9845a78e0cc3d94e04bc8da85f22a4a8ece2c4ac2c79e54dcc4eabc61e067060ad880377a71fe0c2c0305256e4f3c637575f086e4ae3d7ab5d106fde03d24c47dccba3da23a244c1f50a4f60cd8d71b77390c5ce6d5612fd0260a2f33389b064ae6acac783eca62874232fd3808fb2188151a43de6cebc7e245106183f7d929f1eeff6f972da3e3d967170247925fb0f04bf38e88d06321f9ff9d2c296553d842b69036a2b6de2aad3879aedee723ff00736f7b0dffe6182104105ff0f0b636f5192d6bb5ae7ef950825827d2f3d6285d83aedca3f31474e0ad50ce6290a0e546c30d900e5b4208ecc8b3aca0ba3d110fc3c0a7e004a53e5d0ba1cc1c2bb42c3dbcbb4ceb6674151932ae56f6b03cc34ce450c292fecd2456ddcf42b075e6fd49305fbf265a36f3cff61321dd60f16e844089d659130947672a2d059e04af9ef653e8afec926b5a5d411f60a2a435437095a1df8dc60a616bd1a1ce7b5251ed8f905becffebd635eee8ff0055c40f146f1350a406b853ecb005c6ede4dc270ce6751cff915aa27f5f6b0736da14c9949de599d57868c29cc97ad03bd89502a34b88ad29c8762d0dc24a6df759821882a32e70531cab51fa1752a4fc49cf0706cb24d203174b2940f29ef8b0ce65b40cfde4e0c7310c685cc8de8384e485a951192fa8c36c11f9b88a48caf027dca480caa4fccae70ea6c837eb82f926ad7691c7709f217220d71f6e374fb8522a84c118b5c25f3d56acfb25afbe676fc9e574b6c5a59c00a0bbeeff61fd82a1677f3da9bb596133db491a8f11b945d930c8a67de9ce80025c764d518efcbae25d9194dc96c31e929bbb5afabd34bc37c095acd0abbbdb1ea48e40a30ac99550f0ccca19ecef5acb2604c48fffb53b352d114fac72d6fc019ddec558406668f773fed9476148133c0f9ca4d1fd7e70dd04bfa089dc57e5940f29a5fd33dc79913ff48853794fdaf891d71de94c4a4fed0544e09f2bd578b07003031b8602f08ca8a79fa5ebfd5477f4d4f031c3efe0db273446a99d0cbe21a3cf43f3b82774e4657bb4f9675adbaf71c52953f0b18a61e05a9c770536fbad215848f8238e8730b9085189ea4621780dac500d7d7dc7815b45e232f86592498f1515ac8c50306013524cc5f0a74b67bc85d435d332ce69f00641c86a3e91be84b78ac358f35b18d69679df4197d3be8554417cf44aee6dc623f68ce3388df18168efa1c87c776cbda792f6110b6af178eb8200a91dfb72c1e23b5e5a66b5a3ee3f4c2bba2ccac939dcb036006b86e894093922a95fd70baba9424a3d0327a0f209fe10b39f3cec3f669d301a2834e58fd56f94d622dccf653f08e776c9f3e1b0e5b3cdef133834b93c41c70438d51a0b127262868d49ca91623c3d8b75c2cce0b771b9ac941bb96029e782224a3686a7c0dd164e162ede667e0e5817e7bde85ad3bf30a6a5bdc420f751679be74a02f84aa93b971c3f45a67d155f7ecb1d5284660918dbf102bc16f496fb62a1290e6b88ddaff55740583cba13076afd623276634e0c11663be50766980949095003ef5bc6f90a98bbad436b67928513e70115224f672ca2a24e27bb98bd5288c49ea23d47ef13c5ff28c43ce53ca16a6caeccc1f601226253c4a38a88a93828f6c800547cadbaa6d7ad26db618cccd38a671507cad5ba0065ce2edba81a059b95c36c5d04ab456fd6fd81ec3738ebe546d973c0886a5e7b83dd9c2f58f5d6c19519e67575b3732a486555f8d8c4ae004a62e8d07ab2c8ef74cdb96aa99d75aeb1c25985996f281d71106910a3c3da17de35e04dbe00e2b7b75ec2fed177a7f2d04fbf68bd0b8af682b30911867d4d1497ba060b662f4e97a8e7fd3613015cc34302377497cd08bcdc29f06dae240820d2ccddbf8c95c76a4ba5d3e1b37a62369ce3f79fb74ebd9bc82c3fa3edad4034b6715c2853fa7781c974b5a4e541e8b69bf4bd653fcce4e4340d9409fe9112e4d253a3b7e9d43f4426127b10f2d5d3fcd2193490f7d933e0cc53dae552f2d7c9d77b8f9b27c59105cfae43a0aab314a0820fbb5684bf20986e3be215688b42938d272c4c0edd17bcdc84a514d2483456d6cfb4f5c1218859ee55bfc77da36c9c75734932a12fd03df38232063ed92024f8ee7c21f314129feb10670bb4d6a0ad4fb3dc57a64cfe6509a0770650cdec0efd5e0b1fd29433cf871c9ddbe648319bd481357326ac1eb32b4bef4ad89ab6122e92dc786decac88624a4a3963ae771f8023b9a92e446114764c53d7efc07e3ea77a9daac5cabbe648a223e249db62102ef7b7b6d06df46b6ff913911b89848a47aecc0563fb06b6d77fe1daf4541cf619105ab68e0bcdf7a05af22b0551323bf33dec8167df2b7fac62dc9e286dd3462f488c82ad194f7fd5d3ca72fe9c0c37cdb6d75684326e5cb30319ab333fc70bb197320acda161d2e685e78ac2cb1417223f64742b12a316d590b18a4173b2a105a381baf6f383ec2e81d04860b5cc536475d7c5d05bd6a7db1a5d93930bacba8c1de63707bd24785e19fc1f15ba724660ac00d0f2ebbcd5528b8cbe4f3ca332e8611e937a310fc79d234be6c1cd09d6a5cb06ab36a9d667188144c81f86aaf0851763573b36cc21462ba4f3d6e95d38d1e9b943085661d234ef6d079bc9d84c7447c85baba88263451ba10559e1ce326fee5074b26b54872e690a9a1e589e1c444daa3224b292bf9ec4a604dc512760084084f27386c89a1190b8905f0d720508c0ed69272f396725805480188aa4602a26e833c16aa5079c0577a8203ec0b2b929ef3b410bb427c168b7fefd1be652f06efc61c7a295a5d07a9fd61bd5bfe67ac5f74e485a66c92950a1b460257084ca3a3489943ad450300967234b487fa3def4010f9b715196562ebb0846b7ac3eba47646af6285582b4402f64aa684dff7d9cf81fbe1aa88959f7906f06839389f2ad56efb5029afe1d5ceac99a3e698f49ff0da7db06d7c9e94a8773a13fab93def139667b4dc6b741bd2769da7786acecbe315f9006bb6b72abe5bdc587d8d5aa8f67aaefef68197fd2e7874d9b7da2c3a5618720c12e8fc31db3e334c47abcbf10c6181ec14af4f9e90e19a35360a793b1e9b336e49b3ed67568a860cd4c298f967ba323d315821959629e5b7aaac367e1ddb8a1c5d61500afa69331a4c90861852f533657b28b97a343bc531a11ff634b157a6d859a35f0d2a595375e11a32457575f1d73da033bf5eeda12337b9fdd46bce192d3aaaa240a8c65bf47704d6aa64a9531f9de14a96fc9fe380db35dd5ec52321c67fb4c18abcaf22fbe8f602ed201232251317e1a1b71e1e2c924a92d84685de348eec97fed954b7f6681ddf521b4ee03a1aeb2e446ee2a7f4dfa37b1c53831139fc624c14dcc4d144ccdf758fd9f344b4cdc1df70f6a24fa78cab136c912d1ebffa7053ccbc9b9445762236dca409820f738370117d5c369dfc50fd42277f14eeaf29110aedcd503008c42914d04e219a8b6c01e337d04724919b07157e2275ba6365a9dba5ebc8019bd1aa1b8668023f64cf47e1b49b4fbcfc10d560bb74405c90751504db8100d8a8a1a3ff84d98f1262fbbd6b962f492b9531a7411c08e7e56eb0f838075f754b6a395b6b58a8e4c47eb46bfaba2ac94800a396749d18ba0e6219f8d616ec71a1e60b3bcc24e19d4a20ddbc6a871e6d7efa50a362610598d892a5adecbcfe217534deee3620dfc88c7992ec2e710e083ef0a50c20621405f654804d1af4f24d22b8ca48f26303e6969127a74f0b276a5624c3b84410d4d5ee3c62605876e60a88df2bd6e8db8c7e486fdb452178563e7add6bc126b721b9ef8b12181989b87031573a4010d88e34f15a2344e4808b74c99ad68f0c2aca4e8d504397c03e1368c4b1ec43fd902d206c3cfb63d7541ac57fdbc70b0033f87514286101231fe7e79668c802e1c23d61540cdf13a5e675b736e221ddc29ab747d9c64f6213f51d3c1ded2e2b0efc4e45183d90468f61ec1720f7a0b87947e2c54125cebe6563ee4415d886bbe869d17d36371c942c11db1e13c1dd40ed24cabaf7ee80eae6c4db934e982d9619d753dcd679c5650cd95d21582e31b259043a0d03371cd294f4cc028042c75070c9b534a2d79f164ab9d773295795280d1584ca664b53b263fe2e23534d27b0d85742fae8061e03187795129dd272041c6eb9c10c3406da1f752f4ca697bdbddd74975cd4dbba5687fb30ac4fd5d2579494eac73053a63821a852cf41a80f6668006f7e1c4e30b48d638ebab470c558d42baeed1adc8fc71f73e95f3ca212a4b009b508e89898727f805685e4e7650a2961d62c117d1ee9017236a6bffa0c36ae11bc52d346c83399e43c42cdb9f443aa307109a97ee66ceb7a29eeb2f1a2bb3ee1492229116db07301b2aa4126aee7775daa2d0eab4d206fae11b3c6b565dcc4c7b4dd1cf2abec81150d0629803f6eb221be384b8772fe6d6c4fa98c928a9d0a02e9ff8bb7a2168dbebe140323d93bee8983c496bccf752c372b795a3493624cefb3cfeb4307bd39826cac1ea3f18912deef1b8c8db30bc016990a477bc0a925fb36453a9e21354b2d7e6e3d4ca4dd20f27a8db05429d44b7a485365191dc4ba977a815958faf6434813a9f4046054763dd55dbb7fae892b746e169ae046ae3361a9f75cf622b03f75b1633da864395bd1c3a594fab0b1fb37f088dd1f2776e2b795c78635c2026a8ce7ff40968a1960786049a217dd8872ac0c01f4bafcf2d3d751dd46a5e1bec00540a9ca7afca3ef37575d4a8b1291d05be94913092890a9b4bfff39edbff307e5654896e79228777c0f8ea46c55bfe19e522bf457ab4e6b0167d776dbcd0160598370a12c4a03e4edc82b245a7608797b03d4ed89dfc2a5bf07b9fcb251fb8608553f3b3774818717a9aabe6b2ded811515ba454b390a6065bbc59552f3bfe51d38f139792e1aae60093a7c5770b52a1730feb1049c14a7d5261d644f6b738e22ee72aafa422bd93f61e1ccac0a5ef4726c66f61bb539acb937bd63da82c700c0860be90ce5621ced22b52b63d041266fc258fbfa6641aef22e97804e5138ad2ce4405eaf76bb0acd7fc61b2d6de4aabc5c28a850fcf219cff77c97d3cb6bec0067c171b912d11d82c56cbad56c0032a9657d4cdd1eacaca53f40f5e3fe911127e1cd30781351f180e1413933cee2d46ca0eea31ee01fe4e99a567edd0b10565d47b87c8a48366143e889e52d0ff13c920aea092c2545fa9b7056204fec156549d3c0a997bc1cf4a01338483bf5c69d6958ae038f1c3e3b84baeb2c1f9e064c0750602c34c6c483c316391d975f94f21f6dfe74e92c33228b408a9e2b9abcda33c497abba9c48a63e5c8f1a8d0f4c24d36a44e1601e8a09e8a5c7179bd4c44b17e542dd99cace87aab60a5e53325d544c991b6fa5deffa49fd886332980deeca9229cb2f67f495a7b743153854ed81e1623b12dbd65512d08a5732fee2db3fb455cf6df5a1701a2b8674633c6792162dc86ac76e30da225b0167a7e704ad33ba694f9c902afbeed58eef609874767053f59414d4d3eccbbcdbc7eba997c71f9b1f5139bb020d5dae1db6e2dcfbb51b5371b08bdbc3312b05ee6d8c03c8b5a7d4f23da45f276394f222b1a0bdf4e2603243cdba60ee0530387c88bb457ca9932f2283a4d55bb1195e6d325ed93f714e21908b1baafa467f1cec7fa26e5c384ee6828e77978bd1abd014de549a5e5966f2b2f4ba000f9d77f1abfe3a6c337cdb852c1ec59f61b63d543f3062dd2616a163ed7ca60168b0347b5c5646a678dafb4c502c333a0a48f0341b47f5c5946e42e571db0bfa0682a449ca64e71b5661a842975182399245c6de241512c67ac918d7e0c5cb66565010e881b8333567ca584321ead1c383b099d8bf1c56dac08cb218cde4226ad420d6d6313f9c4884d6394722304fdaa76e61db8c0d54eb1151344c41ce1130272928eecb2f9f0f23c752622374eb1223a80efcf0b937dff7d813d7be0340226c0a7b163741d9aecafcb7ddae5a219323323f621c802be82399e06d2e1cc582e759ffa303c5103f8a44d7129d2853b02e506abda57ad2836d7ff16f95232149fbeb8b62e586d3536bb4ae042ecd9e25d1dee789353071f9c89d4361000c47b763556e8902f1f25cbd8ae71679e03ff27db0ec75eeee3fccafc7fcf22c377ac60d3c61a43cb53abf6162118f2efc86a5ce80e69a02bc1db80018beeef6d567941232e4412a958ed012bf7a832c1eaf68134ecabc4927ad666b3d0f21d4e8d52fa37e0a9751124efed8bf47544299138a6f69d89e295677f12606c79b72451c263fca3eec22bf0c47c641159a0bbfb3b2b03154af533e5c06a149e52adcfae31bfc55f30064a8903c8d3b828d275a937b1e4adffa0597da5e253b50bd71b33f057ffeff0b2a0829b3bf33350fbe67c7c79034f80d69e6a21be495a848d328f416f15966491b218eab390544e39d498258ad80ddae248634c845cbe6f1c1e93e7c2b02075411e075fe936bcc75f4a4e1a3687cb3dbbb61cb31ddfbbc87a1859b3a48fccdd8e5915c8bf4eebe8f7093cef6a7a91c8682915f9908c854c483e90c9643467292884d284134dbaddafdbc74d94a5f9713719d62b4f6b4236803d210181847ca27129fde264156895f4e1822ef78a3b215ef56d7e36d2b94c93f5e931a0d13a3a3030061ce62de595eecf47eae6bf698530145757700df18f66fd7261a12c119d6679663b3c0f99d1705aebe66dc862eb21ccb7360b93f54507149b577abf521113991e06f345e8282fdc18de673e1ca7b188ee34b14f37f86ddcf97fef0b913c33cf8e5d5d33707dbcdbe4b27cef056670252f186735cdd02f6ed6bfe5318a704f00e34ffc4fda9855bf37c51be6a7423e44dd8a98883c8fa82ca37c90d681fb7a0db915576b50e49aff545b99aa3aa6343b814ba0bf64e53b2a1edcae2231bf20d65e4bb4da6dc8382120ede652adfb7c30a46e0ee784cbde74563d83eb8d89a1573fa104fddca9d4833c49dc904bda905426c7dee3e48b596c8ee201bea57fedb1a0649457eaac3c5b5f4519af3adb66f10b861e711cd4034448890e15047c2f8902588268b5645051f3f3968ed8d630e050ccef0d01b61ffeade51e4e72d8fd46bba4c20009396e984c424d174934a67a1930665fbea04c809e7cda0a2cdfd3a14d6b99c3a8d8b3691825830456876f188ff871fc861e4c6a0ca377dc1f0cb0f929f7eb1f5da045d9a588a393312acacca5c5a3b15bb1b488b08fc40ad65ae2c1df187eccd8377525a81d80df57579ae52f775fb2efdd172a41c370300fcc594c2635dcf50e9eb9d34fa8b4bbfd13078422e3a7734a8ae6cc09e39d07c7ee19838f8da4cbafe4162c8f8dc44e284840bd0a5c80bfc657c22e37e0d9a96dda34a51ce616c9ccdc95955cf85d93860da902ab30f11aa333eacc25c47981d8636038761ed4d84fcbb0ca92dd2e07863b9505b451c3c49e36a172527578123049ff2dc2b4e258a3f698a12ca4705a6fd0ce6bc4f1767b4d9c2e57c9ed1388527964ac96ff5e4cf5ad6fdb6a853b43905df32af8bd788b520fd526cbb95195a1bc00d654cb080acdf67938517a6cdac741d86730358be16465b4e1301f47f6a444c4e8d2980b8bd98a8dcd6617cde0b287e2d1f59167b5c445146fa49728111b8a2729428cabd02facb8fbddbdb2769680f288648d6baac53e0d909335da3e2b4c13ebd41f32820c9f491e9124ca444a0532f60e2816e15a5810baa91f64454aa355f9d362c7d1a461561689d08b1350a216b6f1bda57aae0706b3710a1b8e52a7e3084e600b5ee3dc540bba0c16267d549304a7840659a32e40070715c9bb912792d4a7b84fa06e73b9ddbc2f06c4edc19d25f5a198c7e3fc6226842e6215da5d826fcf5949612889f78e9de39d4e64b86b7033b5717a21f8f2b81c799a3fc0bfe6f5837b252eefa360c91a6148296bd19d50a343d909c1edf5261e70c8dfb2c488940cf236941ad3fd01247e37902a4bbfdd1839f7c92c260a2c494022fac08629303c8e54108d78ae2c94289c7f998ba3b622b48931ee7c17c59f5499d282467a1b8050acc94a0b17b21836c80b69f519b9b077d18e33c027faad562fa09f2cc6120f8cf5ee18cf7db9d729ffbb9de58885713215b7aebb8c98d9fa009be0a9ef3ceccdb2b31968db555b26c5c94e382d06ebf6d356e8caa85def5813dd1596d823924c4fb63dba5bd094cb64f204d1e59d31287715f831a1f0be95d8749f2166ba0b0b6b64a37991be1fe1c1e922835f2da0c074ec9413561d52166576b1c4f1e18f078dc046d1c284964b80217b55c59a474740c3649116b33e927479736bff6005859c7c00598f22cb8eca38af802f4c86836e8330492ac7ef3707890a8ff856dc7786ed769bba75b18484b257b3b022eeb51aa720639f79e6e6bd3d3c9a61f7822abe562867b4693f0b2f61135aaeaa510b31112efeec48d2602c6d4f2ddeeb51bb03ab18c18d8e127a37e22881febca47742b9332d3f2251003b1a46c40eca111d02446466b669568c70971bd33254ca577777f126f86f8a3665f065b645ff261e78e0f532e83a81b99c5de3488de74ca82daa0e4e7404eff911ae955acbb800f9f91b774e472bc14aa92817b6d85877b1861a6ca92c03c83b6f1490068bad8eab1f58c9e91e1029683de2ca45c99966966031ee86d8c9995f0612480e2a6d5396e8ae361d6fd2e24557613a1191f5019d4c8078628013512ea3a59532efffa6cfe4970d28d8c7aa8c866c4275ff2b0b4ef1a7e56854d7ee4bc445713da9349d13e30a4a802cb9db2f10280fd9ea043b5b3480441e8ed2d907eae1259befba9d87a04ce42b0010c70af157b90e0bf72549852fd122edd6cf3475f76852b13b4bf887cf32e25ad34aed7fd5a6e97b307f9b4ff1c07b2b55beef5ef3dd96eeb2a57720c18209d911a55341cee67e6ff577f7acaba01c2c9690b15a3b8aaa5b9d734196467a8c074b2eeeb5ae931ddf3deb15b1a8d603e72125c2e68ad206f2c4252a659f8248ff882a8e54126ebc0c77a46101072272460e683d465279a3695be6b64c9eeb4a576d95fd520be42eab5c95cbace0dfd80e2d67bab9f683a1cc9c006c02f0f90a21a0f51218c628f5608fbf1abc79aa63452bde1002383033578f32980e3779a8edeb226f6d3f9b36d8f07bddd7479b60346a4b4fa883940e3aef8ad8d834dad4405960a4409a6255e8753d0c0ad0960ff3ef48ce93fbe6b165e86eab36fccb8b989f5b54e6ccaa19749ff065a0a732d15c41b9072bbc6f07e1fd5a3df2775874e46b61ed50714e8c403fbed6884ec06f52ab71d2c191fcc56ac0b17ba3c46d2dab3e11c79383bd8867ff14b5fbca73b9ae594b6a09fb73a2e8f15aee59150e8d6d3dad9659025d045bbd1b9ca257c67bb78abe8f7eb9c8b3bc32951c41f7390bacc8c7059a2a9b078ab50413605aec604e4666a6ace765b0e7ab558fe6232f2703d07811e3d0ac5bf9434e87876e99250ee9db6527a8ccb4a3ee3bde738563c9746f941cf2cd7efacdbd2593cafdbe5171864b2982b54dc5a32c86638c0e650a331625033b8dd65851965ae791880349d5cd52548f4422a317f96ed79e7ccf3bd671e6dc70365f521c65206386eb1f99570a544d11b3d36fea285f8a3770ca303a965a0c1d598ebe3696e647be734ccf760d3d47dec75e236d7ac08019b6622a7b9f08bc8f0937ab75e75a047a7386befbd56fc4b2f89c852dadce8df946cb3fafe4eed2678caadf1a913ae32b2c0b8a37984cb700343c5e24609f8c5ddeff5e653837a9332a41c8e21466a13d79224125d5f6a4fef79b5adae7f4ab7d351c55400545edd3c00637bd27164828925e9bb5d79f1f1e6eb3270ab799ae38772f779565d92c47503de695f7aad7ddacda6f6c71e755b3737231b64715bf07849d3466e4f92239f733436ce674389bd16900", 0x2000, &(0x7f0000008b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x90, 0x0, 0x0, {0x100000000404, 0x0, 0xc, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xa000, 0x0, 0x0, 0x0, 0x4}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) open$dir(&(0x7f0000000000)='./file0/file0\x00', 0x125200, 0x1aa) read$FUSE(r3, &(0x7f0000004280)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_IOCTL(r3, &(0x7f0000000040)={0x20, 0x0, r5, {0x5, 0x0, 0x5, 0x6bc}}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0) recvmmsg(r0, &(0x7f0000001780)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000004c0)=""/4091, 0xe5c}, {&(0x7f00000003c0)=""/184, 0xb8}], 0x2}}, {{0x0, 0x0, 0x0}, 0x1b20cfe5}, {{0x0, 0x0, 0x0}, 0x3}], 0x3, 0x2, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x0, 0x1, 0x11, r6, 0xd32d) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r7, 0xaf01, 0x0) r8 = eventfd(0xc) syz_open_procfs(0x0, &(0x7f0000000480)='net/icmp6\x00') ioctl$VHOST_SET_LOG_FD(r7, 0x4004af07, &(0x7f0000000240)=r8) ioctl$VHOST_SET_VRING_KICK(r7, 0x4008af20, &(0x7f0000000040)={0x1, r8}) ioctl$VHOST_SET_VRING_ADDR(r7, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r7, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f0000000300)=""/91, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r7, 0x4008af03, &(0x7f0000000bc0)) ioctl$VHOST_SET_VRING_ERR(r7, 0x4008af22, &(0x7f00000002c0)={0x1, r8}) 1m37.089448671s ago: executing program 0 (id=688): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x100000002) mmap(&(0x7f0000702000/0x1000)=nil, 0x1000, 0x9, 0x2010, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f0000002600)='\x00\x00\x03\x06\x00\x00\x00\x05\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80`4/\xe9\x15\x9a\x9f\xf0:\xfd$\xad\xbb\x9a|c\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b7\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Xd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\x16\\n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x04;\xc5[\nja\xb9\'\xc9#\xfcx\x00\x00X\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~~\x84\\\xe4\x00B\x05\xd4\xea\xea\x7f=\xc6:\\N\xc3\xb7Vw\xc6\x9c\x96s\xaaHL\x96\xc72\n\x18Ynj\xceTS\xfbl\x0f\x9f8M\f\x89\xa1\xd2Hs`\x8bp\x8a\xc4%\xf8\x1d3\nV\x9a\xaf\x1f\xf96^\x93\xc1\xaf)\rg\x86\xd6\xea\xa9\x0f\x9a\xf1V\x1b\xbf\x8b\'-\xab\x8e\t7\xd3\xf7\xa9v\xfbY\xe6\x9b^d\x8c\xb1\xdd') ioctl$ASHMEM_SET_NAME(r0, 0x40087707, &(0x7f0000000300)='\x00\x00\x00\x06\x00\x00\x03\x00\x00x\x92\x12\xbc\x00\x00\xbb\x0642\x9c\x1a\xd1\xcbx\xb0\xd6\x1e\x10gQ\xca\x0e;\xf7\'\x8c\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn\x05\x00\x00\x00-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \xac\xc4K\x03\xfa\x13Vz\xbf\xe3c\x8d \x0f\xb1\xe9\xf2oci(\xcb\x82\x05\xfe[H\xaf\x01\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafd%\xf1\xdbjE\x01\xd1sD5hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\x851Y9OB\xdeB\xe1\x02-&\"1hS\x92\xe4$-\x02\x00\xe4\x8e\"\x85\xc9x\xef\x81E.r\x89\xe5\x00\x9e\x97\x96\xb8j\x81\xf0\xdca\xfb\xa6\xff\xff\xff\xff\x00\x00\x00\x00d\xf0\xf1j\x11\x12\xc0\xbb\xfdq~#\xf7\xa8\"$,\xf4\x84|\x89o\x00<\xa6-\xb0\xd3\x80\xbe\xcf\a\x00\xfc\xa6\xb1\x05\x94\x84l\xbfA\xeb\xd8\t\x00\x00\x00CvNhx461\x04N<\xedV\xcet\xaa~\xf3j\x94\xec\x92\x86uY\xf6\xb5\t?,~\xa67\\\xb9\xc9K\xf8\x9d\x96\xc0\xb5\xc7wF\x99\x12\x97T\x90.\x9c\xe3\x9a\xf1\xb9\x9c\x13\xbc\x19\xde/\xaahB\t\x97\a03\xcd\xb3\xc8\xd5l\x14!\xf9Xg2\x1d\xeeB\xccT\x0e\xd8\xef\xc8\xe9\xb4\xf3l\xc3\xf2\x998\xc8\xc2|2\xee\xb4W\x99f.\xeb\xe9\x05\xcbkz3+\xdd\xe1*8\x95@0t0\xad\xe3#\xd7\x19\xe7Q\xdfmI\xe5\x1e\xe4\x87\xc9\x8f\xa7\xe0\xd9v\xf6\x01\x9d\x8f`,\x1a8\x81I\x86l\x8f2\r:\xc1\x02\xd6Z%\xa7Ks\x8bUolS\x05\xbe\x97\x1fGe\x94\xa6\xa3\xab\xdb\r\x17\xff[\xb1\x00\xff\x7f\x00\x00\x00\x00') 1m37.081471091s ago: executing program 0 (id=689): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000100)=[@register_looper], 0x50, 0x0, &(0x7f0000000340)="a89aff67520a7335b849b4f88a6db06e45e3f5e648a65b8003975be8a982d5135e161a783d3d01fddcbd838bac308358a7e349f333e620505e4cf1982c991b516a9e26b6bb537c85f5ad467697f0d78b"}) r2 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000102515a8a440000102030109021b000101000000090400ff0207010100090501020000030000"], 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f00000011c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r3, 0x604, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x0, &(0x7f00000001c0)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, 0x0}}, 0x0}, 0x10}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) 1m36.569924619s ago: executing program 0 (id=695): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r1) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="74010000", @ANYRES16=r0, @ANYBLOB="11060000000000000000010000000800050001000000200108803c0000801400040002000000ac1e00010000000000000000240001000000000000000000000000000000000000000000000000000000000000000000e0000080a400098041000080060001000a0000001400020020010000000000000000000000000001050003000100000028000080060001000a00000014000200ff010000000000000000000000000001050003000100000028000080060001000a00000014000200ff010000000000000000000000000001050003000300000028020080060001000a00000014000200ff0100000000000000000000000000010500030000000000240001000000000000000000000000000000000000000000000000000000000000000000140004000200000000000000000000000000000024000300000000000000000000000000000000000000000000000000000000000000000014000200776731"], 0x174}}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fchown(r1, 0x0, 0xee01) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000002c0)=0x20) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x22) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000100), 0x2) r4 = memfd_create(&(0x7f0000000340)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\xdenJ\xeb\x87\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38\x14\xcb\xfa\xb3j\x92\f\xe0\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf0\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x2) fcntl$addseals(r4, 0x409, 0x7) ioctl$UDMABUF_CREATE(r3, 0x40187542, &(0x7f0000000140)={r4, 0x0, 0x0, 0x4000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='./file1\x00') ioctl$IOC_PR_RESERVE(r0, 0x401070c9, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x800001, 0x22052, r0, 0xfffff000) 1m36.51443683s ago: executing program 0 (id=696): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async) r1 = getpgrp(0x0) r2 = syz_clone3(&(0x7f0000000740)={0x10200, &(0x7f0000000240), &(0x7f0000000500), &(0x7f0000000540), {0x12}, &(0x7f0000000580)=""/190, 0xbe, &(0x7f0000000640)=""/168, &(0x7f0000000700)=[r1, r1, r1, r1, r1, r1, 0x0], 0x7}, 0x58) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x80000001) r3 = syz_pidfd_open(r1, 0x0) sendmsg$DEVLINK_CMD_SB_GET(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="ff08c624596d", @ANYRES16=0x0, @ANYBLOB="010027bd7000fcdbdf250b0000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b0001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000001}, 0x44040) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x24004040) (async) r5 = epoll_create(0x1) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f00000000c0)) r6 = syz_clone(0x20002000, 0x0, 0x0, 0x0, 0x0, 0x0) io_setup(0x9, &(0x7f0000000280)) (async) io_setup(0x10000, &(0x7f00000001c0)) (async) r7 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r7, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0xfffffffd}}, 0x10) sendmsg$tipc(r7, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x24040855}, 0x4) (async) kcmp$KCMP_EPOLL_TFD(r1, r6, 0x7, r3, &(0x7f0000000180)={r5, r3}) (async) ptrace$setregs(0xf, r1, 0x3ff, &(0x7f0000000100)="dcb81ac85a6c0d224eb58da1ac200d44b36e9e0692d3cc6566adf6d6a68234c6418d3f5d9b9716b6d0927ecc4114737aefff9e453aba362e5e204ff02d830f85c2034384d8aefd8c1cb8d168a7073b8d8b0d9cd9b09684701dca675ced9a53a06a32ca5c4309789bca2d00438e0d708f4c689262544987a1dfbb1c6ddd6a22e4e1271966b7c222f0dbaadb7a4963c99d52ed66825692361e2793133139931f307e3b2a21ffd509c4dec43c40fb1f81fd385fe0133fd4d7c928c2a581f41aa02396b49b0626ef2bebf80fd0e3f2") (async) open$dir(&(0x7f0000000000)='\x00', 0x20002, 0x72) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x24, 0x0, &(0x7f0000000340)=[@increfs_done={0x40106308, 0x3}, @decrefs, @register_looper, @register_looper], 0x0, 0x0, &(0x7f00000002c0)}) 1m21.499982229s ago: executing program 32 (id=696): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async) r1 = getpgrp(0x0) r2 = syz_clone3(&(0x7f0000000740)={0x10200, &(0x7f0000000240), &(0x7f0000000500), &(0x7f0000000540), {0x12}, &(0x7f0000000580)=""/190, 0xbe, &(0x7f0000000640)=""/168, &(0x7f0000000700)=[r1, r1, r1, r1, r1, r1, 0x0], 0x7}, 0x58) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x80000001) r3 = syz_pidfd_open(r1, 0x0) sendmsg$DEVLINK_CMD_SB_GET(r3, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="ff08c624596d", @ANYRES16=0x0, @ANYBLOB="010027bd7000fcdbdf250b0000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b0001000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000001}, 0x44040) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, 0x4, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x24004040) (async) r5 = epoll_create(0x1) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f00000000c0)) r6 = syz_clone(0x20002000, 0x0, 0x0, 0x0, 0x0, 0x0) io_setup(0x9, &(0x7f0000000280)) (async) io_setup(0x10000, &(0x7f00000001c0)) (async) r7 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r7, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0xfffffffd}}, 0x10) sendmsg$tipc(r7, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x24040855}, 0x4) (async) kcmp$KCMP_EPOLL_TFD(r1, r6, 0x7, r3, &(0x7f0000000180)={r5, r3}) (async) ptrace$setregs(0xf, r1, 0x3ff, &(0x7f0000000100)="dcb81ac85a6c0d224eb58da1ac200d44b36e9e0692d3cc6566adf6d6a68234c6418d3f5d9b9716b6d0927ecc4114737aefff9e453aba362e5e204ff02d830f85c2034384d8aefd8c1cb8d168a7073b8d8b0d9cd9b09684701dca675ced9a53a06a32ca5c4309789bca2d00438e0d708f4c689262544987a1dfbb1c6ddd6a22e4e1271966b7c222f0dbaadb7a4963c99d52ed66825692361e2793133139931f307e3b2a21ffd509c4dec43c40fb1f81fd385fe0133fd4d7c928c2a581f41aa02396b49b0626ef2bebf80fd0e3f2") (async) open$dir(&(0x7f0000000000)='\x00', 0x20002, 0x72) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x24, 0x0, &(0x7f0000000340)=[@increfs_done={0x40106308, 0x3}, @decrefs, @register_looper, @register_looper], 0x0, 0x0, &(0x7f00000002c0)}) 5.102670513s ago: executing program 4 (id=1761): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r1, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f007fdd1327c9167c643c4a1b7880610cc9", 0x26, 0x0, &(0x7f0000000540)={0xc9, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) ioctl$TCSETSF(r4, 0x5457, &(0x7f0000000000)={0x8000, 0x0, 0x7, 0x200000, 0x7, "ffffbe5a8a0600120c00006f00"}) ioctl$TCSETSW2(r4, 0x402c542c, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "7a47999e2f94c0662987295f821486acfc22c8"}) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) write$cgroup_int(r5, 0x0, 0x23) bind$inet6(r3, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000180)=[{&(0x7f0000000400)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) getgroups(0x2, &(0x7f0000000000)=[0xee01, 0xffffffffffffffff]) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x67) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000040)={0x2, &(0x7f0000000180)=[{0x1d, 0x5, 0xa, 0x5}, {0xd, 0x81, 0x6, 0x403}]}) bind$bt_hci(r7, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) write$bt_hci(r7, &(0x7f0000000040)=ANY=[], 0x6) 5.019289494s ago: executing program 4 (id=1762): geteuid() keyctl$set_reqkey_keyring(0xe, 0x3) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x2, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7}) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) io_setup(0x1d9, &(0x7f00000011c0)=0x0) io_getevents(r1, 0x4, 0x4, &(0x7f0000001680)=[{}, {}, {}, {}], &(0x7f0000001740)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xd, 0x0, &(0x7f0000000340)=[@increfs_done={0x40106308, 0x3}, @decrefs, @register_looper, @register_looper], 0x0, 0x0, &(0x7f00000002c0)}) 4.928854785s ago: executing program 4 (id=1765): r0 = creat(&(0x7f0000000080)='./file0\x00', 0x25) ioctl$NS_GET_OWNER_UID(r0, 0xb704, &(0x7f0000000280)=0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) fchown(r2, r3, r4) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r5, &(0x7f0000006300)={0x2020, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000000040)={0x50, 0x0, r6, {0x7, 0x1f, 0x0, 0x10408, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r5, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = geteuid() mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x12008, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1200}}, {}, {@blksize={'blksize', 0x3d, 0x1c00}}, {@max_read={'max_read', 0x3d, 0x900}}, {@max_read={'max_read', 0x3d, 0x20}}, {@max_read={'max_read', 0x3d, 0x8}}, {@allow_other}, {@allow_other}], [{@smackfsdef={'smackfsdef', 0x3d, 'trans=fd,'}}, {@subj_type={'subj_type', 0x3d, '(})-%!'}}, {@uid_eq={'uid', 0x3d, r7}}, {@subj_role={'subj_role', 0x3d, '\'^^{+@:!'}}, {@fowner_eq={'fowner', 0x3d, r8}}, {@flag='dirsync'}, {@smackfshat={'smackfshat', 0x3d, '+)'}}]}}) close(r0) r9 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000), 0x101000, 0x800, 0x3, 0x1}, 0x20) setsockopt$XDP_TX_RING(r9, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_to_batadv\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r9, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r9, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r9, &(0x7f00000001c0)={0x2c, 0x8, r10}, 0x10) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 4.068246129s ago: executing program 4 (id=1772): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) write$bt_hci(r0, &(0x7f0000000040)=ANY=[], 0x6) 4.066768389s ago: executing program 4 (id=1773): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000940)={{}, 'syz0\x00', 0x24}) (async) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000940)={{}, 'syz0\x00', 0x24}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x12) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x77, 0x29, 0x4, 0x20, 0x424, 0x9901, 0xc257, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x43, 0x0, 0x2, 0x31, 0x7d, 0x55, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) (async) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="401504"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="401504"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000300)={0x20, 0x1, 0x4, "94c161ee"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000b00)={0x2c, &(0x7f0000000900)={0x0, 0xe, 0x4, "52b16000"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) (async) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f00000002c0)={0x1c, &(0x7f0000000140)={0x0, 0xf, 0x4, "c7a13997"}, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f00000002c0)={0x1c, &(0x7f0000000140)={0x0, 0xf, 0x4, "c7a13997"}, 0x0, 0x0}) syz_usb_disconnect(r1) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000680)={0x2c, &(0x7f0000000340)={0x20, 0x3, 0x4, "a13b1f21"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000180)={0x20, 0x15, 0x4, "b03f99ea"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) (async) syz_usb_control_io$printer(r1, 0x0, 0x0) ioctl$UI_SET_SNDBIT(r0, 0x4004556a, 0x2) (async) ioctl$UI_SET_SNDBIT(r0, 0x4004556a, 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x202, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000001200)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x48, 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0x0, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r5, 0x400c620e, 0xfffffffffffffffe) 1.510268217s ago: executing program 2 (id=1800): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) getpeername$netlink(r0, 0x0, &(0x7f0000000c00)) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x6a400, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r1, &(0x7f0000000100)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0x2b4, @remote, 0xd}, 0x1c, 0x0}}], 0x1, 0xa0448c4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x10, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) rmdir(0x0) sendmmsg$sock(r0, &(0x7f0000000180), 0x0, 0x20000000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_devices(r2, &(0x7f0000000840)=ANY=[@ANYBLOB="1e0308004d6b71ef288563"], 0xffdd) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r6, &(0x7f0000000f00)={0x2020}, 0x2020) 1.436348139s ago: executing program 2 (id=1801): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000f40)=0xff, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000003480)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)=""/168, 0xa8}, {&(0x7f0000000100)=""/248, 0xf8}, {&(0x7f0000000780)=""/239, 0xef}, {&(0x7f0000000880)=""/4096, 0x1000}, {&(0x7f0000000040)=""/55, 0x37}, {&(0x7f0000001940)=""/197, 0xc5}, {&(0x7f0000001a40)=""/124, 0x7c}, {&(0x7f0000000380)=""/215, 0xd7}], 0x8}, 0xa}, {{0x0, 0x0, 0x0}, 0x4}], 0x2, 0x40002100, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x1c1341, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000640)={0x0, 0xfffffffffffffff3, &(0x7f0000007d00)=[{&(0x7f0000001880)=ANY=[@ANYRESHEX=r1, @ANYRES16=r4, @ANYRES32=r3], 0x1c}], 0x1}, 0x4000080) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r5, 0x7, &(0x7f0000000000)={0x1, 0x2, 0x1b8, 0x2}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$tipc(0x1e, 0x5, 0x0) r7 = epoll_create(0x3ff) r8 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r8, &(0x7f0000000240)={0xa0000000}) r9 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/4\x00') preadv(r9, &(0x7f0000000040)=[{&(0x7f0000000580)=""/85, 0x55}], 0x1, 0x0, 0xffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @random="bf9a7a7a1033"}) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="7bedcb5d07081196f37538e488a8"], 0x66) 1.287124151s ago: executing program 1 (id=1804): ioprio_set$uid(0x3, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$SOCK_DESTROY(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)={0x1c, 0x15, 0x12b, 0x70bd28, 0x25dfdbfc, {0xa, 0x8}, [@INET_DIAG_REQ_BYTECODE={0x7, 0x1, "506ac1"}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2040015}, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201500285d5c2086004040031960154030109021b000100031003090458080119662194090586d7"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x2040, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) userfaultfd(0x1) r2 = syz_clone(0x1000000, 0x0, 0xfffffd11, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) mount(0x0, 0x0, 0x0, 0x82, 0x0) syz_open_procfs(r2, 0x0) sendfile(r1, r1, 0x0, 0x7ffff000) chdir(&(0x7f0000000040)='./file0\x00') 1.286517281s ago: executing program 2 (id=1805): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000001a00)={0x8, 0x0, [{0xffff1000, 0x57, &(0x7f0000000140)=""/87}, {0x8000000, 0xdc, &(0x7f0000000580)=""/220}, {0x8000000, 0x1000, &(0x7f0000000680)=""/4096}, {0x100000, 0xea, &(0x7f0000001680)=""/234}, {0x1000, 0x8b, &(0x7f0000001780)=""/139}, {0x8080000, 0x49, &(0x7f0000000200)=""/73}, {0xeeee8000, 0xa9, &(0x7f0000001840)=""/169}, {0x6000, 0xc1, &(0x7f0000001900)=""/193}]}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) r3 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) read(r3, 0x0, 0x0) close(r2) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000080)=0x200000000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010626bd7080fbdbdf2509000000240004801300810062726f6164616173742d6c696e6b00000c000780080005001800000048e47d4ecfe91ddd14963f864f017a7e3fe851ad211b9a7635e62176bec9b2a80f97c6bbf82db1917d6f0c87c9b298243082d05f725423fa17821458d93d901591975940e9530e603d6e2b8c0490c66212ce1b50ba4833519a69830da2813a6d426a7812b16d40b1b54d03814b4957efc5c58debb32de1809122672943638297c6f7440dde09833dd80bb86d1ad325ff9349ab8189748e5f28e4fc891dcc20cddbbe8fc4bfa5184a635e76932fc8bfddcf8cf214edde8f1d11590a060fbb97adcecc4d3e6624b6fb8af778113dfa802f1a50a2469377b6283b59d7edfdede43ad8c5c0d5a5d73b944970057cc39448666577b755cdeb98da31"], 0x38}, 0x1, 0x0, 0x0, 0x20000080}, 0xc000) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000040)=0x1) dup2(r1, r1) close_range(r0, 0xffffffffffffffff, 0x0) 1.184773632s ago: executing program 2 (id=1806): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={@dev={0xfe, 0x80, '\x00', 0xf}, @ipv4={'\x00', '\xff\xff', @loopback}, @local, 0x5, 0xda69, 0x5, 0x0, 0x3, 0x800000}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x2}, @flat=@weak_binder={0x77622a85, 0x1, 0x2}, @fda={0x66646185, 0x8, 0x1, 0x18}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) 1.184399443s ago: executing program 2 (id=1807): ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7c0000000001240002801408008008000100ffffffff08000200000000000c000280053546f2bec025274e6ebf18c55273c6139f7b4fabb73a046df9444309ce6761223086b5cab587b3d8f80062c5375ba41597725d4743ebdf3559f51f5eefb88679e7055b15dc98d65fd5cf5e3c0faf259402971c5146b452d3e373f4af3155d2c3ac3c59f85d974500"/152], 0x7c}}, 0x0) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100000cb78a405e0483020b990102030109022400010000000009040000025c291d0009050900000000000009050b"], 0x0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r3 = socket$inet6(0xa, 0x3, 0x88) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000c00)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x1, 0x0, 0x2}, {0x0, 0x1fffffffe, 0x40000000007, 0x20000a0de, 0x40000000000004, 0x2, 0x200000003, 0x400}, {0x40000000000005, 0x0, 0x0, 0x5}, 0x4, 0x0, 0x1}, {{@in6=@ipv4={'\x00', '\xff\xff', @local}, 0x0, 0x6c}, 0x2, @in6=@local, 0x3502, 0x1, 0x8, 0x0, 0x9075, 0x0, 0x9945}}, 0xe8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x4}}}, 0x1c) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x100000001) mmap(&(0x7f0000701000/0x4000)=nil, 0x4000, 0x200000a, 0x12, r1, 0x2546c000) 963.848296ms ago: executing program 4 (id=1808): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) unshare(0x44040200) futex(&(0x7f0000000100)=0x1, 0x8, 0x1, 0x0, 0x0, 0xfffffffd) openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) socket(0x80000000000000a, 0x2, 0x0) r1 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 963.438156ms ago: executing program 3 (id=1809): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000080)={0x0, 0x0, {0x0, 0xfffffffc, 0x0, 0x1, 0x0, 0x800}}) (async) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0xfffffffa) (async, rerun: 32) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) (async, rerun: 32) ioctl$ASHMEM_SET_NAME(r1, 0x8008770b, &(0x7f0000000cc0)='\x00\x00\x03\x06\x00\x00\x00\x01\x00x\x92\x12\xbc\x00\x00\xbb\x0642@\xb8\xd1\xcbx\xb0\xd6\x1e\x10gQ\xca\x0e;\xf7\'\x8c\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc3\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn\x05\x00\x00\x00-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5U\x80\xc0\xb4a \xac\xc4K\x03\xfa\x13Vz\xbf\xe3c\x8d \x0f\xb1\xe9\xf2oci(\xcb\x82\x05\xfe[H\xaf\x01\x13\xc8\xdc\x00\x00\x00\x00\x00\x00\x00\xa7\xf7\xafd%\xf1\xdbjE\x01\xd1sD5h/41\x99\'\xd0\x1e}\x89\xff\x8c\x851Y9OB\xdeB\xe1\x02-&\"1hS\x92\xe4$-\x02\x00\xaf\x03\x9bWwh\xca\xf5d\x8di\xe7\xc4\xdbx\xbc\xe4\x8e\"\x85\xc9x\xef\x81E.r\x89\xe5\x00\x9e\x97\x96\xb8j\x81\xf0\xdca\xfb\xa6\xff\xff\xff\xff\x00\x00\x00\x00d\xf0\xf1j\x11\x12\xc0\xbb\xfdq~#\xf7\xa8\"$,\xf4\x84|\x89o\x00<\xa6-\xb0\xd3\x80\xbe\xcf\a\x00\xfc\xa6\xb1\x05\x94\x84l\xbfA\xeb\xd8\t\x00\x00\x00CvNhx461\x04N<\xedV\xcet\xaa~\xf3j\x94\xec\x92\x86uY\xf6NR\x13\x84~\xa67\\\xb9\xc9K\xf8\x9d\x96\xc0\xb5\xc7wF\x99\x12\x97T\x90.\x9c\xe3\x9a\xf1\xb9\x9c\x13\xbc\x19\xde/\xaa\x868hB+\x97\a03\xcd\xb3\xc8\xd5l\x14!\xf9Xg2\x1d\xeeB\xccT\x0e\xd8\xef\xc8\xe9\xb4\xf3l\xc3\xf2\x998\xc8\xc2|2\xee\xb4W\x99v.\xeb\xe9\x05\xcbkz3+\xdd\xe1*8\x95@0t0\xad\xe3#\xd7\x19\xe7Q\xdfmI\xe5\x1e\xe4\x87\xc9\x8f\xa7\xe0\xd9v\xf6\x01\x9d\x8f`,\x1a8\x81I\x86l\x8f2\r:\xc1\x02\xd6Z%\xa7Ks\x8bUolS\x05\xbe\x97\x1fGe\x94\x02\x7f\xc4T\xa5\xc1,*\x8d\xf6\x1f\xbe\x10\x04\x97\x9d+\x81\xbb8|\xf3\x8bo\xa5\xf9\xab[-t\xdf6H\xc1\xb1\b\b\xcc\xbf\xb0c\xe8S\xea6\xf5\xd0\xda/\xbf\xe5p\x82\xb8V\xe9g[\x8d\x14e;\x11o\v\xb8\xb6\x0f\xd3\x16\x82\xc5$\xce\xe2\xab\a\x1c\x8c\x843\xf4\xbb\xc8\xd3\xf5R\xb5\x8dZ\xb7Jql\x05+i{\xc5w\xfcD\x1fE\xcc]\xb7~\xd3\x99\xde\x1dX\xdc}C,|\bf\x80&WeT\x98X\xeb\xef(\x1c9\x00'/623) 958.312816ms ago: executing program 3 (id=1810): chown(&(0x7f00000022c0)='./cgroup\x00', 0x0, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r1, 0x890c, &(0x7f0000000000)=@generic={0x1800, 0x2}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYRES64=r2, @ANYRESHEX=r2, @ANYBLOB="b948ecbea5a603b7fe71783233ba7b5ac2e5815527eda31a3682a6deb7b10d1fc368ab5a89e7b81d4dc7df703c3a042fa9246bc0811bec59dc4212cb73e5a2e8a83de76342f93e474c241dad6fdbb14e8be7d944f97d3862647734add098da5b85780e0de8c5bb83f48c43f524a798f34dd343fc7ce47af9979a2c7fae205b0dddf0835f29be5218b1e3dc9253349bf654944effb8b73e139bc444eccc4a1821306c8addcbd6"], 0x14}, 0x1, 0x0, 0x0, 0x20008040}, 0xc000001) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r5, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, 0x0, 0x40000) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_BT_DEFER_SETUP(r6, 0x112, 0xf, &(0x7f0000000080)=0xfffffffe, 0x2e) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) r7 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x1, 0x7, 0xe51, 0xffffffffffffffff, 0x5479, 0x103d, 0x6, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0x0, 0x40000000009, 0x5, 0x6a], 0x2000, 0x808d6}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x2}, @flat=@weak_binder={0x77622a85, 0x1, 0x2}, @fda={0x66646185, 0x8, 0x1, 0x18}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) 896.989737ms ago: executing program 3 (id=1811): writev(0xffffffffffffffff, &(0x7f00000000c0), 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x2, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x4, 0xc, 0x0, 0x5, 0xff, 0x1f, 0x0, 0x10000}, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x9}, {0x0, 0x0, 0x3c, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x1, 0x0, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000280)={0x4003, 0x6, 0x9, 0x4, 0x0, 0x0, 0x40}, 0xc) ioctl$KVM_RUN(r2, 0xae80, 0x0) 838.153438ms ago: executing program 3 (id=1812): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x2301, 0x400000000000001}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x101240, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x101240, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x5ccc6e75, @rand_addr, 0x3}, 0x1c) listen(r2, 0x3) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000cc0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_audit(0x10, 0x3, 0x9) (async) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000004240)=@ethtool_channels={0x3d, 0x80000001, 0x7, 0x6, 0x3, 0xf44, 0x9, 0x1, 0x4a}}) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) (async) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r6, 0x400452c8, &(0x7f0000000100)) sendmsg$inet(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)="75c1cc54649640be1983f79c5bfe88cd6a6a000070ab59578db363168a2559f334d436138406b699de69db13fd737428808940bcd0940dc930c81aaad8b665cd232c5831977dd63ce2c88d43b17760a6e0df533940a702485bb198e47be60c4fe6987ebfdb041df6bbc2d10b61eb755df569c9cb7c4951ddb54505f67244cd16e376fbbdebc994d22a474b7bc494cafcac137748c8ebff7807053222d67c3ee79861e8cf4ff092236fccfbe08dcb5d7c2ba08b25883740695452a401800e631b0309b9a6963cc00e9e52df03723ce3", 0xcf}, {&(0x7f0000000f80)="b0fef28adda62f55a0000000000000001abe0a88f67472c3cd975c9884ae01084df2b71b56e2a043b74efe85a30267fae395e8a051934cefd1a1f19f89180ab13ab8ec7437b08f50479139867ffe20a7e4088d8a3f4304feafe592c403cb5d1991683fcbda9a1404998bc92cb28946223165c906e2bed23adce7939d37148e79c6b485db91083de9905e7de49fd8837cf3792d697bf8b29b9c6e8daee80e86778a4a2426e6459d4a30ad36b138b31570d8342f7094ca640633ba7e0793a6e21acbc4749413f629ba4de97b84ed9acc06a3d29ef68cd6d32fc4398429c472891f8e244d27a4b6241083efd4ecd2c92d91399de6ddcafbcd07000000000000009d1b7d60c898340102268c474bf8b7db27c8787b34cae8a9c676907ec017733c1ece82e11b99a4bdc74c8d9d1871be6af0fef62b529af9ab1f37d60a2f967d715b301856b033a7e7dac74416447a090f7b6693bbd2deaf5eebbfc9adff299bafcf5772b4f35409a8720dc2b78f09198096c60126f911fd42c29cd6fa311e2c8daef3927ccdc90436b2b6ee4c79ff80f6938e0560d9d8e925bd0180000000000000f8d9b7977fff6c4293065de2ff26a041e67954f68871d010d377f9bad3711b3ea5c6361a97d4d46b8b406091be9433f950613083805aa4ae31e3aef57eb8d299548df54dffa5c4af7f00a869c6bdbc6c2bd1a83262981638ae365b2611d2b50c5f000000d620e2a52db4283dc90000000000", 0x212}], 0x2}, 0x0) recvmsg(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)=""/233, 0xe9}], 0x1, &(0x7f0000001d00)=""/4080, 0xff0}, 0x0) close(r3) (async) close(r3) mount$9p_tcp(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000004e22']) close_range(r2, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313, 0x3}], 0x0, 0x1000000, 0x0}) 686.28507ms ago: executing program 1 (id=1813): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0xfffff038}, {0x20, 0x0, 0x0, 0xfffff00c}, {0x6}]}, 0x10) sendmmsg(r1, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000001ac0)="300000b7", 0x4}], 0x1}}], 0x1, 0x4004800) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) write$cgroup_devices(r3, &(0x7f0000000000)=ANY=[], 0x9) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r3, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x10bb40) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000a00), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000340)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f0000000000)={0x7, 0x41546}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffffa) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x9, 0x13, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f00000007c0)='\x00\x00\x03\x06\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\x87\xa3\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Hd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~\x00\x00\x00\x00\x00\x00\x00') ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f00000034c0)='\x00\x00\x03\x86\x00\x00\x00\x01\x00x\x92\x12\xbc\x00\x00\xbb\x0642\x9c\x1a\xd1\xcbx\xb0\xd6\x1e\x10gQ\xca\x0e;\xf7\'\x8c\x95\x83=\t7\x94\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcbzA\x8e\xf6\x89\xc2\'\xdfn\x054Y\xd4\x91s\x00\x00\x00-<\r\xd1?$\x8b\x17Bn\xe0\\\x98\xe1%\x1c\xf4\xd0\xf5\xd5\x80\xc4\xb4a \xac\xc4K\x03\xfa\x13Vz\xbf\xe3c\x8d \x0f\xb1\xe9\xf2oci(\xcb\x82\x05\xfe[H\xaf\x01\x18\xc8\x1b\x1e\xbe\xd8>\a\x00\x00\x00\xf7\xafd%\xf1\xdbjE\x01\xd1sD5hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\x851Y9OB\xdeB\xe1\x02-&\"1hS\x92\xe4$-\x02\x00\xe4\x8e\"\x85\xc9x\xef\x81E.r\x89\xe5\x00\x9e\x97\x96\xb8j\x81\xf0\xa5a\xfb\xa6\xff\xfbj\x11\x12\xc0\xbb\xfdq~#\xf7\xa8\"$,\xf4\x84|\x89o\x00<\xa6-\xb0\xd3\x80\xbe\xcf\a\x00\xfc\xa6\xb1\x05\x94\x84l\x05\x00\xeb\xd8\t\x00\x00\x00CvNx461\x04Nl\xedV\xcet\xaa~\x01j\x94\xec\x92\x86uY\xf6\xb5\t?,~\xa67\\\xb9\xc9K\xf8\x9d\x96\xc0\xb5\xc7wF\f\x00\x97T\x90.\x9c\xe3\x9a\xf1\xb9\x9c\x13\xbc\x19\xde/\xaahB\t\x97\a03\xcd\xb3\xc8\xd5l\x14!\xf9Xg\xc52\x1d\xeeB\xccT\x0e\xd8\xef\xc8\xe9\xb4\xf3l\xc3\x99f.\xeb\xe9\x05\xcbkz3+\xdd\xe1*8\x95@0t0\xad\xe3#\xd7\x19\xe7Q\xdfmI\xe5\x1e\xe4\x87\xc9\x8f\xa7\xe0\xd9v\xf6\x01\x9d\x8f`,\x1a8\x81I\x86l\x8f2\r:\xc1\x02\xdeZ%\xa7\x01\x00\x00\x00\x01\x00\x00\x00\xbe\x97\x1fGe\x94\xa6\xa3\xab\xdb\r\x17\xff[\xb1\x00\xff\x7f\x00\x00\x1c\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\"Y\xad\xaf\x83\xaf\x93\xdaHg\xd4\x8c\xee\x0f\x00\x1c/\x9a\xf83\';:q\x92\x010g\\Ym\xd8,\x8d\b\xab\x9dq\xed\xcc\xba\x06\x1ej\xb7s33\xe5\xec\xe90M\xd1\xfd\xbb\xdf\xedc\xd1\xbbI\xa3\xbdqU\x02\x00\x00\x00\x00\x00\x00\x00\xee\xb0\v\x84\xc7\xac\xec\x92t\x00\x00\x00\x92\x1a\f\xbbM\x1cG\xb8\xa4\x05\x16\x06\xb6\x1a\tL\xe3C$K~\xf7\xa1mt\x87E\xc4\xb6h\xf3\x8cG=&\xbd\xa16\xaa\xa2N\xac\xad,Q\x97\xd6\x15\xc46v\x9a\x97\xa6\xb9`\x03\x8ff,V\xe8\xeb\x8bJn\x12o\x8b\xe7K)+\xe0\x06\x8a\\\xfc\nw\xf8\x01\xc4\xd8\x97\xd2\x9cF\xda6F\xfa6I\x03o\xa7\x15&*\xf6Wn\xb9\x00~Y\x17:\x03\xef\xf9\x03\xe7\x8d\x16\\/\xe3\xfcV\x9d\xf2g\xbcFy\xca\x8a\x10*\xbdU#\x7f\xbb\'6\x9e\x1d\n\x19\xff[\x92n\xe1\x81q\xfe\x10\xfd\xa6pL\xc6\x0fN\x06&W\xa2\x9dPWp\x94r\xe2\x92X\x12\x87\xe5\x94\xb3Aa\xb1/\\\xde\x9c\x93\xf5(,u|\f`\x8e\x86\xeb\xcb\x18J+\xdcv\x894\x01\xd0\xc6\x95\xea^j(x\xa5\x9b\xd6f1\x9d\x8fcr\x18\x1fs%\x91~\x19@\x84!u\xc8u\x8aL\x021k\xb4\b\xbb_#A{dw<\xb9\x9dR\xef\xaf]\xe0\xca\xd9x\xdab7@\xfd\x0e\x94\xf8\xab\x8c\xf4\xf1\xb0\xd6\xbe\x8e,\xa2Y\x000F\xe6q\xe3~\xc9\xaa!\xf3\'UF\xf0\xc0\x11\x11\xc2\xc9\x93#K\xea\xc2c\xb9\xe7)\xa4\xd9X\xb9\xaay\xd1\xc7\xab\xe9F\xc6r5\xdf\xa0\'y\r\xbf\xbd\x97\x9d\x8aS\xdb\rF\x9e99\xb4\xf7\x8c\xf9\xca;\xef\xc7]\xa4\xdd<6wc5\xc6\xdeS\xe5*H\xed\xc8^a-\xe8\xb1\xc2\xca\xfa\t\xd0\\\xfc\xe9\x90\x83oj\xa9E\xfb\x8du\x94\x97\x1cF\x0f\xe9d\xf2\xe4\fc\xdf\xde\x1c\xd8u\x9b\xd7\x9c\x11\xbe\b\xb5\x1e\x04\xa0\xdc\xe1Oxu\xd7O#\n%\x89+\xcc\x9f\x8e\xb2:\xa0\xb0\xdc\xd1\xba\xbd@\xf4\x00\x00\xfd\aqn:\x83\x84N\x83K\xbf^\xd8&\xde\x14\x17\x9d\xcd\xed\x19\xd0\xc1$*K\b$\x12\xf3\x88#\xb1#\xb6RX\x11\x86X\x94\x84\x8e\xdd\x82b\x19b\x9fQ\x91\x98\x9e\xf7\xf6`\x03\xb3\x8a\x86\xf9\x00\x00\x00\x00\x00P\x00'/1066) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f00000083c0)={{0x1}}) read(r6, &(0x7f00000013c0)=""/4089, 0xff9) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r6, 0x54a2) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x66960000) ioctl$ASHMEM_SET_NAME(r0, 0x40087707, &(0x7f0000000040)='\x00\x00\x03\x06\x00\x00\x00\x05\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xf0:\xfd$\xad\xbb\x9a|c\xfc\"\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2o \x00\x00\x00\x00\x00\x00\x00H\xaf\t\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f_D\xbdt/\'\xf6\xc3\x8c\xb8\vS\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b7\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0Xd\xcf\xb9\xa2\x1d\x13\x8fC\xd2&\xd8\x9d\x8b\xe0E\xd2\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80\x1a\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13Y\x86\xd8\xbfH\xc6\x9c\x8cs4\r\xcd\xd1\x83JT\xf9\xa2\x83?\xb3\x0f\xc6&\x1d\xa3\xc4\xc3\xd2\xfd\xad\xa35o\xe8\xcd^/\xd8\xf4[n\x9fJ\xf4\n\x92c\xaa\xddT&L<+\x19R\a\xfc\xf2\x17\xb8$\xa9]\xc2\\\xda<\xc8d.w\x9c\xaf4\xbb\xe8Co\xb3\xd8\x82\x92\xba+\x99PXB\xdc\xbay\xa0s<\x92k\vJTRW\xc26\x06\x10\x92\xc7\xa55\x9fZ\xff*ir\x1e\xe8\a\x00\x00\x00\x00\x00\x00\x00\x88\x19\xf7\xdd\xa8\xef\xa0\x98\xcd\x81\x10>\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146%Z\x83H\xabF\x18<\x86h\x01=\x03i\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84x\x00\x00X\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&e$\f\rrT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\x82\x8f\xc0\xab\xe3a\x99\x17\x85\x9a\x05\xb1\x12K\\\xf2\xd5\b^[D~~\x84\\\xe4\x00') socket$nl_netfilter(0x10, 0x3, 0xc) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom0\x00', 0x1800, 0x0) write$ppp(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) memfd_create(0x0, 0x2) 682.48107ms ago: executing program 3 (id=1814): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000001a00)={0x8, 0x0, [{0xffff1000, 0x57, &(0x7f0000000140)=""/87}, {0x8000000, 0xdc, &(0x7f0000000580)=""/220}, {0x8000000, 0x1000, &(0x7f0000000680)=""/4096}, {0x100000, 0xea, &(0x7f0000001680)=""/234}, {0x1000, 0x8b, &(0x7f0000001780)=""/139}, {0x8080000, 0x49, &(0x7f0000000200)=""/73}, {0xeeee8000, 0xa9, &(0x7f0000001840)=""/169}, {0x6000, 0xc1, &(0x7f0000001900)=""/193}]}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) r3 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) read(r3, 0x0, 0x0) close(r2) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000080)=0x200000000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010626bd7080fbdbdf2509000000240004801300810062726f6164616173742d6c696e6b00000c000780080005001800000048e47d4ecfe91ddd14963f864f017a7e3fe851ad211b9a7635e62176bec9b2a80f97c6bbf82db1917d6f0c87c9b298243082d05f725423fa17821458d93d901591975940e9530e603d6e2b8c0490c66212ce1b50ba4833519a69830da2813a6d426a7812b16d40b1b54d03814b4957efc5c58debb32de1809122672943638297c6f7440dde09833dd80bb86d1ad325ff9349ab8189748e5f28e4fc891dcc20cddbbe8fc4bfa5184a635e76932fc8bfddcf8cf214edde8f1d11590a060fbb97adcecc4d3e6624b6fb8af778113dfa802f1a50a2469377b6283b59d7edfdede43ad8c5c0d5a5d73b944970057cc39448666577b755cdeb98da31"], 0x38}, 0x1, 0x0, 0x0, 0x20000080}, 0xc000) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000040)=0x1) close_range(r0, 0xffffffffffffffff, 0x0) 644.23244ms ago: executing program 3 (id=1815): capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='cgroup.controllers\x00', 0x26e1, 0x0) close(r0) r1 = syz_clone(0x20820000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_usb_connect$hid(0x3, 0x3f, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000000087d1e323200000000000109022d000100002000090400fc02030002000921ffff040122050009058103"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000440)={0x2c, &(0x7f0000000100)={0x20, 0x3, 0x5, {0x5, 0x22, "26f860"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000300)={0x0, 0x2, "4cf90fba85c830e42a3ca4b10f01bbcb15f3806c4853e7c44a6974759d9f643905a56baa4195fb396d9bfa306999f1586e5d1ca49add100a36b751a7d9fe0b182ebf2c8a0e66f72c1c08260030752f07cd4089473e52885a3c85bacf3ccfac5bb9435fe036dcfccd7254bbd8bce90e2284d29e1f17d6652270fd0abcb8729f16ff602b438bd122a9e09984e2799d0dbfef7533d1a930ea4f4b57605ace45f5815450693650ae000034aa0c5ca5e793516d156e5a5b34d6c17c40d753426a3d8e15e726d0f2622e873e0cbe63751bb62c68594d4cb0a21b92ad2e80f24a9b290a9eee6779022a0b7f5223e4e8c9f53f501ec8c439724078fdc076a51d50760566"}) fstat(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r4) r5 = syz_pidfd_open(r1, 0x0) setns(r5, 0x24020000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$SIOCSIFHWADDR(r0, 0x8b2b, &(0x7f0000000000)={'wlan1\x00', @remote}) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) getpid() ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000001500)={0x44, 0x0, &(0x7f0000001380)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x39, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 590.800461ms ago: executing program 1 (id=1816): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/if_inet6\x00') lseek(r2, 0xfffffffffffff000, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) creat(&(0x7f0000000180)='./file0\x00', 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r5, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r6 = dup(r5) write$FUSE_BMAP(r6, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r6, &(0x7f00000000c0)={0x14c}, 0x137) r7 = syz_open_dev$loop(&(0x7f0000000200), 0xfffffffffffffffd, 0x42081) ioctl$BLKTRACETEARDOWN(r7, 0x1276, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@cache_mmap}], [], 0x6b}}) chmod(&(0x7f0000000140)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000080)={{&(0x7f00003fe000/0x4000)=nil, 0x4000}}) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x3938700}, 0x0) 530.354502ms ago: executing program 1 (id=1817): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f0000000140)={0x32, 0x2, {0x5, @struct={0x80000000, 0x100}, 0x0, 0x1, 0x8000000000000001, 0x100000000000000, 0x3, 0x401, 0x2, @usage=0xfffffffffffffffc, 0xb4b, 0x6, [0x5, 0x8, 0xd, 0x1, 0x3, 0x7fffffffffffffff]}, {0x0, @struct={0x7, 0x5}, 0x0, 0x2, 0xa977, 0x0, 0xba, 0x1, 0x0, @usage=0x4, 0x4, 0x6, [0x80000000, 0x5, 0x5, 0x66, 0xf, 0x4]}, {0x800, @usage, 0x0, 0x101, 0x7, 0x76c0, 0x1, 0x3, 0x8, @struct={0x2, 0x1ff}, 0x1, 0x800, [0x1ff, 0x8001, 0x7ff, 0xfff, 0x100000001, 0x5]}, {0x3, 0xb1d6, 0x2c68}}) r1 = fsopen(&(0x7f0000000140)='tracefs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) socket(0x6, 0x6, 0x5) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081008418e00000004fcff", 0x58}], 0x1) r3 = fsmount(r1, 0x0, 0x5) fchdir(r3) renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file7\x00', 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0}) r4 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r4, 0x0) r5 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r5, 0x29, 0xd1, &(0x7f0000000180)=0x5, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, 0x0) munlockall() r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x5a1001, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) 529.148262ms ago: executing program 1 (id=1818): prlimit64(0x0, 0xe, 0x0, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={0x14, r1, 0x731, 0x2000000, 0x0, {0x38}}, 0x14}, 0x1, 0x2}, 0x0) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) gettid() (async) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22, 0x0, @loopback, 0x6}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b4560a117fffffff81000e220e227f000001925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) (async) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r8, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xc0000080, 0x0, 0x7ffffffffff7fffe}]}) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) read$FUSE(r5, &(0x7f0000000200)={0x2020}, 0x2020) mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', &(0x7f0000000180)='tmpfs\x00', 0x2200890, 0x0) r9 = openat$binfmt_format(0xffffff9c, &(0x7f0000003040)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) write$binfmt_format(r9, &(0x7f0000000040)='-1\x00', 0x3) (async) pread64(r5, &(0x7f0000002240)=""/237, 0xed, 0x4eb) 487.328373ms ago: executing program 1 (id=1819): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = syz_io_uring_setup(0x1f85, &(0x7f0000000340)={0x0, 0x0, 0x13580}, &(0x7f0000000100), &(0x7f0000000300)) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x40400, 0x4) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x0, 0x0, 0x0}, 0x10}], 0x0, 0x0, 0x0}) 0s ago: executing program 2 (id=1820): pselect6(0x2a, 0x0, &(0x7f0000000080)={0x1, 0xa, 0x0, 0x5, 0xf039, 0xffff, 0x2, 0x7}, &(0x7f00000000c0)={0x5, 0x7, 0xe882, 0x1000, 0x5, 0x2, 0x7f, 0x800}, &(0x7f0000000140), &(0x7f00000001c0)={0x0}) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) r1 = socket$inet6(0xa, 0xa, 0x100000000000088) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @mcast2}, 0x1c) r2 = socket$inet6(0xa, 0x802, 0x88) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000280)={0x5, &(0x7f0000000100)=[{0x8, 0xb3, 0x2, 0x8d}, {0xffff, 0xfc, 0xa, 0x6}, {0x80, 0x6, 0x6, 0x6}, {0x8, 0x1, 0x10, 0x80000001}, {0x7, 0x0, 0x7}]}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./bus\x00', 0x141842, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000200), 0xfea7) copy_file_range(r4, &(0x7f00000001c0), r3, 0x0, 0xffffffffa003e45b, 0x700000000000000) setsockopt$inet6_udp_int(r2, 0x11, 0x100000000a, &(0x7f00000003c0)=0x800000001, 0x4) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000d80)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x0, @remote, 0x9}, 0x1c, 0x0, 0x0, &(0x7f00000020c0)=ANY=[@ANYBLOB="38020000000000002900000036000000004300000000000004013f040100c910ff010000000000000000000000000001c910fc0000000000000000000000000000000001000740000000000e07010101000000010000000200000000000000000000000000000001000000010000002000000000000000ffffffff00000000ffffffffffffff7f06aeb07c1c192077cc9e7c45705803ad5588ca8b194d23f748fe792cfa3d32221f25d73b8ffe64a4ddda6efcfb7483b588194d29c7a04395d8500965a9a1d07879040c44db1d5d6f618d2ab920f0bf168ddc9acc6a51edd1230760d4ae8bf30f5f82a78e8114849ee8e37364560400000035bfa8197ef2ba99103ee5f5aae28ec5c8e2675db11530f5c466d55f2244d479dc653c854406155eada3eaeb90d39149b8d13bab75a9bd1452c8c76284b9ddfbeff41344e64f1771d78a706e1c5a6d63f1c954e24a1e73f75c26e9f09ec9b606cc3470f11c4842db651926bd2263a4a0a8fe80de8b2f9cb176e51819d5f4d10a5d1f0488d5e46953fbfd750f6137fbebe89a8d462158a87f9622355104b4f68d7a6d3ad85c373ea52a25afad37ffb743a5c361158087904b09fcc806d032bac00ee0e0251fc032446e45a3e12417ff4703526ffc45f71567857777927903799e0ba453334186009d22e38099c67b5350c7e82136bba947a18fb61d36fcba1f9efe3d79485d06252702833dc8ee417f40bb9064878fb89dd75a49135e5df148c4ad1e1d5626b44c8112d822f4c9a05e693fd5ae5595627f8684016b37a2bf6d0040030000000000002900000037000000006500000000000000fb1a63687c244e6df3aecb13d6eb957495b669cc032f6d0a11a5e16eed9937b046c9dc1a61dcf9754b767df4735c3f8c37b4d5cd15a99c5a19cc62c921ad4e90d6e3695e85000000a53600d5031b5735acafb556e22279975f958ad437c76573e544506e58455772eb11493af933099a5dc7e9e0c8b907e68e23e59d7b94bc774309e2047132758b60955301f277a9032b0bc47e660b243e9e2126733f13ab99055a0999068ada35a38d105a5efe6c7115774effe28695ecae3944413b7764eefde26ed571d857b2cb2dd1b2a4a84c1fec0799cf90f57f7a6d35e2b60cd425b9372ae4a27f453e5d7da2eacd3b98cdb10cec9152d5829c2511eb0f9600a0cd280f3d08849b6cd43d25e3dcd62f7c7dee6123a2682daf4aa9a856b31e9204c5c2b80b84dbeec05d93a64a550f1ebc326488cd620c6fe1aa266a0ce5b24be03b5037786e037cc85ed61f362e081fb694e12e54fcb9eb0f86d6d91fd159023a073278f84d6ada8f9aa25ec223d268f3291b25392c941740932bd1a82f40a8fc586db23d2f6240ce883e3c1dc1e0d07fc3aa73a9ac82a1538d129c9e66cb6a8100abe95bc4064581e8c01ce65ba3ea751db5d8c0a1173fe62b2fd2d415042a97ade4d274a466b6d997eed6bf5d7a305ead804c36b9e1c314b26676ed83412417610d3cf4d07e5b24cf3de9c790ae93850e0f8bba047b710cf340c78a80cef5f6665a647681ff5f7b6ecce8ab65e26406b6a6e0e72ff8501c545bffc00f034dc3a5b251390ae68bb61d936dc9a24e6f66c72e7911c51c716dfd4304566fb32e6c2745d232f990d0bbe0ddf9dc58398dda292c07b16da766a37c60bd9993b4f21e641036a8afa2ccdb47d7990d5a007faccb2f86664179f2e229723bce870aec3f7f4e529c92add713590ce6c0ea1a0499fb76d32636cfd18b6b39fb48f1a6d46f6ae8f45c47ee8260f9531070d170ab92739be0bdf5b76f8a9b93a5e550dfecab79d2e46085a67024b6be883c79ade2873458fda5a7f4eb62b05634356ee3b45723f4cff19c654ad441ff5b8792df7f18d841c351e195151b1b3532e742a6525c86efdb29653f35ce8e0a41c8c6d39f39531e13aeb1172893eeedd83b6afb939f8e6abc5482696aa48918000000000000002900000037"], 0x590}}], 0x1, 0x8008801) sendmmsg$inet6(r2, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000200)="3893cfee839f6dcf606639f4ec1fbfe03d4a4836628c52a20469e5e9518c2c30cbc3f0c33c483f8a3ffb48341db192db3469fc77b7fc31df0a0b6c412c8c63ca1802a417c946a0feb146c1c8352a785050bbef0afbc4e8", 0x57}, {0x0}], 0x2}}], 0x1, 0x2604082c) sendto$inet6(r2, 0x0, 0x0, 0x4008840, &(0x7f0000000180)={0xa, 0x4e23, 0x8be6, @dev={0xfe, 0x80, '\x00', 0xc}}, 0x1c) sendto$inet6(r2, &(0x7f0000000400)="17", 0x1, 0x40000, 0x0, 0x0) recvmmsg(r1, &(0x7f0000004b40)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x140, 0x0) fadvise64(r0, 0x3, 0x2, 0x5) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0x5a051feb1f984a1d, 0x202812, r0, 0x7dfff000) pselect6(0x2a, 0x0, &(0x7f0000000080)={0x1, 0xa, 0x0, 0x5, 0xf039, 0xffff, 0x2, 0x7}, &(0x7f00000000c0)={0x5, 0x7, 0xe882, 0x1000, 0x5, 0x2, 0x7f, 0x800}, &(0x7f0000000140), &(0x7f00000001c0)={0x0}) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) (async) socket$inet6(0xa, 0xa, 0x100000000000088) (async) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @mcast2}, 0x1c) (async) socket$inet6(0xa, 0x802, 0x88) (async) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) (async) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000280)={0x5, &(0x7f0000000100)=[{0x8, 0xb3, 0x2, 0x8d}, {0xffff, 0xfc, 0xa, 0x6}, {0x80, 0x6, 0x6, 0x6}, {0x8, 0x1, 0x10, 0x80000001}, {0x7, 0x0, 0x7}]}) (async) openat(0xffffffffffffff9c, &(0x7f0000000200)='./bus\x00', 0x141842, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) (async) write$binfmt_script(r4, &(0x7f0000000200), 0xfea7) (async) copy_file_range(r4, &(0x7f00000001c0), r3, 0x0, 0xffffffffa003e45b, 0x700000000000000) (async) setsockopt$inet6_udp_int(r2, 0x11, 0x100000000a, &(0x7f00000003c0)=0x800000001, 0x4) (async) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000d80)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x0, @remote, 0x9}, 0x1c, 0x0, 0x0, &(0x7f00000020c0)=ANY=[@ANYBLOB="38020000000000002900000036000000004300000000000004013f040100c910ff010000000000000000000000000001c910fc0000000000000000000000000000000001000740000000000e07010101000000010000000200000000000000000000000000000001000000010000002000000000000000ffffffff00000000ffffffffffffff7f06aeb07c1c192077cc9e7c45705803ad5588ca8b194d23f748fe792cfa3d32221f25d73b8ffe64a4ddda6efcfb7483b588194d29c7a04395d8500965a9a1d07879040c44db1d5d6f618d2ab920f0bf168ddc9acc6a51edd1230760d4ae8bf30f5f82a78e8114849ee8e37364560400000035bfa8197ef2ba99103ee5f5aae28ec5c8e2675db11530f5c466d55f2244d479dc653c854406155eada3eaeb90d39149b8d13bab75a9bd1452c8c76284b9ddfbeff41344e64f1771d78a706e1c5a6d63f1c954e24a1e73f75c26e9f09ec9b606cc3470f11c4842db651926bd2263a4a0a8fe80de8b2f9cb176e51819d5f4d10a5d1f0488d5e46953fbfd750f6137fbebe89a8d462158a87f9622355104b4f68d7a6d3ad85c373ea52a25afad37ffb743a5c361158087904b09fcc806d032bac00ee0e0251fc032446e45a3e12417ff4703526ffc45f71567857777927903799e0ba453334186009d22e38099c67b5350c7e82136bba947a18fb61d36fcba1f9efe3d79485d06252702833dc8ee417f40bb9064878fb89dd75a49135e5df148c4ad1e1d5626b44c8112d822f4c9a05e693fd5ae5595627f8684016b37a2bf6d0040030000000000002900000037000000006500000000000000fb1a63687c244e6df3aecb13d6eb957495b669cc032f6d0a11a5e16eed9937b046c9dc1a61dcf9754b767df4735c3f8c37b4d5cd15a99c5a19cc62c921ad4e90d6e3695e85000000a53600d5031b5735acafb556e22279975f958ad437c76573e544506e58455772eb11493af933099a5dc7e9e0c8b907e68e23e59d7b94bc774309e2047132758b60955301f277a9032b0bc47e660b243e9e2126733f13ab99055a0999068ada35a38d105a5efe6c7115774effe28695ecae3944413b7764eefde26ed571d857b2cb2dd1b2a4a84c1fec0799cf90f57f7a6d35e2b60cd425b9372ae4a27f453e5d7da2eacd3b98cdb10cec9152d5829c2511eb0f9600a0cd280f3d08849b6cd43d25e3dcd62f7c7dee6123a2682daf4aa9a856b31e9204c5c2b80b84dbeec05d93a64a550f1ebc326488cd620c6fe1aa266a0ce5b24be03b5037786e037cc85ed61f362e081fb694e12e54fcb9eb0f86d6d91fd159023a073278f84d6ada8f9aa25ec223d268f3291b25392c941740932bd1a82f40a8fc586db23d2f6240ce883e3c1dc1e0d07fc3aa73a9ac82a1538d129c9e66cb6a8100abe95bc4064581e8c01ce65ba3ea751db5d8c0a1173fe62b2fd2d415042a97ade4d274a466b6d997eed6bf5d7a305ead804c36b9e1c314b26676ed83412417610d3cf4d07e5b24cf3de9c790ae93850e0f8bba047b710cf340c78a80cef5f6665a647681ff5f7b6ecce8ab65e26406b6a6e0e72ff8501c545bffc00f034dc3a5b251390ae68bb61d936dc9a24e6f66c72e7911c51c716dfd4304566fb32e6c2745d232f990d0bbe0ddf9dc58398dda292c07b16da766a37c60bd9993b4f21e641036a8afa2ccdb47d7990d5a007faccb2f86664179f2e229723bce870aec3f7f4e529c92add713590ce6c0ea1a0499fb76d32636cfd18b6b39fb48f1a6d46f6ae8f45c47ee8260f9531070d170ab92739be0bdf5b76f8a9b93a5e550dfecab79d2e46085a67024b6be883c79ade2873458fda5a7f4eb62b05634356ee3b45723f4cff19c654ad441ff5b8792df7f18d841c351e195151b1b3532e742a6525c86efdb29653f35ce8e0a41c8c6d39f39531e13aeb1172893eeedd83b6afb939f8e6abc5482696aa48918000000000000002900000037"], 0x590}}], 0x1, 0x8008801) (async) sendmmsg$inet6(r2, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000200)="3893cfee839f6dcf606639f4ec1fbfe03d4a4836628c52a20469e5e9518c2c30cbc3f0c33c483f8a3ffb48341db192db3469fc77b7fc31df0a0b6c412c8c63ca1802a417c946a0feb146c1c8352a785050bbef0afbc4e8", 0x57}, {0x0}], 0x2}}], 0x1, 0x2604082c) (async) sendto$inet6(r2, 0x0, 0x0, 0x4008840, &(0x7f0000000180)={0xa, 0x4e23, 0x8be6, @dev={0xfe, 0x80, '\x00', 0xc}}, 0x1c) (async) sendto$inet6(r2, &(0x7f0000000400)="17", 0x1, 0x40000, 0x0, 0x0) (async) recvmmsg(r1, &(0x7f0000004b40)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x140, 0x0) (async) fadvise64(r0, 0x3, 0x2, 0x5) (async) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0x5a051feb1f984a1d, 0x202812, r0, 0x7dfff000) (async) 0s ago: executing program 2 (id=1821): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x2301, 0x400000000000001}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313, 0x3}], 0x0, 0x1000000, 0x0}) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) r4 = dup(r3) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r4, @ANYBLOB=',wfdno=', @ANYRESHEX=r5]) ioctl$PTP_PEROUT_REQUEST2(r2, 0x40383d0c, 0x0) mount$binderfs(0x0, 0x0, 0x0, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB='max']) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_INPUT(r7, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e57060", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r7, 0x0) lsm_get_self_attr(0x68, &(0x7f0000000080)={0x0, 0x0, 0xe1, 0xc1, ""/193}, &(0x7f0000000380)=0xe1, 0x0) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)={0x5c, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x34, 0x8, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x8}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}]}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000780)={0x90, r10, 0x1, 0x80, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0x4}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x81}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1400000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3f7}]}, @TIPC_NLA_NET={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xc46}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x80}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x800}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x6805}, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(r6, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000580)={0x180, r10, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x1c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NODE={0x60, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0x57, 0x3, "c7a9f2b7ccd63333396493bcdfd80a17d2e750902af6072b8c02799fb9751fcdd5fe15ad3942eb4ae26a5cc43c1cfa81cdeccc21703030704453fcd79e8fe4818a60ec6099d94be5bbab7de87bb336eeb179a5"}]}, @TIPC_NLA_SOCK={0x8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0x24, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x60000000}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x9}]}, @TIPC_NLA_NODE={0x4}, @TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffff801}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xacf9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}]}, @TIPC_NLA_NODE={0x6c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x49, 0x3, "6f0b8c23a216cf64763d6203a8c788e281166c87db268f31e2d44cb28bac6ed8a58bead23b1ea8f8e4cfadb33663d43f524d328f2f60abe1f97801b767c3ccc47d01ad6280"}, @TIPC_NLA_NODE_ID={0x19, 0x3, "736ebfb89ffcf5bc0c90bee26a774fa477d50901aa"}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}]}, @TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffc00}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}]}, 0x180}, 0x1, 0x0, 0x0, 0x11}, 0x20008081) kernel console output (not intermixed with test programs): promiscuous mode [ 119.852698][ T12] veth0_vlan: left promiscuous mode [ 119.893821][ T12] veth1_to_batadv (unregistering): left allmulticast mode [ 119.941587][ T36] audit: type=1400 audit(1750717968.350:403): avc: denied { create } for pid=2786 comm="syz.3.874" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 119.942707][ T2787] binder: Unknown parameter 'fscontex„' [ 120.004753][ T2793] rust_binder: Write failure EFAULT in pid:409 [ 120.005300][ T2793] fuse: blksize only supported for fuseblk [ 120.137055][ T2797] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 120.193862][ T2809] fuse: Unknown parameter '0x0000000000000005' [ 120.259560][ T349] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 120.281913][ T2820] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:435 [ 120.344779][ T2815] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 120.354035][ T2815] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:14 [ 120.379838][ T2825] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 120.388978][ T2825] rust_binder: Error while translating object. [ 120.399617][ T2825] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 120.406122][ T2825] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:17 [ 120.420633][ T349] usb 4-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 120.443198][ T349] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.453396][ T349] usb 4-1: config 0 descriptor?? [ 120.518516][ T2841] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:31 [ 120.536788][ T2844] fuse: Unknown parameter '0x0000000000000005' [ 120.604000][ T2852] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 120.706844][ T2852] rust_binder: Error in use_page_slow: ESRCH [ 120.719977][ T2852] rust_binder: use_range failure ESRCH [ 120.726092][ T2852] rust_binder: Failed to allocate buffer. len:5144, is_oneway:false [ 120.731621][ T2852] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 120.739721][ T2852] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:448 [ 120.788611][ T2864] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 120.846647][ T2873] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 120.846660][ T2874] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 120.846675][ T2874] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 120.855550][ T2873] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 120.864432][ T2874] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:464 [ 120.875175][ T2873] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:464 [ 120.907348][ T2876] fuse: Unknown parameter '0x0000000000000005' [ 120.977188][ T36] audit: type=1400 audit(1750717969.401:404): avc: denied { map } for pid=2881 comm="syz.1.906" path="socket:[17169]" dev="sockfs" ino=17169 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 121.057918][ T2887] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 121.058455][ T2887] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 121.471059][ T2795] binder: Bad value for 'stats' [ 121.488580][ T2899] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 121.502290][ T2899] kvm: apic: phys broadcast and lowest prio [ 121.515136][ T2899] netlink: 'syz.1.911': attribute type 4 has an invalid length. [ 121.522867][ T2899] netlink: 3581 bytes leftover after parsing attributes in process `syz.1.911'. [ 121.532718][ T36] audit: type=1400 audit(1750717969.988:405): avc: denied { accept } for pid=2898 comm="syz.1.911" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 121.554472][ T36] audit: type=1326 audit(1750717970.008:406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2898 comm="syz.1.911" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6d4218e929 code=0x0 [ 121.683027][ T349] usb 4-1: Cannot set autoneg [ 121.689985][ T349] MOSCHIP usb-ethernet driver 4-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 121.705023][ T349] usb 4-1: USB disconnect, device number 29 [ 121.711317][ T2904] rust_binder: Error in use_page_slow: ESRCH [ 121.711345][ T2904] rust_binder: use_range failure ESRCH [ 121.722306][ T2904] rust_binder: Failed to allocate buffer. len:4216, is_oneway:false [ 121.727896][ T2904] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 121.736091][ T2904] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:483 [ 121.862322][ T2913] mmap: syz.2.918 (2913) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 122.189342][ T2918] PM: Enabling pm_trace changes system date and time during resume. [ 122.189342][ T2918] PM: Correct system time has to be restored manually after resume. [ 122.274295][ T2919] binder: Unknown parameter 'defcontext01777777777777777777777' [ 122.470728][ T2928] rust_binder: Error while translating object. [ 122.470769][ T2928] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 122.472506][ T36] audit: type=1400 audit(1750717970.943:407): avc: denied { write } for pid=2923 comm="syz.4.923" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 122.477151][ T2926] rust_binder: Error while translating object. [ 122.514299][ T2928] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:44 [ 122.516315][ T2930] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 122.523968][ T2926] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 122.540046][ T2930] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 122.562743][ T2926] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:44 [ 122.609163][ T2943] SELinux: security_context_str_to_sid () failed with errno=-22 [ 122.634924][ T2949] rust_binder: Error while translating object. [ 122.634972][ T2949] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 122.647438][ T2949] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:47 [ 122.660016][ T2949] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 122.933069][ T349] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 123.128030][ T349] usb 4-1: Using ep0 maxpacket: 32 [ 123.141964][ T349] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 123.154572][ T349] usb 4-1: config 0 has no interface number 0 [ 123.172249][ T349] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 123.188957][ T349] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.205669][ T349] usb 4-1: Product: syz [ 123.214493][ T349] usb 4-1: Manufacturer: syz [ 123.223597][ T349] usb 4-1: SerialNumber: syz [ 123.235378][ T349] usb 4-1: config 0 descriptor?? [ 123.246751][ T349] smsc95xx v2.0.0 [ 123.346188][ T2986] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 123.346240][ T2986] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 123.363067][ T2990] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 123.369543][ T2990] rust_binder: Error while translating object. [ 123.401297][ T2990] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 123.410829][ T2990] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:496 [ 123.579601][ T2997] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 123.637315][ T349] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 123.655177][ T3003] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:504 [ 123.655269][ T3003] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 123.673085][ T349] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 123.725682][ T3011] 9pnet_virtio: no channels available for device syz [ 123.749690][ T3013] overlayfs: failed to clone upperpath [ 123.793569][ T3015] 9pnet: p9_errstr2errno: server reported unknown error [ 124.011841][ T3032] rust_binder: inc_ref_done called when no active inc_refs [ 124.111395][ T3045] binder: Unknown parameter 'sta' [ 124.415534][ T3064] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 124.424130][ T3064] rust_binder: Error while translating object. [ 124.424153][ T3064] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 124.441523][ T3064] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:507 [ 124.471977][ T3068] binder: Bad value for 'max' [ 124.510701][ T3075] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 124.510995][ T3075] rust_binder: Error in use_page_slow: ESRCH [ 124.517730][ T3075] rust_binder: use_range failure ESRCH [ 124.523995][ T3075] rust_binder: Failed to allocate buffer. len:4224, is_oneway:false [ 124.529509][ T3075] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 124.538350][ T3075] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:518 [ 124.572184][ T36] audit: type=1400 audit(1750717973.096:408): avc: denied { accept } for pid=3077 comm="syz.1.975" laddr=fe80::40ac:cfff:fe02:2dfc lport=58 faddr=ff02::1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 124.611998][ T306] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 124.626114][ T3084] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 124.645443][ T3089] can: request_module (can-proto-0) failed. [ 124.672995][ T3091] fuse: Unknown parameter '0x0000000000000005' [ 124.684366][ T3092] netlink: 80 bytes leftover after parsing attributes in process `syz.1.977'. [ 124.784186][ T306] usb 5-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 124.793398][ T306] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 124.803487][ T306] usb 5-1: config 0 descriptor?? [ 125.700162][ T3112] netlink: 16 bytes leftover after parsing attributes in process `syz.2.988'. [ 125.741863][ T3116] fuse: Unknown parameter '0x0000000000000005' [ 125.864116][ T36] audit: type=1400 audit(1750717974.414:409): avc: denied { ioctl } for pid=3130 comm="syz.2.996" path="socket:[18768]" dev="sockfs" ino=18768 ioctlcmd=0x8982 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 125.921766][ T3142] fuse: Unknown parameter '0x0000000000000005' [ 126.002163][ T3062] binder: Bad value for 'stats' [ 126.206660][ T306] usb 5-1: Cannot set autoneg [ 126.211556][ T306] MOSCHIP usb-ethernet driver 5-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 126.224005][ T306] usb 5-1: USB disconnect, device number 2 [ 126.402690][ T10] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 126.549717][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 126.556060][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 126.567018][ T10] usb 2-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 126.576126][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.584957][ T10] usb 2-1: config 0 descriptor?? [ 126.739344][ T349] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 126.781752][ T349] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 126.800122][ T349] usb 4-1: USB disconnect, device number 30 [ 126.810516][ T3150] input: syz0 as /devices/virtual/input/input14 [ 126.853395][ T3152] x_tables: arp_tables: NFLOG.0 target: invalid size 80 (kernel) != (user) 0 [ 126.994332][ T10] kye 0003:0458:5016.0007: control desc unexpectedly large [ 127.002897][ T10] input: HID 0458:5016 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5016.0007/input/input15 [ 127.015651][ T10] input: HID 0458:5016 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5016.0007/input/input16 [ 127.038607][ T10] kye 0003:0458:5016.0007: input,hiddev96,hidraw0: USB HID v0.09 Device [HID 0458:5016] on usb-dummy_hcd.1-1/input0 [ 127.206836][ T9] usb 5-1: new low-speed USB device number 3 using dummy_hcd [ 127.246709][ T36] audit: type=1400 audit(1750717975.833:410): avc: denied { mounton } for pid=3124 comm="syz.1.986" path="/file1/file0" dev="ramfs" ino=18212 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 127.359470][ T9] usb 5-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 127.368735][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.377859][ T9] usb 5-1: config 0 descriptor?? [ 127.514974][ T3168] FAULT_INJECTION: forcing a failure. [ 127.514974][ T3168] name failslab, interval 1, probability 0, space 0, times 1 [ 127.527747][ T3168] CPU: 0 UID: 0 PID: 3168 Comm: syz.3.1008 Not tainted 6.12.30-syzkaller-g1d4f4d446dbd #0 c93aecf919cd453af8c9b0d1ce6d9747cbb4dbdf [ 127.527786][ T3168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 127.527809][ T3168] Call Trace: [ 127.527817][ T3168] [ 127.527826][ T3168] __dump_stack+0x21/0x30 [ 127.527863][ T3168] dump_stack_lvl+0x10c/0x190 [ 127.527887][ T3168] ? __cfi_dump_stack_lvl+0x10/0x10 [ 127.527912][ T3168] ? cred_has_capability+0x281/0x380 [ 127.527936][ T3168] ? __kasan_check_write+0x18/0x20 [ 127.527956][ T3168] dump_stack+0x19/0x20 [ 127.527979][ T3168] should_fail_ex+0x3d9/0x530 [ 127.528001][ T3168] should_failslab+0xac/0x100 [ 127.528028][ T3168] kmem_cache_alloc_noprof+0x42/0x3a0 [ 127.528055][ T3168] ? getname_flags+0xc6/0x710 [ 127.528082][ T3168] getname_flags+0xc6/0x710 [ 127.528107][ T3168] ? security_capable+0xcf/0xf0 [ 127.528124][ T3168] user_path_at+0x2b/0x60 [ 127.528147][ T3168] __se_sys_pivot_root+0x180/0xcd0 [ 127.528177][ T3168] ? __kasan_check_write+0x18/0x20 [ 127.528202][ T3168] ? fput+0x1a5/0x240 [ 127.528220][ T3168] ? ksys_write+0x1ef/0x250 [ 127.528256][ T3168] ? __x64_sys_pivot_root+0x80/0x80 [ 127.528277][ T3168] ? __cfi_ksys_write+0x10/0x10 [ 127.528297][ T3168] ? __kasan_check_read+0x15/0x20 [ 127.528321][ T3168] __x64_sys_pivot_root+0x5f/0x80 [ 127.528350][ T3168] x64_sys_call+0x25b4/0x2ee0 [ 127.528375][ T3168] do_syscall_64+0x58/0xf0 [ 127.528404][ T3168] ? clear_bhb_loop+0x50/0xa0 [ 127.528421][ T3168] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 127.528437][ T3168] RIP: 0033:0x7fb866d8e929 [ 127.528461][ T3168] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 127.528481][ T3168] RSP: 002b:00007fb867cc1038 EFLAGS: 00000246 ORIG_RAX: 000000000000009b [ 127.528512][ T3168] RAX: ffffffffffffffda RBX: 00007fb866fb5fa0 RCX: 00007fb866d8e929 [ 127.528528][ T3168] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 00002000000001c0 [ 127.528544][ T3168] RBP: 00007fb867cc1090 R08: 0000000000000000 R09: 0000000000000000 [ 127.528554][ T3168] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 127.528564][ T3168] R13: 0000000000000000 R14: 00007fb866fb5fa0 R15: 00007fff0f356d18 [ 127.528577][ T3168] [ 127.757606][ T9] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 127.767820][ T9] asix 5-1:0.0: probe with driver asix failed with error -71 [ 127.776762][ T9] usb 5-1: USB disconnect, device number 3 [ 127.788658][ T3172] fuse: Unknown parameter '0x0000000000000005' [ 128.267984][ T3193] binder: Bad value for 'max' [ 128.464043][ T3214] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active [ 128.473122][ T3214] rust_binder: Write failure EINVAL in pid:119 [ 128.487917][ T3216] rust_binder: Write failure EFAULT in pid:121 [ 128.511652][ T3218] netlink: 'syz.4.1028': attribute type 24 has an invalid length. [ 128.757907][ T9] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 128.799068][ T31] usb 2-1: USB disconnect, device number 26 [ 128.905303][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 128.916311][ T9] usb 5-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config [ 128.938720][ T9] usb 5-1: config 9 has 0 interfaces, different from the descriptor's value: 1 [ 128.953868][ T9] usb 5-1: New USB device found, idVendor=06d0, idProduct=0622, bcdDevice=3f.5a [ 128.971177][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.991588][ T9] usb 5-1: Product: syz [ 128.997437][ T9] usb 5-1: Manufacturer: syz [ 129.002112][ T9] usb 5-1: SerialNumber: syz [ 129.040407][ T3241] /dev/rnullb0: Can't lookup blockdev [ 129.087614][ T3250] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 129.088104][ T3251] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:542 [ 129.159153][ T3257] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 129.169683][ T3257] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 129.180528][ T349] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 129.261849][ T3258] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 129.261875][ T3258] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:123 [ 129.348682][ T349] usb 4-1: config 0 has an invalid interface number: 104 but max is 0 [ 129.366066][ T349] usb 4-1: config 0 has no interface number 0 [ 129.372200][ T349] usb 4-1: config 0 interface 104 has no altsetting 0 [ 129.380406][ T349] usb 4-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=a1.c9 [ 129.389604][ T349] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.397665][ T349] usb 4-1: Product: syz [ 129.401934][ T349] usb 4-1: Manufacturer: syz [ 129.406532][ T349] usb 4-1: SerialNumber: syz [ 129.412256][ T349] usb 4-1: config 0 descriptor?? [ 129.416426][ T9] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 129.564140][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 129.571166][ T9] usb 2-1: config 244 has an invalid interface number: 31 but max is 3 [ 129.579488][ T9] usb 2-1: config 244 has an invalid interface number: 72 but max is 3 [ 129.587803][ T9] usb 2-1: config 244 contains an unexpected descriptor of type 0x1, skipping [ 129.596721][ T9] usb 2-1: config 244 has an invalid interface number: 103 but max is 3 [ 129.605120][ T9] usb 2-1: config 244 has an invalid interface number: 235 but max is 3 [ 129.613712][ T9] usb 2-1: config 244 has no interface number 0 [ 129.620185][ T9] usb 2-1: config 244 has no interface number 1 [ 129.632644][ T9] usb 2-1: config 244 has no interface number 2 [ 129.636399][ T349] usb 4-1: USB disconnect, device number 31 [ 129.638982][ T9] usb 2-1: config 244 has no interface number 3 [ 129.651632][ T9] usb 2-1: config 244 interface 72 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 129.662658][ T9] usb 2-1: config 244 interface 72 altsetting 2 has an invalid endpoint descriptor of length 5, skipping [ 129.674070][ T9] usb 2-1: config 244 interface 72 altsetting 2 has an endpoint descriptor with address 0xEA, changing to 0x8A [ 129.686107][ T9] usb 2-1: config 244 interface 72 altsetting 2 endpoint 0x8A has invalid maxpacket 44579, setting to 1024 [ 129.697571][ T9] usb 2-1: config 244 interface 72 altsetting 2 bulk endpoint 0x8A has invalid maxpacket 1024 [ 129.707924][ T9] usb 2-1: config 244 interface 72 altsetting 2 endpoint 0x5 has invalid maxpacket 512, setting to 64 [ 129.718915][ T9] usb 2-1: config 244 interface 72 altsetting 2 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 129.729992][ T9] usb 2-1: config 244 interface 72 altsetting 2 has a duplicate endpoint with address 0xA, skipping [ 129.740822][ T9] usb 2-1: config 244 interface 72 altsetting 2 has a duplicate endpoint with address 0x81, skipping [ 129.751755][ T9] usb 2-1: config 244 interface 72 altsetting 2 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 129.762868][ T9] usb 2-1: config 244 interface 72 altsetting 2 has a duplicate endpoint with address 0xA, skipping [ 129.773687][ T9] usb 2-1: config 244 interface 72 altsetting 2 endpoint 0x9 has invalid maxpacket 512, setting to 64 [ 129.784762][ T9] usb 2-1: config 244 interface 72 altsetting 2 has a duplicate endpoint with address 0x8, skipping [ 129.795683][ T9] usb 2-1: config 244 interface 72 altsetting 2 has a duplicate endpoint with address 0xC, skipping [ 129.806657][ T9] usb 2-1: config 244 interface 72 altsetting 2 has a duplicate endpoint with address 0xC, skipping [ 129.817542][ T9] usb 2-1: config 244 interface 72 altsetting 2 has a duplicate endpoint with address 0xA, skipping [ 129.828352][ T9] usb 2-1: config 244 interface 72 altsetting 2 has a duplicate endpoint with address 0xC, skipping [ 129.839157][ T9] usb 2-1: config 244 interface 72 altsetting 2 has an endpoint descriptor with address 0xAF, changing to 0x8F [ 129.850946][ T9] usb 2-1: config 244 interface 72 altsetting 2 has a duplicate endpoint with address 0x8F, skipping [ 129.861850][ T9] usb 2-1: config 244 interface 72 altsetting 2 has a duplicate endpoint with address 0x5, skipping [ 129.872699][ T9] usb 2-1: config 244 interface 72 altsetting 2 has 19 endpoint descriptors, different from the interface descriptor's value: 8 [ 129.886078][ T9] usb 2-1: config 244 interface 103 altsetting 129 has a duplicate endpoint with address 0x5, skipping [ 129.897189][ T9] usb 2-1: config 244 interface 103 altsetting 129 endpoint 0x2 has invalid maxpacket 1023, setting to 64 [ 129.908542][ T9] usb 2-1: too many endpoints for config 244 interface 235 altsetting 17: 166, using maximum allowed: 30 [ 129.920056][ T9] usb 2-1: config 244 interface 235 altsetting 17 has 0 endpoint descriptors, different from the interface descriptor's value: 166 [ 129.933562][ T9] usb 2-1: config 244 interface 31 has no altsetting 0 [ 129.940460][ T9] usb 2-1: config 244 interface 72 has no altsetting 0 [ 129.947326][ T9] usb 2-1: config 244 interface 103 has no altsetting 0 [ 129.954329][ T9] usb 2-1: config 244 interface 235 has no altsetting 0 [ 129.962622][ T9] usb 2-1: New USB device found, idVendor=8086, idProduct=0b5c, bcdDevice=87.e7 [ 129.971711][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.979736][ T9] usb 2-1: Product: syz [ 129.983895][ T9] usb 2-1: Manufacturer: ▫䥳閧繖鑃ã鞾æ·é³¯äš¿ä‚•ì ã¥±ï¶ì›•î¿§éŒ¡ç¼‘å‘裸銜鸇카滸둮á¡á‡†è‚‰â˜¸ä³„⌓á±ì¶ê‰¬íŒŸê™šæ„¨ê¡îŸŒç ”툎îšé©”å´·ã™ä²†é©¼à±¹á²ˆç ‹áž½Õ²åƒãº«ì—¥è„˜î¼à¹¯ç’‰æ« ç´¬æ•èŒ®é— ã»»ê’–꼗嬑ç â˜ªá¾·èœ­å¤á¸æ„ªæˆ“잦蹦襀Ί䅼â¸îŸ§ç·£ï˜¤í‰žä†…ê‘絳ȿᓋ貞îºå…„㼓纗 [ 130.013646][ T9] usb 2-1: SerialNumber: syz [ 130.153363][ T3265] rust_binder: Write failure EFAULT in pid:446 [ 130.206213][ T36] audit: type=1400 audit(1750717978.845:411): avc: denied { mounton } for pid=3269 comm="syz.2.1048" path="/bus" dev="ramfs" ino=19257 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 130.218856][ T9] usb 2-1: Found UVC 0.00 device syz (8086:0b5c) [ 130.243833][ T9] usb 2-1: No valid video chain found. [ 130.255088][ T9] usb 2-1: USB disconnect, device number 27 [ 130.827730][ T3278] netlink: 'syz.1.1051': attribute type 4 has an invalid length. [ 131.011896][ T3284] fuse: Unknown parameter '0x0000000000000005' [ 131.139052][ T31] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 131.288002][ T31] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 131.297198][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.305852][ T31] usb 2-1: config 0 descriptor?? [ 131.475035][ T9] usb 5-1: USB disconnect, device number 4 [ 131.809154][ T9] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 131.957015][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 131.963431][ T9] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 131.972007][ T9] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 131.980710][ T9] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 131.989739][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 131.999466][ T9] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 132.009162][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 132.022183][ T9] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 132.031356][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.040176][ T9] usb 5-1: config 0 descriptor?? [ 132.168853][ T3311] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=3311 comm=syz.2.1065 [ 132.184162][ T36] audit: type=1326 audit(1750717980.855:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3310 comm="syz.2.1065" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f45b358e929 code=0x0 [ 132.243958][ T9] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 132.284071][ T3312] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1065'. [ 132.300058][ T3282] binder: Bad value for 'stats' [ 132.443266][ T349] usb 5-1: USB disconnect, device number 5 [ 132.450178][ T349] usblp0: removed [ 132.505082][ T31] usb 2-1: Cannot set autoneg [ 132.509986][ T31] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 132.522392][ T31] usb 2-1: USB disconnect, device number 28 [ 132.693739][ T3316] binder: Unknown parameter 'secllÿ' [ 132.943369][ T31] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 133.020933][ T3324] can: request_module (can-proto-0) failed. [ 133.075060][ T3333] fuse: Unknown parameter '0x0000000000000005' [ 133.101311][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 133.107870][ T31] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 133.116660][ T31] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 133.125369][ T31] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 133.134552][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 133.144277][ T31] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 133.154019][ T31] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 133.167095][ T31] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 133.176220][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.190853][ T31] usb 4-1: config 0 descriptor?? [ 133.197917][ T3346] netlink: 108 bytes leftover after parsing attributes in process `syz.2.1078'. [ 133.318492][ T9] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 133.338026][ T349] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 133.395133][ T36] audit: type=1400 audit(1750717982.071:413): avc: denied { compute_member } for pid=3317 comm="syz.3.1068" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 133.396816][ T31] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 32 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 133.466587][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 133.472997][ T9] usb 2-1: config 0 has no interfaces? [ 133.478545][ T9] usb 2-1: New USB device found, idVendor=0763, idProduct=1021, bcdDevice=8e.c0 [ 133.487620][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.496350][ T9] usb 2-1: config 0 descriptor?? [ 133.515835][ T349] usb 5-1: Using ep0 maxpacket: 8 [ 133.522227][ T349] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 133.532432][ T349] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 133.541349][ T349] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 133.552508][ T349] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 133.563671][ T349] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 133.572728][ T349] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.584278][ T349] hub 5-1:1.0: bad descriptor, ignoring hub [ 133.590294][ T349] hub 5-1:1.0: probe with driver hub failed with error -5 [ 133.597594][ T349] cdc_wdm 5-1:1.0: skipping garbage [ 133.602798][ T349] cdc_wdm 5-1:1.0: skipping garbage [ 133.608567][ T349] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 133.614503][ T349] cdc_wdm 5-1:1.0: Unknown control protocol [ 133.617462][ T3318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 133.628994][ T3318] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 133.642519][ T9] usb 4-1: USB disconnect, device number 32 [ 133.654528][ T9] usblp0: removed [ 133.661100][ T36] audit: type=1326 audit(1750717982.345:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3352 comm="syz.3.1080" exe="/root/syz-executor" sig=9 arch=c000003e syscall=157 compat=0 ip=0x7fb866d8e929 code=0x0 [ 133.712650][ T36] audit: type=1400 audit(1750717982.395:415): avc: denied { read } for pid=3352 comm="syz.3.1080" name="loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 133.738109][ T3328] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 133.747235][ T36] audit: type=1400 audit(1750717982.395:416): avc: denied { open } for pid=3352 comm="syz.3.1080" path="/dev/loop-control" dev="devtmpfs" ino=48 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 133.749949][ T3328] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 133.774282][ T36] audit: type=1400 audit(1750717982.405:417): avc: denied { ioctl } for pid=3352 comm="syz.3.1080" path="/dev/loop-control" dev="devtmpfs" ino=48 ioctlcmd=0x4c80 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 133.807265][ T3357] overlayfs: missing 'lowerdir' [ 133.854559][ T9] usb 2-1: USB disconnect, device number 29 [ 133.881230][ T31] usb 5-1: USB disconnect, device number 6 [ 134.216924][ T31] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 134.366257][ T31] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 134.376851][ T31] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 134.377850][ T3363] fuse: Unknown parameter '0x0000000000000005' [ 134.386003][ T31] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 64 [ 134.403227][ T31] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 134.412449][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.421919][ T3334] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 134.429898][ T31] hub 5-1:1.0: bad descriptor, ignoring hub [ 134.435900][ T31] hub 5-1:1.0: probe with driver hub failed with error -5 [ 134.443167][ T31] cdc_wdm 5-1:1.0: skipping garbage [ 134.448436][ T31] cdc_wdm 5-1:1.0: skipping garbage [ 134.454297][ T31] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 134.460264][ T31] cdc_wdm 5-1:1.0: Unknown control protocol [ 134.730819][ T305] usb 5-1: USB disconnect, device number 7 [ 134.819683][ T9] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 134.969114][ T9] usb 4-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 134.978277][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.986922][ T9] usb 4-1: config 0 descriptor?? [ 135.151778][ T3382] bridge0: entered promiscuous mode [ 135.207032][ T3381] bridge0: left promiscuous mode [ 135.259712][ T3387] fuse: Unknown parameter '0x0000000000000005' [ 135.305010][ T3391] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1095'. [ 135.314183][ T3391] tipc: Invalid UDP bearer configuration [ 135.314210][ T3391] tipc: Enabling of bearer rejected, failed to enable media [ 135.481976][ T31] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 135.630294][ T31] usb 5-1: Using ep0 maxpacket: 32 [ 135.636590][ T31] usb 5-1: config 0 has no interfaces? [ 135.642493][ T31] usb 5-1: New USB device found, idVendor=0763, idProduct=1021, bcdDevice=8e.c0 [ 135.651630][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.661242][ T31] usb 5-1: config 0 descriptor?? [ 135.919474][ T3401] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 135.928115][ T3401] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 135.983784][ T3378] binder: Bad value for 'stats' [ 135.991376][ T305] usb 5-1: USB disconnect, device number 8 [ 136.109897][ T3403] overlayfs: missing 'lowerdir' [ 136.115573][ T3403] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 136.124356][ T3403] overlayfs: missing 'lowerdir' [ 136.190168][ T9] usb 4-1: Cannot set autoneg [ 136.196392][ T9] MOSCHIP usb-ethernet driver 4-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 136.212179][ T9] usb 4-1: USB disconnect, device number 33 [ 136.714256][ T36] audit: type=1400 audit(1750717985.440:418): avc: denied { append } for pid=3415 comm="syz.3.1103" name="001" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 136.921129][ T36] audit: type=1400 audit(1750717985.642:419): avc: denied { setopt } for pid=3425 comm="syz.3.1106" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 136.921403][ T3426] lo: entered promiscuous mode [ 136.949169][ T3425] lo: left promiscuous mode [ 137.126772][ T3438] fuse: Unknown parameter '0x0000000000000005' [ 137.489460][ T36] audit: type=1400 audit(1750717986.218:420): avc: denied { setattr } for pid=3452 comm="syz.4.1116" name="RAW" dev="sockfs" ino=20013 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 137.543701][ T36] audit: type=1400 audit(1750717986.279:421): avc: denied { read write } for pid=3454 comm="syz.4.1117" name="usbmon9" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 137.577315][ T36] audit: type=1400 audit(1750717986.279:422): avc: denied { open } for pid=3454 comm="syz.4.1117" path="/dev/usbmon9" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 137.628214][ T3457] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:157 [ 137.766603][ T3461] overlayfs: failed to resolve './file1': -2 [ 137.879944][ T36] audit: type=1400 audit(1750717986.612:423): avc: denied { mounton } for pid=3470 comm="syz.1.1122" path="/216/file0" dev="tmpfs" ino=1208 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 138.030111][ T36] audit: type=1400 audit(1750717986.763:424): avc: denied { map } for pid=3477 comm="syz.4.1124" path="pipe:[20963]" dev="pipefs" ino=20963 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 138.322512][ T349] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 138.390282][ T36] audit: type=1400 audit(1750717987.127:425): avc: denied { create } for pid=3489 comm="syz.2.1129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 138.411037][ T3490] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1129'. [ 138.432559][ T36] audit: type=1400 audit(1750717987.147:426): avc: denied { write } for pid=3489 comm="syz.2.1129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 138.456063][ T36] audit: type=1400 audit(1750717987.147:427): avc: denied { nlmsg_write } for pid=3489 comm="syz.2.1129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 138.486613][ T3495] fuse: Unknown parameter '0x0000000000000005' [ 138.494001][ T349] usb 4-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 138.503391][ T349] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.513942][ T349] usb 4-1: config 0 descriptor?? [ 138.570359][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 139.144952][ T31] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 139.293577][ T31] usb 2-1: Using ep0 maxpacket: 32 [ 139.299919][ T31] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 139.308370][ T31] usb 2-1: config 0 has no interface number 0 [ 139.314654][ T31] usb 2-1: config 0 interface 184 has no altsetting 0 [ 139.323042][ T31] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 139.332423][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.340740][ T31] usb 2-1: Product: syz [ 139.345242][ T31] usb 2-1: Manufacturer: syz [ 139.349898][ T31] usb 2-1: SerialNumber: syz [ 139.355807][ T31] usb 2-1: config 0 descriptor?? [ 139.364239][ T31] smsc75xx v1.0.0 [ 139.720238][ T349] usb 4-1: Cannot set autoneg [ 139.725348][ T349] MOSCHIP usb-ethernet driver 4-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 139.738061][ T349] usb 4-1: USB disconnect, device number 34 [ 139.957921][ T31] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 139.968944][ T31] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 140.272118][ T3543] fuse: Unknown parameter '0x0000000000000005' [ 140.580639][ T3522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 140.589435][ T3522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 140.622456][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 140.623899][ T1630] Bluetooth: hci0: command 0x1003 tx timeout [ 140.801869][ T3545] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1150'. [ 140.995702][ T31] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 141.006794][ T31] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to write PMT_CTL: -71 [ 141.016583][ T31] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 141.026109][ T31] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 141.037096][ T31] usb 2-1: USB disconnect, device number 30 [ 141.160142][ T3566] rust_binder: Failed to vm_insert_page(35184388857856): vma_addr:35184388853760 i:1 err:EFAULT [ 141.160186][ T3566] rust_binder: Error in use_page_slow: EFAULT [ 141.166686][ T3569] overlayfs: failed to resolve './file0': -2 [ 141.170850][ T3566] rust_binder: use_range failure EFAULT [ 141.182888][ T3566] rust_binder: Failed to allocate buffer. len:4224, is_oneway:true [ 141.188573][ T3566] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 141.196627][ T3566] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:179 [ 141.243174][ T3577] fuse: Unknown parameter '0x0000000000000005' [ 141.327656][ T3580] SELinux: security_context_str_to_sid (sytem_uÝGй ‰:ÿß) failed with errno=-22 [ 141.520931][ T3596] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 141.521282][ T3596] rust_binder: Failed to allocate buffer. len:65376, is_oneway:true [ 141.527796][ T3596] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 141.536203][ T3596] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:200 [ 141.603103][ T3614] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 141.613144][ T3614] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 255) [ 141.619670][ T3614] rust_binder: Error while translating object. [ 141.630549][ T3614] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 141.638799][ T3614] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:212 [ 141.781412][ T3630] overlayfs: missing 'lowerdir' [ 141.808544][ T3632] exFAT-fs (rnullb0): invalid boot record signature [ 141.815326][ T3632] exFAT-fs (rnullb0): failed to read boot sector [ 141.821769][ T3632] exFAT-fs (rnullb0): failed to recognize exfat type [ 141.829921][ T3632] exFAT-fs (rnullb0): invalid boot record signature [ 141.836669][ T3632] exFAT-fs (rnullb0): failed to read boot sector [ 141.843128][ T3632] exFAT-fs (rnullb0): failed to recognize exfat type [ 141.942159][ T306] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 141.961987][ T31] usb 4-1: new low-speed USB device number 35 using dummy_hcd [ 142.080080][ T3638] netlink: 'syz.2.1186': attribute type 4 has an invalid length. [ 142.102347][ T306] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 142.110952][ T344] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 142.113609][ T306] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 142.122679][ T31] usb 4-1: config 0 interface 0 altsetting 252 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 142.130869][ T306] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 142.143070][ T3639] cgroup2: Unknown parameter 'obj_user' [ 142.155019][ T306] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 142.160356][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 142.169610][ T306] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.176118][ T31] usb 4-1: New USB device found, idVendor=17ef, idProduct=60b5, bcdDevice= 0.00 [ 142.187352][ T306] usb 2-1: config 0 descriptor?? [ 142.196804][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.206703][ T31] usb 4-1: config 0 descriptor?? [ 142.212019][ T3623] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 142.272298][ T344] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 142.281455][ T344] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.289624][ T344] usb 5-1: Product: syz [ 142.293831][ T344] usb 5-1: Manufacturer: syz [ 142.298493][ T344] usb 5-1: SerialNumber: syz [ 142.551180][ T3662] fuse: Unknown parameter '0x0000000000000005' [ 142.599061][ T306] plantronics 0003:047F:FFFF.0008: item fetching failed at offset 13/15 [ 142.607745][ T306] plantronics 0003:047F:FFFF.0008: parse failed [ 142.614089][ T306] plantronics 0003:047F:FFFF.0008: probe with driver plantronics failed with error -22 [ 142.801895][ T3618] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 142.810607][ T3618] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 142.823021][ T3623] usb 5-1: USB disconnect, device number 9 [ 142.832317][ T3623] lo: entered promiscuous mode [ 142.838228][ T3623] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 142.849714][ T3623] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 142.864235][ T3623] lo: left promiscuous mode [ 142.870044][ T31] usbhid 4-1:0.0: can't add hid device: -71 [ 142.876754][ T31] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 142.900571][ T31] usb 4-1: USB disconnect, device number 35 [ 142.915495][ T344] usb 2-1: USB disconnect, device number 31 [ 143.272584][ T31] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 143.423795][ T31] usb 4-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 143.434353][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.444658][ T31] usb 4-1: config 0 descriptor?? [ 143.473663][ T36] kauditd_printk_skb: 7 callbacks suppressed [ 143.473682][ T36] audit: type=1400 audit(1750717992.258:435): avc: denied { setopt } for pid=3679 comm="syz.1.1201" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 143.523012][ T3685] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1203'. [ 143.532823][ T3685] erofs: (device rnullb0): erofs_read_superblock: cannot find valid erofs superblock [ 143.716987][ T3690] fuse: Unknown parameter '0x0000000000000005' [ 144.441972][ T36] audit: type=1400 audit(1750717993.224:436): avc: denied { execute } for pid=3716 comm="syz.2.1218" path="/439/cpu.stat" dev="tmpfs" ino=2425 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 144.465178][ T3669] binder: Bad value for 'stats' [ 144.488180][ T36] audit: type=1400 audit(1750717993.274:437): avc: denied { link } for pid=3721 comm="syz.2.1220" name="file1" dev="tmpfs" ino=2437 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 144.648896][ T36] audit: type=1400 audit(1750717993.435:438): avc: denied { execute_no_trans } for pid=3740 comm="syz.1.1225" path="/231/file1" dev="tmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 144.649167][ T3741] can: request_module (can-proto-0) failed. [ 144.680256][ T31] usb 4-1: Cannot set autoneg [ 144.685186][ T31] MOSCHIP usb-ethernet driver 4-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 144.698180][ T31] usb 4-1: USB disconnect, device number 36 [ 144.884836][ T3755] fuse: Unknown parameter '0x0000000000000005' [ 144.941788][ T344] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 145.092047][ T344] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 145.103042][ T344] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 145.112832][ T344] usb 2-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 145.121939][ T344] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.130558][ T344] usb 2-1: config 0 descriptor?? [ 145.189687][ T3757] exFAT-fs (rnullb0): invalid boot record signature [ 145.196412][ T3757] exFAT-fs (rnullb0): failed to read boot sector [ 145.202814][ T3757] exFAT-fs (rnullb0): failed to recognize exfat type [ 145.536974][ T344] hid-steam 0003:28DE:1142.0009: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 145.571077][ T36] audit: type=1326 audit(1750717994.371:439): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3770 comm="syz.2.1235" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f45b358e929 code=0x0 [ 145.607790][ T344] hid-steam 0003:28DE:1142.0009: Steam wireless receiver connected [ 145.625633][ T344] hid-steam 0003:28DE:1142.000A: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 145.710000][ T3779] overlayfs: conflicting options: userxattr,redirect_dir=on [ 146.415145][ T36] audit: type=1400 audit(1750717995.216:440): avc: denied { associate } for pid=3822 comm="syz.2.1252" name="rnullb0" scontext=root:object_r:etc_runtime_t tcontext=system_u:object_r:root_t tclass=filesystem permissive=1 [ 146.592203][ T306] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 146.731428][ T306] usb 4-1: device descriptor read/64, error -71 [ 146.811003][ T31] usb 2-1: reset high-speed USB device number 32 using dummy_hcd [ 146.940279][ T31] usb 2-1: device descriptor read/64, error -32 [ 146.970160][ T306] usb 4-1: device descriptor read/64, error -71 [ 147.178980][ T31] usb 2-1: device descriptor read/64, error -32 [ 147.208852][ T306] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 147.338187][ T306] usb 4-1: device descriptor read/64, error -71 [ 147.417826][ T31] usb 2-1: reset high-speed USB device number 32 using dummy_hcd [ 147.486900][ T3865] fuse: Bad value for 'group_id' [ 147.492253][ T3865] fuse: Bad value for 'group_id' [ 147.577083][ T306] usb 4-1: device descriptor read/64, error -71 [ 147.686482][ T306] usb usb4-port1: attempt power cycle [ 148.007842][ T31] usb 2-1: device descriptor read/64, error -32 [ 148.034604][ T306] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 148.065450][ T306] usb 4-1: device descriptor read/8, error -71 [ 148.194871][ T306] usb 4-1: device descriptor read/8, error -71 [ 148.432637][ T306] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 148.453662][ T306] usb 4-1: device descriptor read/8, error -71 [ 148.582982][ T306] usb 4-1: device descriptor read/8, error -71 [ 148.691611][ T306] usb usb4-port1: unable to enumerate USB device [ 148.744634][ T3916] can0: slcan on ptm0. [ 148.845052][ T36] audit: type=1400 audit(1750717997.658:441): avc: denied { append } for pid=3924 comm="syz.4.1285" name="loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 148.901999][ T344] usb 2-1: USB disconnect, device number 32 [ 148.910999][ T344] hid-steam 0003:28DE:1142.0009: Steam wireless receiver disconnected [ 149.336224][ T3944] can: request_module (can-proto-0) failed. [ 149.342296][ T3944] can: request_module (can-proto-0) failed. [ 149.348323][ T3944] can: request_module (can-proto-0) failed. [ 149.354332][ T3944] can: request_module (can-proto-0) failed. [ 149.360537][ T3944] can: request_module (can-proto-0) failed. [ 149.366558][ T3944] can: request_module (can-proto-0) failed. [ 149.372867][ T3944] can: request_module (can-proto-0) failed. [ 149.379174][ T3944] can: request_module (can-proto-0) failed. [ 149.385406][ T3944] can: request_module (can-proto-0) failed. [ 149.407610][ T36] audit: type=1400 audit(1750717998.221:442): avc: denied { read } for pid=3952 comm="syz.3.1291" name="ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 149.434212][ T36] audit: type=1400 audit(1750717998.221:443): avc: denied { open } for pid=3952 comm="syz.3.1291" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 149.459472][ T36] audit: type=1400 audit(1750717998.271:444): avc: denied { write } for pid=3952 comm="syz.3.1291" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 149.464759][ T3954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 149.482569][ T36] audit: type=1400 audit(1750717998.271:445): avc: denied { ioctl } for pid=3952 comm="syz.3.1291" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 149.492673][ T3954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 149.558931][ T3914] can0 (unregistered): slcan off ptm0. [ 149.633196][ T3973] rust_binder: Error while translating object. [ 149.633241][ T3973] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 149.647020][ T3973] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:669 [ 149.706755][ T9] usb 4-1: new low-speed USB device number 41 using dummy_hcd [ 149.829328][ T3996] can: request_module (can-proto-0) failed. [ 149.867874][ T9] usb 4-1: config 9 has an invalid interface number: 51 but max is 0 [ 149.876110][ T9] usb 4-1: config 9 has no interface number 0 [ 149.884449][ T9] usb 4-1: string descriptor 0 read error: -22 [ 149.890749][ T9] usb 4-1: New USB device found, idVendor=07a6, idProduct=07c2, bcdDevice=37.12 [ 149.899869][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.084993][ T344] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 150.109218][ T9] usb 4-1: USB disconnect, device number 41 [ 150.214392][ T344] usb 2-1: device descriptor read/64, error -71 [ 150.453363][ T344] usb 2-1: device descriptor read/64, error -71 [ 150.645852][ T4006] rust_binder: Write failure EFAULT in pid:566 [ 150.646273][ T4007] rust_binder: Write failure EFAULT in pid:566 [ 150.693461][ T344] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 150.851692][ T344] usb 2-1: device descriptor read/64, error -71 [ 151.100637][ T344] usb 2-1: device descriptor read/64, error -71 [ 151.220249][ T344] usb usb2-port1: attempt power cycle [ 151.578765][ T344] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 151.609722][ T344] usb 2-1: device descriptor read/8, error -71 [ 151.739995][ T344] usb 2-1: device descriptor read/8, error -71 [ 151.739995][ T4031] binder: Unknown parameter '0xffffffffffffffff' [ 151.765881][ T36] audit: type=1400 audit(1750718000.591:446): avc: denied { checkpoint_restore } for pid=4032 comm="syz.3.1311" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 151.987218][ T344] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 152.018514][ T344] usb 2-1: device descriptor read/8, error -71 [ 152.168811][ T344] usb 2-1: device descriptor read/8, error -71 [ 152.277113][ T344] usb usb2-port1: unable to enumerate USB device [ 152.310960][ T4043] overlay: Unknown parameter 'mounts' [ 152.364109][ T4052] netlink: 'syz.2.1316': attribute type 29 has an invalid length. [ 152.372671][ T36] audit: type=1400 audit(1750718001.193:447): avc: denied { accept } for pid=4051 comm="syz.2.1316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 152.631354][ T4059] rust_binder: Error while translating object. [ 152.631392][ T4059] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 152.637920][ T4059] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:586 [ 152.662013][ T4061] sit0: entered promiscuous mode [ 152.677899][ T4061] netlink: 'syz.3.1320': attribute type 1 has an invalid length. [ 152.685707][ T4061] netlink: 1 bytes leftover after parsing attributes in process `syz.3.1320'. [ 152.765542][ T4063] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:588 [ 152.774552][ T4065] FAULT_INJECTION: forcing a failure. [ 152.774552][ T4065] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 152.796789][ T4065] CPU: 0 UID: 0 PID: 4065 Comm: syz.4.1321 Not tainted 6.12.30-syzkaller-g1d4f4d446dbd #0 c93aecf919cd453af8c9b0d1ce6d9747cbb4dbdf [ 152.796827][ T4065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 152.796841][ T4065] Call Trace: [ 152.796849][ T4065] [ 152.796857][ T4065] __dump_stack+0x21/0x30 [ 152.796888][ T4065] dump_stack_lvl+0x10c/0x190 [ 152.796913][ T4065] ? __cfi_dump_stack_lvl+0x10/0x10 [ 152.796939][ T4065] dump_stack+0x19/0x20 [ 152.796963][ T4065] should_fail_ex+0x3d9/0x530 [ 152.796987][ T4065] should_fail+0xf/0x20 [ 152.797010][ T4065] should_fail_usercopy+0x1e/0x30 [ 152.797037][ T4065] _copy_from_user+0x22/0xb0 [ 152.797067][ T4065] get_user_ifreq+0x71/0x180 [ 152.797092][ T4065] sock_ioctl+0x6fb/0x7b0 [ 152.797117][ T4065] ? __cfi_sock_ioctl+0x10/0x10 [ 152.797145][ T4065] ? bpf_lsm_file_ioctl+0xd/0x20 [ 152.797170][ T4065] ? security_file_ioctl+0x34/0xd0 [ 152.797201][ T4065] ? __cfi_sock_ioctl+0x10/0x10 [ 152.797226][ T4065] __se_sys_ioctl+0x135/0x1b0 [ 152.797260][ T4065] __x64_sys_ioctl+0x7f/0xa0 [ 152.797289][ T4065] x64_sys_call+0x1878/0x2ee0 [ 152.797318][ T4065] do_syscall_64+0x58/0xf0 [ 152.797355][ T4065] ? clear_bhb_loop+0x50/0xa0 [ 152.797378][ T4065] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 152.797400][ T4065] RIP: 0033:0x7f8cf238e929 [ 152.797417][ T4065] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 152.797437][ T4065] RSP: 002b:00007f8cf325c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 152.797461][ T4065] RAX: ffffffffffffffda RBX: 00007f8cf25b5fa0 RCX: 00007f8cf238e929 [ 152.797478][ T4065] RDX: 0000200000000600 RSI: 00000000000089f1 RDI: 0000000000000004 [ 152.797494][ T4065] RBP: 00007f8cf325c090 R08: 0000000000000000 R09: 0000000000000000 [ 152.797508][ T4065] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 152.797521][ T4065] R13: 0000000000000000 R14: 00007f8cf25b5fa0 R15: 00007ffc49e04468 [ 152.797539][ T4065] [ 152.916709][ T4067] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 153.555217][ T4086] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 153.561802][ T4086] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:592 [ 153.585240][ T36] audit: type=1400 audit(1750718002.418:448): avc: denied { create } for pid=4088 comm="syz.3.1330" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 153.605969][ T4091] FAULT_INJECTION: forcing a failure. [ 153.605969][ T4091] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 153.626879][ T4091] CPU: 1 UID: 0 PID: 4091 Comm: syz.3.1331 Not tainted 6.12.30-syzkaller-g1d4f4d446dbd #0 c93aecf919cd453af8c9b0d1ce6d9747cbb4dbdf [ 153.626909][ T4091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 153.626919][ T4091] Call Trace: [ 153.626924][ T4091] [ 153.626930][ T4091] __dump_stack+0x21/0x30 [ 153.626953][ T4091] dump_stack_lvl+0x10c/0x190 [ 153.626971][ T4091] ? __cfi_dump_stack_lvl+0x10/0x10 [ 153.626990][ T4091] ? __ia32_compat_sys_ioctl+0x850/0x850 [ 153.627014][ T4091] dump_stack+0x19/0x20 [ 153.627030][ T4091] should_fail_ex+0x3d9/0x530 [ 153.627049][ T4091] should_fail+0xf/0x20 [ 153.627065][ T4091] should_fail_usercopy+0x1e/0x30 [ 153.627084][ T4091] _copy_from_user+0x22/0xb0 [ 153.627106][ T4091] ip6gre_tunnel_siocdevprivate+0x20e/0x880 [ 153.627123][ T4091] ? __cfi_ip6gre_tunnel_siocdevprivate+0x10/0x10 [ 153.627142][ T4091] ? full_name_hash+0xa1/0xf0 [ 153.627168][ T4091] dev_ifsioc+0xb02/0xe60 [ 153.627202][ T4091] ? dev_ioctl+0x1030/0x1030 [ 153.627235][ T4091] ? dev_get_by_name_rcu+0xe9/0x140 [ 153.627261][ T4091] dev_ioctl+0xa9b/0x1030 [ 153.627284][ T4091] sock_ioctl+0x737/0x7b0 [ 153.627303][ T4091] ? __cfi_sock_ioctl+0x10/0x10 [ 153.627323][ T4091] ? bpf_lsm_file_ioctl+0xd/0x20 [ 153.627340][ T4091] ? security_file_ioctl+0x34/0xd0 [ 153.627363][ T4091] ? __cfi_sock_ioctl+0x10/0x10 [ 153.627381][ T4091] __se_sys_ioctl+0x135/0x1b0 [ 153.627404][ T4091] __x64_sys_ioctl+0x7f/0xa0 [ 153.627426][ T4091] x64_sys_call+0x1878/0x2ee0 [ 153.627446][ T4091] do_syscall_64+0x58/0xf0 [ 153.627469][ T4091] ? clear_bhb_loop+0x50/0xa0 [ 153.627485][ T4091] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 153.627503][ T4091] RIP: 0033:0x7fb866d8e929 [ 153.627518][ T4091] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 153.627531][ T4091] RSP: 002b:00007fb867cc1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 153.627548][ T4091] RAX: ffffffffffffffda RBX: 00007fb866fb5fa0 RCX: 00007fb866d8e929 [ 153.627560][ T4091] RDX: 0000200000000600 RSI: 00000000000089f1 RDI: 0000000000000004 [ 153.627571][ T4091] RBP: 00007fb867cc1090 R08: 0000000000000000 R09: 0000000000000000 [ 153.627580][ T4091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 153.627590][ T4091] R13: 0000000000000000 R14: 00007fb866fb5fa0 R15: 00007fff0f356d18 [ 153.627603][ T4091] [ 153.892976][ T4097] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 153.917490][ T4102] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 4200, limit: 4216, size: 18446744073709550742) [ 153.923990][ T4102] rust_binder: Error while translating object. [ 153.936420][ T4102] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 153.942837][ T4102] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:261 [ 153.993445][ T4109] sit0: entered promiscuous mode [ 154.009017][ T4109] netlink: 'syz.4.1338': attribute type 1 has an invalid length. [ 154.016920][ T4109] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1338'. [ 154.119329][ T512] usb 4-1: new low-speed USB device number 42 using dummy_hcd [ 154.147331][ T36] audit: type=1400 audit(1750718002.980:449): avc: denied { name_bind } for pid=4111 comm="syz.4.1339" src=65530 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 154.289931][ T512] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 154.299607][ T512] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.308621][ T36] audit: type=1400 audit(1750718005.139:450): avc: denied { setopt } for pid=4121 comm="syz.2.1343" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 154.309677][ T512] usb 4-1: config 0 descriptor?? [ 154.334936][ T36] audit: type=1400 audit(1750718005.169:451): avc: denied { getopt } for pid=4121 comm="syz.2.1343" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 154.518075][ T36] audit: type=1400 audit(1750718005.349:452): avc: denied { map } for pid=4135 comm="syz.4.1347" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 154.549776][ T4139] rust_binder: Error while translating object. [ 154.549804][ T4139] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 154.556140][ T4139] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:286 [ 154.718591][ T4095] overlayfs: statfs failed on './file0' [ 154.746619][ T36] audit: type=1400 audit(1750718005.579:453): avc: denied { map } for pid=4147 comm="syz.1.1351" path="socket:[23642]" dev="sockfs" ino=23642 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 154.769785][ T36] audit: type=1400 audit(1750718005.579:454): avc: denied { accept } for pid=4147 comm="syz.1.1351" path="socket:[23642]" dev="sockfs" ino=23642 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 154.781881][ T4149] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 154.902284][ T4156] rust_binder: Write failure EINVAL in pid:700 [ 154.985987][ T4165] binder: Bad value for 'stats' [ 154.997636][ T512] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 155.012999][ T512] asix 4-1:0.0: probe with driver asix failed with error -71 [ 155.031697][ T512] usb 4-1: USB disconnect, device number 42 [ 155.044623][ T36] audit: type=1400 audit(1750718005.879:455): avc: denied { read } for pid=4171 comm="syz.1.1359" path="socket:[23677]" dev="sockfs" ino=23677 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 155.143719][ T4183] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 155.368827][ T10] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 155.518788][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 155.525234][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 155.539076][ T10] usb 2-1: config 5 has an invalid interface number: 40 but max is 0 [ 155.547491][ T10] usb 2-1: config 5 has no interface number 0 [ 155.553905][ T10] usb 2-1: config 5 interface 40 has no altsetting 0 [ 155.565540][ T10] usb 2-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.07 [ 155.578786][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.586831][ T10] usb 2-1: Product: syz [ 155.598786][ T10] usb 2-1: Manufacturer: syz [ 155.603571][ T10] usb 2-1: SerialNumber: syz [ 155.811451][ T512] hid-generic 0000:0003:0000.000B: item fetching failed at offset 0/2 [ 155.824370][ T512] hid-generic 0000:0003:0000.000B: probe with driver hid-generic failed with error -22 [ 155.868098][ T4189] overlayfs: conflicting lowerdir path [ 157.019669][ T4246] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 157.020094][ T4246] rust_binder: Error while translating object. [ 157.030986][ T4246] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 157.040977][ T4246] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:608 [ 157.635315][ T4256] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 157.654956][ T4256] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:295 [ 157.774593][ T36] audit: type=1400 audit(1750718008.609:456): avc: denied { create } for pid=4258 comm="syz.4.1387" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 157.804160][ T36] audit: type=1400 audit(1750718008.639:457): avc: denied { accept } for pid=4258 comm="syz.4.1387" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 158.000231][ T36] audit: type=1400 audit(1750718008.839:458): avc: denied { unmount } for pid=4264 comm="syz.4.1390" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=filesystem permissive=1 [ 158.113097][ T4276] rust_binder: Write failure EFAULT in pid:614 [ 158.132795][ T10] ums-isd200 2-1:5.40: USB Mass Storage device detected [ 158.169252][ T10] usb 2-1: USB disconnect, device number 37 [ 158.368884][ T4295] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 158.768797][ T512] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 158.919953][ T512] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 158.930192][ T512] usb 2-1: config 0 interface 0 has no altsetting 0 [ 158.936808][ T512] usb 2-1: New USB device found, idVendor=0463, idProduct=c227, bcdDevice= 0.00 [ 158.945957][ T512] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.954765][ T512] usb 2-1: config 0 descriptor?? [ 159.372222][ T512] hid-generic 0003:0463:C227.000C: unknown main item tag 0x1 [ 159.394563][ T512] hid-generic 0003:0463:C227.000C: hidraw0: USB HID v1.01 Device [HID 0463:c227] on usb-dummy_hcd.1-1/input0 [ 159.406460][ T4315] vcan0: entered allmulticast mode [ 159.572564][ T4303] erofs: (device rnullb0): erofs_read_superblock: cannot find valid erofs superblock [ 159.582846][ T4303] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 159.592288][ T4303] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 159.600569][ T512] usb 2-1: USB disconnect, device number 38 [ 159.929654][ T4323] fuse: Unknown parameter '0x0000000000000005' [ 160.119084][ T4329] overlayfs: missing 'lowerdir' [ 160.252040][ T4331] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1413'. [ 160.365202][ T4334] sit0: entered promiscuous mode [ 160.373629][ T4334] netlink: 'syz.1.1414': attribute type 1 has an invalid length. [ 160.381654][ T4334] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1414'. [ 160.524008][ T4340] /dev/nullb0: Can't lookup blockdev [ 160.788796][ T1185] usb 2-1: new low-speed USB device number 39 using dummy_hcd [ 160.799451][ T4351] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 160.939867][ T1185] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 160.955527][ T1185] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 160.964269][ T1185] usb 2-1: config 0 descriptor?? [ 161.152638][ T4362] netlink: 'syz.4.1424': attribute type 1 has an invalid length. [ 161.160500][ T4362] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1424'. [ 161.214700][ T36] kauditd_printk_skb: 2 callbacks suppressed [ 161.214735][ T36] audit: type=1400 audit(1750718012.049:461): avc: denied { accept } for pid=4364 comm="syz.4.1425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 161.330385][ T4373] fuse: Unknown parameter '0x0000000000000005' [ 161.370608][ T1185] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 161.380737][ T1185] asix 2-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 161.391133][ T1185] asix 2-1:0.0: probe with driver asix failed with error -71 [ 161.399521][ T1185] usb 2-1: USB disconnect, device number 39 [ 161.810168][ T4385] binder: Unknown parameter '“nrmi¼' [ 161.871644][ T4390] netlink: 'syz.3.1434': attribute type 1 has an invalid length. [ 161.880081][ T4390] netlink: 1 bytes leftover after parsing attributes in process `syz.3.1434'. [ 161.907156][ T4395] rust_binder: Failed to allocate buffer. len:160, is_oneway:false [ 162.084810][ T4411] rust_binder: Error while translating object. [ 162.092889][ T4411] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 162.099271][ T4411] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:758 [ 162.203521][ T4422] netlink: 'syz.2.1447': attribute type 1 has an invalid length. [ 162.220508][ T4422] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1447'. [ 162.358829][ T31] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 162.378834][ T344] usb 4-1: new low-speed USB device number 43 using dummy_hcd [ 162.488818][ T31] usb 2-1: device descriptor read/64, error -71 [ 162.530021][ T344] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 162.539138][ T344] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.548065][ T344] usb 4-1: config 0 descriptor?? [ 162.728784][ T31] usb 2-1: device descriptor read/64, error -71 [ 162.929886][ T4442] fuse: Unknown parameter '0x0000000000000005' [ 162.954930][ T344] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 162.965038][ T344] asix 4-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 162.975350][ T31] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 162.983105][ T344] asix 4-1:0.0: probe with driver asix failed with error -71 [ 162.992068][ T344] usb 4-1: USB disconnect, device number 43 [ 163.118848][ T31] usb 2-1: device descriptor read/64, error -71 [ 163.358817][ T31] usb 2-1: device descriptor read/64, error -71 [ 163.468861][ T31] usb usb2-port1: attempt power cycle [ 163.708791][ T305] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 163.772956][ T4446] netlink: 'syz.2.1456': attribute type 1 has an invalid length. [ 163.780761][ T4446] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1456'. [ 163.808780][ T31] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 163.858839][ T305] usb 4-1: Using ep0 maxpacket: 8 [ 163.869538][ T305] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 163.880434][ T305] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 163.890629][ T305] usb 4-1: config 0 descriptor?? [ 164.083597][ T4466] fuse: Unknown parameter '0x0000000000000005' [ 164.303079][ T31] usb 2-1: device descriptor read/8, error -71 [ 164.439834][ T31] usb 2-1: device descriptor read/8, error -71 [ 164.678788][ T31] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 164.699904][ T31] usb 2-1: device descriptor read/8, error -71 [ 164.829887][ T31] usb 2-1: device descriptor read/8, error -71 [ 164.927630][ T4468] netlink: 'syz.2.1466': attribute type 1 has an invalid length. [ 164.935493][ T4468] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1466'. [ 164.944635][ T31] usb usb2-port1: unable to enumerate USB device [ 165.156980][ T36] audit: type=1400 audit(1750718015.989:462): avc: denied { append } for pid=4489 comm="syz.1.1474" name="ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 165.213679][ T4493] fuse: Unknown parameter '0x0000000000000005' [ 165.250692][ T4495] netlink: 'syz.2.1476': attribute type 1 has an invalid length. [ 165.258702][ T4495] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1476'. [ 165.351631][ T36] audit: type=1400 audit(1750718016.189:463): avc: denied { create } for pid=4502 comm="syz.4.1479" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 165.385865][ T4510] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:347 [ 165.401362][ T4513] netlink: 'syz.4.1482': attribute type 1 has an invalid length. [ 165.419661][ T4513] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1482'. [ 165.428909][ T4513] tipc: Invalid UDP bearer configuration [ 165.428973][ T4513] tipc: Enabling of bearer rejected, failed to enable media [ 165.443855][ T4513] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 165.443882][ T4513] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 165.452476][ T4513] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:350 [ 165.544640][ T4523] netlink: 'syz.2.1487': attribute type 1 has an invalid length. [ 165.561684][ T4523] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1487'. [ 165.608233][ T4529] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64 sclass=netlink_route_socket pid=4529 comm=syz.2.1489 [ 165.621672][ T4529] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1489'. [ 165.679163][ T36] audit: type=1400 audit(1750718016.519:464): avc: denied { setattr } for pid=4535 comm="syz.4.1492" name="/" dev="incremental-fs" ino=678 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 165.842451][ T36] audit: type=1400 audit(1750718016.679:465): avc: denied { name_bind } for pid=4537 comm="syz.4.1493" src=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 166.074610][ T4547] netlink: 'syz.1.1497': attribute type 1 has an invalid length. [ 166.082514][ T4547] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1497'. [ 166.110975][ T305] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 166.121258][ T305] asix 4-1:0.0: probe with driver asix failed with error -71 [ 166.132066][ T305] usb 4-1: USB disconnect, device number 44 [ 166.206196][ T4564] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:369 [ 166.219272][ T4568] fuse: Unknown parameter '0x0000000000000005' [ 166.247398][ T4570] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1505'. [ 166.268132][ T4575] netlink: 'syz.1.1506': attribute type 1 has an invalid length. [ 166.275999][ T4575] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1506'. [ 166.578835][ T305] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 166.692427][ T4588] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 166.692570][ T4588] rust_binder: Write failure EFAULT in pid:669 [ 166.728783][ T305] usb 2-1: Using ep0 maxpacket: 16 [ 166.741387][ T305] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 78, changing to 10 [ 166.752622][ T305] usb 2-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00 [ 166.761768][ T305] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.763703][ T4590] FAULT_INJECTION: forcing a failure. [ 166.763703][ T4590] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 166.773435][ T305] usb 2-1: config 0 descriptor?? [ 166.783426][ T4590] CPU: 1 UID: 0 PID: 4590 Comm: syz.3.1512 Not tainted 6.12.30-syzkaller-g1d4f4d446dbd #0 c93aecf919cd453af8c9b0d1ce6d9747cbb4dbdf [ 166.783463][ T4590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 166.783480][ T4590] Call Trace: [ 166.783488][ T4590] [ 166.783498][ T4590] __dump_stack+0x21/0x30 [ 166.783532][ T4590] dump_stack_lvl+0x10c/0x190 [ 166.783561][ T4590] ? __cfi_dump_stack_lvl+0x10/0x10 [ 166.783593][ T4590] dump_stack+0x19/0x20 [ 166.783619][ T4590] should_fail_ex+0x3d9/0x530 [ 166.783648][ T4590] should_fail+0xf/0x20 [ 166.783674][ T4590] should_fail_usercopy+0x1e/0x30 [ 166.783703][ T4590] _copy_from_iter+0x1a3/0x14b0 [ 166.783738][ T4590] ? path_openat+0x1301/0x34b0 [ 166.783760][ T4590] ? do_filp_open+0x1c6/0x3e0 [ 166.783783][ T4590] ? __cfi__copy_from_iter+0x10/0x10 [ 166.783816][ T4590] ? do_syscall_64+0x58/0xf0 [ 166.783852][ T4590] ? __kasan_check_read+0x15/0x20 [ 166.783882][ T4590] ? __check_object_size+0x455/0x620 [ 166.783913][ T4590] ip_generic_getfrag+0xf5/0x290 [ 166.783949][ T4590] ? __cfi_ip_generic_getfrag+0x10/0x10 [ 166.783984][ T4590] ? skb_page_frag_refill+0x22e/0x500 [ 166.784019][ T4590] __ip_append_data+0x1e24/0x3a70 [ 166.784068][ T4590] ? __cfi_ip_generic_getfrag+0x10/0x10 [ 166.784106][ T4590] ? ip_setup_cork+0xa00/0xa00 [ 166.784141][ T4590] ? lock_sock_nested+0x1f5/0x290 [ 166.784173][ T4590] ip_append_data+0x10a/0x1a0 [ 166.784208][ T4590] ? __cfi_ip_generic_getfrag+0x10/0x10 [ 166.784244][ T4590] udp_sendmsg+0x537/0x21f0 [ 166.784279][ T4590] ? avc_has_perm_noaudit+0x268/0x360 [ 166.784308][ T4590] ? avc_has_perm_noaudit+0x286/0x360 [ 166.784335][ T4590] ? __cfi_ip_generic_getfrag+0x10/0x10 [ 166.784368][ T4590] ? __cfi_udp_sendmsg+0x10/0x10 [ 166.784401][ T4590] ? kstrtouint_from_user+0xfb/0x150 [ 166.784431][ T4590] ? __x64_sys_openat+0x13a/0x170 [ 166.784457][ T4590] ? x64_sys_call+0xe69/0x2ee0 [ 166.784491][ T4590] ? selinux_socket_sendmsg+0x284/0x380 [ 166.784523][ T4590] ? __kasan_check_write+0x18/0x20 [ 166.784553][ T4590] ? proc_fail_nth_write+0x17e/0x210 [ 166.784580][ T4590] ? __fget_files+0x2c5/0x340 [ 166.784612][ T4590] ? inet_send_prepare+0x64/0x4f0 [ 166.784638][ T4590] ? __cfi_udp_sendmsg+0x10/0x10 [ 166.784671][ T4590] inet_sendmsg+0xef/0x120 [ 166.784697][ T4590] __sys_sendto+0x588/0x6f0 [ 166.784721][ T4590] ? __cfi___sys_sendto+0x10/0x10 [ 166.784744][ T4590] ? __kasan_check_write+0x18/0x20 [ 166.784774][ T4590] ? __cfi_ksys_write+0x10/0x10 [ 166.784804][ T4590] __x64_sys_sendto+0xe9/0x100 [ 166.784827][ T4590] x64_sys_call+0x2c2c/0x2ee0 [ 166.784860][ T4590] do_syscall_64+0x58/0xf0 [ 166.784892][ T4590] ? clear_bhb_loop+0x50/0xa0 [ 166.784918][ T4590] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 166.784943][ T4590] RIP: 0033:0x7fb866d8e929 [ 166.784962][ T4590] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 166.784983][ T4590] RSP: 002b:00007fb867cc1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 166.785011][ T4590] RAX: ffffffffffffffda RBX: 00007fb866fb5fa0 RCX: 00007fb866d8e929 [ 166.785030][ T4590] RDX: 000000000000ffe3 RSI: 00002000000000c0 RDI: 0000000000000004 [ 166.785054][ T4590] RBP: 00007fb867cc1090 R08: 0000000000000000 R09: 0000000000000000 [ 166.785070][ T4590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 166.785085][ T4590] R13: 0000000000000000 R14: 00007fb866fb5fa0 R15: 00007fff0f356d18 [ 166.785106][ T4590] [ 167.143520][ T4600] netlink: 'syz.2.1516': attribute type 1 has an invalid length. [ 167.151357][ T4600] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1516'. [ 167.353314][ T4613] fuse: Unknown parameter '0x0000000000000005' [ 167.532128][ T305] holtek 0003:1241:5015.000D: hidraw0: USB HID v0.04 Device [HID 1241:5015] on usb-dummy_hcd.1-1/input0 [ 167.543412][ T305] holtek 0003:1241:5015.000D: no inputs found [ 167.735506][ T305] usb 2-1: USB disconnect, device number 44 [ 167.932911][ T36] audit: type=1400 audit(1750718018.769:466): avc: denied { map } for pid=4615 comm="syz.2.1523" path="socket:[25536]" dev="sockfs" ino=25536 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 168.212339][ T4621] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 168.223189][ T4621] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 168.223210][ T4621] rust_binder: Read failure Err(EFAULT) in pid:682 [ 168.533832][ T4642] fuse: Unknown parameter '0x0000000000000005' [ 168.758839][ T31] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 168.910923][ T31] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 168.920238][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 168.930608][ T31] usb 2-1: config 0 descriptor?? [ 169.375476][ T4663] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.389993][ T4663] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.403678][ T4663] bridge_slave_0: entered allmulticast mode [ 169.411920][ T4663] bridge_slave_0: entered promiscuous mode [ 169.418628][ T4663] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.426043][ T4663] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.433332][ T4663] bridge_slave_1: entered allmulticast mode [ 169.440019][ T4663] bridge_slave_1: entered promiscuous mode [ 169.507845][ T4663] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.515043][ T4663] bridge0: port 2(bridge_slave_1) entered forwarding state [ 169.522376][ T4663] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.529448][ T4663] bridge0: port 1(bridge_slave_0) entered forwarding state [ 169.638838][ T1185] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 169.750660][ T12] bridge_slave_1: left allmulticast mode [ 169.756392][ T12] bridge_slave_1: left promiscuous mode [ 169.762313][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.770094][ T12] bridge_slave_0: left allmulticast mode [ 169.775783][ T12] bridge_slave_0: left promiscuous mode [ 169.781470][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.798786][ T1185] usb 4-1: Using ep0 maxpacket: 16 [ 169.805203][ T1185] usb 4-1: config 0 interface 0 altsetting 67 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 169.818773][ T1185] usb 4-1: config 0 interface 0 has no altsetting 0 [ 169.825496][ T1185] usb 4-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.00 [ 169.837888][ T1185] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.847407][ T1185] usb 4-1: config 0 descriptor?? [ 169.865014][ T2776] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.873133][ T2776] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.882396][ T12] veth1_macvtap: left promiscuous mode [ 169.939341][ T4640] binder: Bad value for 'stats' [ 169.945029][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.952137][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 169.960011][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.967113][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 170.000939][ T4663] veth0_vlan: entered promiscuous mode [ 170.014879][ T4663] veth1_macvtap: entered promiscuous mode [ 170.053920][ T4668] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 170.054612][ T4668] rust_binder: inc_ref_done called when no active inc_refs [ 170.062749][ T1185] usbhid 4-1:0.0: can't add hid device: -71 [ 170.076017][ T1185] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 170.088202][ T1185] usb 4-1: USB disconnect, device number 45 [ 170.180561][ T31] usb 2-1: Cannot set autoneg [ 170.185507][ T31] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 170.198286][ T31] usb 2-1: USB disconnect, device number 45 [ 170.377738][ T4680] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1546'. [ 170.388423][ T4680] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1546'. [ 170.398692][ T4680] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1546'. [ 170.416808][ T4680] erofs: (device rnullb0): erofs_read_superblock: cannot find valid erofs superblock [ 170.908868][ T31] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 171.008787][ T1185] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 171.028811][ T305] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 171.059854][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 171.070915][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 171.080734][ T31] usb 4-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 171.089825][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.098441][ T31] usb 4-1: config 0 descriptor?? [ 171.158780][ T1185] usb 3-1: Using ep0 maxpacket: 32 [ 171.165139][ T1185] usb 3-1: config 0 has an invalid interface number: 149 but max is 0 [ 171.173547][ T1185] usb 3-1: config 0 has no interface number 0 [ 171.181806][ T1185] usb 3-1: New USB device found, idVendor=086a, idProduct=0102, bcdDevice=c8.e6 [ 171.190976][ T1185] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.199033][ T305] usb 2-1: Using ep0 maxpacket: 8 [ 171.204136][ T1185] usb 3-1: Product: syz [ 171.208348][ T1185] usb 3-1: Manufacturer: syz [ 171.213124][ T1185] usb 3-1: SerialNumber: syz [ 171.218318][ T305] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 171.229475][ T305] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 171.239545][ T1185] usb 3-1: config 0 descriptor?? [ 171.244594][ T305] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 171.257496][ T305] usb 2-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 171.267814][ T305] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.276819][ T305] usb 2-1: config 0 descriptor?? [ 171.469816][ T1185] usb 3-1: USB disconnect, device number 8 [ 171.507887][ T31] playstation 0003:054C:0DF2.000E: unknown main item tag 0x0 [ 171.515613][ T31] playstation 0003:054C:0DF2.000E: unknown main item tag 0x0 [ 171.523263][ T31] playstation 0003:054C:0DF2.000E: unknown main item tag 0x0 [ 171.530772][ T31] playstation 0003:054C:0DF2.000E: unknown main item tag 0x0 [ 171.538188][ T31] playstation 0003:054C:0DF2.000E: unknown main item tag 0x0 [ 171.546566][ T31] playstation 0003:054C:0DF2.000E: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.3-1/input0 [ 171.683510][ T4703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 171.692298][ T4703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 171.701527][ T305] usbhid 2-1:0.0: can't add hid device: -71 [ 171.706923][ T31] playstation 0003:054C:0DF2.000E: Invalid byte count transferred, expected 20 got 0 [ 171.707620][ T305] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 171.717412][ T31] playstation 0003:054C:0DF2.000E: Failed to retrieve DualSense pairing info: -22 [ 171.729352][ T305] usb 2-1: USB disconnect, device number 46 [ 171.734983][ T31] playstation 0003:054C:0DF2.000E: Failed to get MAC address from DualSense [ 171.748751][ T31] playstation 0003:054C:0DF2.000E: Failed to create dualsense. [ 171.756989][ T31] playstation 0003:054C:0DF2.000E: probe with driver playstation failed with error -22 [ 171.919891][ T305] usb 4-1: USB disconnect, device number 46 [ 172.218791][ T31] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 172.368805][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 172.375220][ T31] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 172.383413][ T31] usb 3-1: config 0 has no interface number 0 [ 172.389584][ T31] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 208, changing to 11 [ 172.400788][ T31] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 25296, setting to 1024 [ 172.413068][ T31] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 172.422182][ T31] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 172.430362][ T31] usb 3-1: Product: syz [ 172.434559][ T31] usb 3-1: SerialNumber: syz [ 172.440707][ T31] usb 3-1: config 0 descriptor?? [ 172.518794][ T1185] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 172.648381][ T4706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 172.657410][ T4706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 172.666055][ T4706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 172.674493][ T1185] usb 2-1: Using ep0 maxpacket: 32 [ 172.678373][ T4706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 172.679706][ T9] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 172.692095][ T31] usb 3-1: USB disconnect, device number 9 [ 172.699007][ T1185] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 172.709126][ T1185] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 172.720530][ T1185] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 172.731629][ T1185] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 172.744836][ T1185] usb 2-1: config 0 interface 0 has no altsetting 0 [ 172.753015][ T1185] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 172.762129][ T1185] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 172.770819][ T1185] usb 2-1: Product: syz [ 172.775018][ T1185] usb 2-1: Manufacturer: syz [ 172.779673][ T1185] usb 2-1: SerialNumber: syz [ 172.784900][ T1185] usb 2-1: config 0 descriptor?? [ 172.848830][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 172.855036][ T9] usb 4-1: config index 0 descriptor too short (expected 156, got 27) [ 172.863290][ T9] usb 4-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 172.874320][ T9] usb 4-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 172.885750][ T9] usb 4-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 172.898963][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 172.906930][ T9] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 172.916042][ T9] usb 4-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 172.924517][ T9] usb 4-1: Product: syz [ 172.928685][ T9] usb 4-1: Manufacturer: syz [ 172.933321][ T9] usb 4-1: SerialNumber: syz [ 172.938539][ T9] usb 4-1: config 0 descriptor?? [ 173.458815][ T9] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 173.611366][ T9] usb 3-1: New USB device found, idVendor=0424, idProduct=9d00, bcdDevice=eb.c7 [ 173.620548][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.628560][ T9] usb 3-1: Product: syz [ 173.632884][ T9] usb 3-1: Manufacturer: syz [ 173.637503][ T9] usb 3-1: SerialNumber: syz [ 173.642852][ T9] usb 3-1: config 0 descriptor?? [ 175.291894][ T9] usb 2-1: USB disconnect, device number 47 [ 175.448978][ T1185] usb 4-1: USB disconnect, device number 47 [ 175.589237][ T9] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 175.739912][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 175.750924][ T9] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 175.760220][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.769022][ T9] usb 2-1: config 0 descriptor?? [ 175.778825][ T1185] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 175.928786][ T1185] usb 4-1: Using ep0 maxpacket: 8 [ 175.935283][ T1185] usb 4-1: unable to get BOS descriptor or descriptor too short [ 175.943881][ T1185] usb 4-1: config 0 has an invalid interface number: 88 but max is 0 [ 175.952041][ T1185] usb 4-1: config 0 has no interface number 0 [ 175.958159][ T1185] usb 4-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 162, changing to 11 [ 175.969440][ T1185] usb 4-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid maxpacket 33781, setting to 1024 [ 175.977264][ T31] usb 2-1: USB disconnect, device number 48 [ 175.980702][ T1185] usb 4-1: config 0 interface 88 has no altsetting 0 [ 175.995986][ T1185] usb 4-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.26 [ 176.005258][ T1185] usb 4-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 176.013571][ T1185] usb 4-1: Product: syz [ 176.017773][ T1185] usb 4-1: Manufacturer: syz [ 176.022417][ T1185] usb 4-1: SerialNumber: syz [ 176.027798][ T1185] usb 4-1: config 0 descriptor?? [ 176.231314][ T9] usb 3-1: USB disconnect, device number 10 [ 176.241339][ T1185] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.88/input/input18 [ 176.254580][ T1185] usb 4-1: USB disconnect, device number 48 [ 176.260586][ C0] usb_acecad 4-1:0.88: can't resubmit intr, dummy_hcd.3-1/input0, status -19 [ 176.302336][ T2128] udevd[2128]: Error opening device "/dev/input/event3": No such file or directory [ 176.311841][ T2128] udevd[2128]: Unable to EVIOCGABS device "/dev/input/event3" [ 176.319387][ T2128] udevd[2128]: Unable to EVIOCGABS device "/dev/input/event3" [ 176.428789][ T31] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 176.538797][ T9] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 176.580015][ T31] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 176.590224][ T31] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 176.599299][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.608070][ T31] usb 2-1: config 0 descriptor?? [ 176.700014][ T9] usb 3-1: config 0 has an invalid interface number: 50 but max is 0 [ 176.708160][ T9] usb 3-1: config 0 has no interface number 0 [ 176.714376][ T9] usb 3-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 176.726886][ T9] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 176.736069][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.744125][ T9] usb 3-1: Product: syz [ 176.748376][ T9] usb 3-1: Manufacturer: syz [ 176.753060][ T9] usb 3-1: SerialNumber: syz [ 176.758568][ T9] usb 3-1: config 0 descriptor?? [ 176.759952][ T4730] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 176.781686][ T4730] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 176.811540][ T4733] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1565'. [ 176.936886][ T36] audit: type=1326 audit(1750718027.769:467): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4738 comm="syz.4.1567" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8cf238e929 code=0x0 [ 177.319801][ T4745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.328398][ T4745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.804757][ T4751] input: syz1 as /devices/virtual/input/input19 [ 177.904591][ T4767] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 177.904825][ T4767] rust_binder: Error while translating object. [ 177.911388][ T4767] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 177.917610][ T4767] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:719 [ 177.945533][ T4769] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 178.021265][ T36] audit: type=1400 audit(1750718028.859:468): avc: denied { setattr } for pid=4771 comm="syz.3.1576" name="binder-control" dev="binder" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 178.288813][ T512] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 178.315681][ T344] usb 2-1: USB disconnect, device number 49 [ 178.440080][ T512] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 178.451042][ T512] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 178.460847][ T512] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 178.469936][ T512] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.478593][ T512] usb 4-1: config 0 descriptor?? [ 179.087054][ T512] usb 4-1: string descriptor 0 read error: -22 [ 179.219819][ T36] audit: type=1326 audit(1750718030.059:469): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4779 comm="syz.1.1579" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6d4218e929 code=0x0 [ 179.258857][ T344] usb 3-1: USB disconnect, device number 11 [ 179.287811][ T512] uclogic 0003:256C:006D.000F: interface is invalid, ignoring [ 179.395368][ T4789] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2584 sclass=netlink_route_socket pid=4789 comm=syz.2.1582 [ 179.408486][ T4789] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2560 sclass=netlink_route_socket pid=4789 comm=syz.2.1582 [ 179.421266][ T4789] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2582 sclass=netlink_route_socket pid=4789 comm=syz.2.1582 [ 179.433902][ T4789] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2571 sclass=netlink_route_socket pid=4789 comm=syz.2.1582 [ 179.459932][ T4792] cgroup: noprefix used incorrectly [ 179.465623][ T4792] exFAT-fs (rnullb0): invalid boot record signature [ 179.472290][ T4792] exFAT-fs (rnullb0): failed to read boot sector [ 179.478759][ T4792] exFAT-fs (rnullb0): failed to recognize exfat type [ 179.502917][ T9] usb 4-1: USB disconnect, device number 49 [ 179.520766][ T4796] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 180.020328][ T4807] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 180.051157][ T4818] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1591'. [ 180.087448][ T36] audit: type=1326 audit(1750718030.919:470): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4819 comm="syz.1.1593" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6d4218e929 code=0x0 [ 180.140824][ T4830] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 180.508034][ T36] audit: type=1400 audit(1750718031.339:471): avc: denied { setcurrent } for pid=4831 comm="syz.2.1598" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 180.514757][ T4832] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 180.706159][ T36] audit: type=1326 audit(1750718031.539:472): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4837 comm="syz.2.1601" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd470d8e929 code=0x0 [ 180.758310][ T4839] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 4200, limit: 4216, size: 18446744073709550742) [ 180.758333][ T4839] rust_binder: Error while translating object. [ 180.770650][ T4839] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 180.776854][ T4839] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:62 [ 180.882576][ T4841] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64 sclass=netlink_route_socket pid=4841 comm=syz.4.1602 [ 180.910861][ T36] audit: type=1400 audit(1750718031.749:473): avc: denied { unmount } for pid=2760 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 180.933344][ T4843] binder: Unknown parameter 'defcontext01777777777777777777777' [ 180.984335][ T4850] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:745 [ 181.016931][ T4847] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 181.026192][ T4847] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:410 [ 181.111138][ T36] audit: type=1400 audit(1750718031.949:474): avc: denied { lock } for pid=4857 comm="syz.4.1608" path="socket:[27452]" dev="sockfs" ino=27452 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 181.408783][ T306] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 181.550225][ T4864] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 181.553164][ T36] audit: type=1400 audit(1750718032.389:475): avc: denied { lock } for pid=4863 comm="syz.2.1611" path="/dev/binderfs/binder0" dev="binder" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 181.556901][ T4864] rust_binder: Error while translating object. [ 181.559724][ T306] usb 4-1: Using ep0 maxpacket: 8 [ 181.583992][ T4864] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 181.591468][ T306] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 181.595003][ T4864] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:65 [ 181.604640][ T306] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 181.635399][ T306] usb 4-1: config 0 descriptor?? [ 182.649056][ T36] audit: type=1400 audit(1750718033.489:476): avc: denied { bpf } for pid=4882 comm="syz.2.1617" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 183.633536][ T4888] fuse: Bad value for 'fd' [ 183.713839][ T4896] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1623'. [ 183.850136][ T306] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 183.860325][ T306] asix 4-1:0.0: probe with driver asix failed with error -71 [ 183.870131][ T306] usb 4-1: USB disconnect, device number 50 [ 184.038934][ T1185] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 184.153661][ T36] audit: type=1400 audit(1750718034.989:477): avc: denied { map } for pid=4924 comm="syz.4.1632" path="socket:[28596]" dev="sockfs" ino=28596 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 184.182497][ T36] audit: type=1400 audit(1750718035.009:478): avc: denied { accept } for pid=4924 comm="syz.4.1632" path="socket:[28596]" dev="sockfs" ino=28596 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 184.210856][ T1185] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 184.221035][ T1185] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 184.236687][ T1185] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 184.246195][ T1185] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.254448][ T1185] usb 3-1: Product: syz [ 184.258951][ T1185] usb 3-1: Manufacturer: syz [ 184.263620][ T1185] usb 3-1: SerialNumber: syz [ 184.272641][ T1185] usb 3-1: config 0 descriptor?? [ 184.283389][ T1185] usb 3-1: 0:0 : invalid sync pipe. bmAttributes 00, bLength 9, bSynchAddress 00 [ 184.295448][ T4938] syzkaller0: entered allmulticast mode [ 184.408468][ T4943] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 184.498942][ T1185] usb 3-1: USB disconnect, device number 12 [ 184.668788][ T9] usb 4-1: new low-speed USB device number 51 using dummy_hcd [ 184.819995][ T9] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 184.829256][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 184.837881][ T9] usb 4-1: config 0 descriptor?? [ 185.016426][ T4957] SELinux: security_context_str_to_sid () failed with errno=-22 [ 185.190204][ T36] audit: type=1400 audit(1750718036.029:479): avc: denied { append } for pid=4968 comm="syz.2.1648" name="binder1" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 185.192003][ T4969] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:99 [ 185.230913][ T36] audit: type=1400 audit(1750718036.069:480): avc: denied { lock } for pid=4970 comm="syz.2.1649" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 185.277527][ T4978] fuse: Unknown parameter '0x0000000000000005' [ 185.401621][ T4983] overlayfs: failed to clone upperpath [ 185.426390][ T4986] netlink: 172 bytes leftover after parsing attributes in process `syz.2.1652'. [ 185.428789][ T36] audit: type=1400 audit(1750718036.259:481): avc: denied { nlmsg_read } for pid=4979 comm="syz.2.1652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 185.468042][ T9] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 185.478226][ T9] asix 4-1:0.0: probe with driver asix failed with error -71 [ 185.486778][ T9] usb 4-1: USB disconnect, device number 51 [ 185.523606][ T4985] netlink: 112 bytes leftover after parsing attributes in process `syz.1.1654'. [ 185.539176][ T36] audit: type=1400 audit(1750718036.379:482): avc: denied { connect } for pid=4984 comm="syz.1.1654" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 186.002072][ T5003] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 186.002618][ T5003] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 186.017002][ T5003] rust_binder: Write failure EINVAL in pid:765 [ 186.032596][ T5005] fuse: Unknown parameter '0x0000000000000005' [ 186.737021][ T5016] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 186.737063][ T5016] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:123 [ 186.838639][ T5025] fuse: Unknown parameter '0x0000000000000005' [ 187.129668][ T306] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 187.279807][ T306] usb 4-1: config 0 has an invalid interface number: 226 but max is 0 [ 187.288130][ T306] usb 4-1: config 0 has no interface number 0 [ 187.294932][ T306] usb 4-1: config 0 interface 226 altsetting 255 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 187.306410][ T306] usb 4-1: config 0 interface 226 altsetting 255 endpoint 0x81 has invalid wMaxPacketSize 0 [ 187.316939][ T306] usb 4-1: config 0 interface 226 has no altsetting 0 [ 187.324112][ T306] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 187.333792][ T306] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.342540][ T306] usb 4-1: config 0 descriptor?? [ 187.724029][ T36] audit: type=1400 audit(1750718038.559:483): avc: denied { execute } for pid=5035 comm="syz.2.1673" path="/selinux/commit_pending_bools" dev="selinuxfs" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=file permissive=1 [ 187.752716][ T306] uclogic 0003:256C:006D.0010: interface is invalid, ignoring [ 188.013226][ T5048] netlink: 'syz.1.1677': attribute type 1 has an invalid length. [ 188.021042][ T5048] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1677'. [ 188.121836][ T5056] fuse: Unknown parameter '0x0000000000000005' [ 188.218834][ T5064] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 188.218853][ T5060] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 188.218861][ T5064] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 188.218880][ T5064] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:434 [ 188.227128][ T5060] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:434 [ 188.455326][ T5067] rust_binder: Write failure EINVAL in pid:439 [ 188.938532][ T5074] sit0: entered promiscuous mode [ 188.950917][ T5074] netlink: 'syz.2.1686': attribute type 1 has an invalid length. [ 188.958665][ T5074] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1686'. [ 189.076603][ T5079] can: request_module (can-proto-0) failed. [ 189.378777][ T306] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 189.528766][ T306] usb 3-1: Using ep0 maxpacket: 8 [ 189.534978][ T306] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 189.544144][ T306] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.552973][ T306] usb 3-1: config 0 descriptor?? [ 189.904967][ T9] usb 4-1: USB disconnect, device number 52 [ 190.110255][ T5090] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 190.110558][ T5090] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 190.117045][ T5090] rust_binder: Read failure Err(EFAULT) in pid:787 [ 190.138776][ T5092] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 190.145353][ T5092] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:789 [ 190.287859][ T36] audit: type=1400 audit(1750718041.119:484): avc: denied { execute } for pid=5093 comm="syz.3.1694" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=30279 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 191.055784][ T5099] netlink: 'syz.1.1696': attribute type 1 has an invalid length. [ 191.063620][ T5099] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1696'. [ 191.096788][ T5104] netlink: 'syz.1.1698': attribute type 1 has an invalid length. [ 191.104587][ T5104] netlink: 1 bytes leftover after parsing attributes in process `syz.1.1698'. [ 191.542564][ T5110] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:445 [ 191.771045][ T306] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 191.790409][ T306] asix 3-1:0.0: probe with driver asix failed with error -71 [ 191.799097][ T306] usb 3-1: USB disconnect, device number 13 [ 191.883006][ T5118] rust_binder: Write failure EINVAL in pid:797 [ 191.883147][ T5118] rust_binder: Write failure EINVAL in pid:797 [ 191.942824][ T5120] netlink: 'syz.3.1705': attribute type 1 has an invalid length. [ 191.956900][ T5120] netlink: 1 bytes leftover after parsing attributes in process `syz.3.1705'. [ 192.030748][ T5126] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 192.221443][ T5132] cgroup2: Unknown parameter 'c%…7~'Në|' [ 192.298772][ T512] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 192.404071][ T5146] fuse: Unknown parameter '0x0000000000000005' [ 192.425047][ T5148] netlink: 'syz.4.1715': attribute type 1 has an invalid length. [ 192.432911][ T5148] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1715'. [ 192.449909][ T512] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 192.462624][ T512] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 192.474177][ T512] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 192.483352][ T512] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.491428][ T512] usb 4-1: Product: syz [ 192.495615][ T512] usb 4-1: Manufacturer: syz [ 192.500294][ T512] usb 4-1: SerialNumber: syz [ 192.505519][ T512] usb 4-1: config 0 descriptor?? [ 192.511619][ T512] usb 4-1: 0:0 : invalid sync pipe. bmAttributes 00, bLength 9, bSynchAddress 00 [ 192.528870][ T306] usb 3-1: new low-speed USB device number 14 using dummy_hcd [ 192.606942][ T5160] SELinux: policydb version 905587468 does not match my version range 15-33 [ 192.616056][ T5160] SELinux: failed to load policy [ 192.679914][ T306] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 192.689157][ T306] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.698035][ T306] usb 3-1: config 0 descriptor?? [ 192.718325][ T512] usb 4-1: USB disconnect, device number 53 [ 192.731764][ T4277] udevd[4277]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 193.246059][ T5191] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 193.270984][ T36] audit: type=1400 audit(1750718044.109:485): avc: denied { getopt } for pid=5194 comm="syz.3.1733" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 193.298520][ T5195] binder: Bad value for 'stats' [ 193.304115][ T36] audit: type=1400 audit(1750718044.109:486): avc: denied { ioctl } for pid=5194 comm="syz.3.1733" path="socket:[30571]" dev="sockfs" ino=30571 ioctlcmd=0x941e scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 193.329059][ T306] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 193.339284][ T306] asix 3-1:0.0: probe with driver asix failed with error -71 [ 193.359276][ T306] usb 3-1: USB disconnect, device number 14 [ 193.368577][ T5197] netlink: 'syz.1.1732': attribute type 6 has an invalid length. [ 193.466617][ T5204] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 193.466950][ T5204] rust_binder: Write failure EINVAL in pid:821 [ 193.532789][ T5208] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 193.552276][ T5210] SELinux: policydb magic number 0x5f6d6f6f does not match expected magic number 0xf97cff8c [ 193.568994][ T5210] SELinux: failed to load policy [ 194.078774][ T10] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 194.229975][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 194.239769][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 194.250938][ T10] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 194.260058][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.268082][ T10] usb 3-1: Product: syz [ 194.272314][ T10] usb 3-1: Manufacturer: syz [ 194.276935][ T10] usb 3-1: SerialNumber: syz [ 194.282212][ T10] usb 3-1: config 0 descriptor?? [ 194.288228][ T10] usb 3-1: 0:0 : invalid sync pipe. bmAttributes 00, bLength 9, bSynchAddress 00 [ 194.492529][ T10] usb 3-1: USB disconnect, device number 15 [ 194.504200][ T4277] udevd[4277]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 194.778812][ T512] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 194.929919][ T512] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 194.939916][ T512] usb 4-1: New USB device found, idVendor=046d, idProduct=c71f, bcdDevice= 0.00 [ 194.949470][ T512] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.958996][ T512] usb 4-1: config 0 descriptor?? [ 195.105352][ T5258] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 195.115491][ T5258] rust_binder: Write failure EINVAL in pid:164 [ 195.157248][ T36] audit: type=1400 audit(1750718045.989:487): avc: denied { setcheckreqprot } for pid=5266 comm="syz.2.1760" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 195.386096][ T512] usbhid 4-1:0.0: can't add hid device: -71 [ 195.392261][ T512] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 195.400999][ T512] usb 4-1: USB disconnect, device number 54 [ 195.651587][ T5271] rust_binder: Write failure EFAULT in pid:461 [ 195.663434][ T36] audit: type=1400 audit(1750718046.499:488): avc: denied { remount } for pid=5272 comm="syz.1.1763" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 195.926077][ T36] audit: type=1400 audit(1750718046.759:489): avc: denied { sqpoll } for pid=5286 comm="syz.3.1768" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 195.945447][ T306] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 196.119980][ T306] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 196.130994][ T306] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 196.140813][ T306] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 196.149923][ T306] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.158618][ T306] usb 3-1: config 0 descriptor?? [ 196.318811][ T512] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 196.364677][ T5275] netlink: 'syz.2.1764': attribute type 6 has an invalid length. [ 196.479989][ T512] usb 4-1: config index 0 descriptor too short (expected 1892, got 100) [ 196.488454][ T512] usb 4-1: config 1 has too many interfaces: 226, using maximum allowed: 32 [ 196.497306][ T512] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 196.507720][ T512] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 226 [ 196.518667][ T512] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 196.527815][ T512] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.535867][ T512] usb 4-1: Product: syz [ 196.540127][ T512] usb 4-1: Manufacturer: syz [ 196.544796][ T512] usb 4-1: SerialNumber: syz [ 196.773843][ T306] usb 3-1: string descriptor 0 read error: -22 [ 196.974532][ T306] uclogic 0003:256C:006D.0011: interface is invalid, ignoring [ 197.190576][ T306] usb 3-1: USB disconnect, device number 16 [ 197.458995][ T306] usb 4-1: USB disconnect, device number 55 [ 197.490935][ T36] audit: type=1400 audit(1750718048.329:490): avc: denied { mounton } for pid=5311 comm="syz.3.1777" path="/proc/859/task" dev="proc" ino=31855 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 197.978803][ T512] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 198.129886][ T512] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 198.139602][ T512] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 198.151067][ T512] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 198.160180][ T512] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.168205][ T512] usb 3-1: Product: syz [ 198.172455][ T512] usb 3-1: Manufacturer: syz [ 198.177073][ T512] usb 3-1: SerialNumber: syz [ 198.182451][ T512] usb 3-1: config 0 descriptor?? [ 198.188497][ T512] usb 3-1: 0:0 : invalid sync pipe. bmAttributes 00, bLength 9, bSynchAddress 00 [ 198.262990][ T5331] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 198.393545][ T512] usb 3-1: USB disconnect, device number 17 [ 198.498771][ T64] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 198.658769][ T64] usb 4-1: Using ep0 maxpacket: 32 [ 198.665084][ T64] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 198.676052][ T64] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 198.686899][ T64] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 198.696061][ T64] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 198.704596][ T64] usb 4-1: Product: syz [ 198.708879][ T64] usb 4-1: Manufacturer: syz [ 198.715930][ T64] hub 4-1:4.0: USB hub found [ 198.911019][ T5373] netlink: 'syz.2.1798': attribute type 4 has an invalid length. [ 198.919526][ T64] hub 4-1:4.0: 9 ports detected [ 198.919817][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 198.924446][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 198.926074][ T64] hub 4-1:4.0: insufficient power available to use all downstream ports [ 198.930991][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 198.938135][ T5373] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:177 [ 198.945717][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 198.961766][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 198.967992][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 198.974700][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 198.981227][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 198.987547][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 198.993806][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.000169][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.006386][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.012667][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.018953][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.025175][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.031443][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.037660][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.038894][ T5377] rust_binder: 5376 RLIMIT_NICE not set [ 199.045885][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.055801][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.062070][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.068281][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.074632][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.080891][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.087095][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.093347][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.100031][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.106545][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.113057][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.119647][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.125945][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.132633][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.139250][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.145627][ T5374] rust_binder: Write failure EINVAL in pid:864 [ 199.152459][ T64] hub 4-1:4.0: hub_hub_status failed (err = -71) [ 199.165151][ T64] hub 4-1:4.0: config failed, can't get hub status (err -71) [ 199.189380][ T64] usb 4-1: USB disconnect, device number 56 [ 199.381785][ T5389] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1804'. [ 199.445746][ T5394] rust_binder: Failed to allocate buffer. len:120, is_oneway:false [ 199.684186][ T5404] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 199.698915][ T512] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 199.719785][ T5404] rust_binder: Error while translating object. [ 199.719827][ T5404] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 199.726080][ T5404] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:872 [ 199.829795][ T5410] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 199.859983][ T512] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 199.876219][ T512] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 199.887245][ T512] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 199.896346][ T512] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.904436][ T512] usb 3-1: Product: syz [ 199.908634][ T512] usb 3-1: Manufacturer: syz [ 199.913314][ T512] usb 3-1: SerialNumber: syz [ 199.919435][ T512] usb 3-1: config 0 descriptor?? [ 199.926763][ T512] usb 3-1: 0:0 : invalid sync pipe. bmAttributes 00, bLength 9, bSynchAddress 00 [ 199.949584][ T5411] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 3 [ 199.957026][ T5411] rust_binder: Write failure EINVAL in pid:878 [ 200.095589][ T36] audit: type=1400 audit(1750718050.929:491): avc: denied { create } for pid=5422 comm="syz.1.1817" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 200.121590][ T36] audit: type=1400 audit(1750718050.929:492): avc: denied { search } for pid=5422 comm="syz.1.1817" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 200.146629][ T512] usb 3-1: USB disconnect, device number 18 [ 200.160121][ T4277] udevd[4277]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 200.298802][ T306] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 200.448780][ T306] usb 4-1: Using ep0 maxpacket: 8 [ 200.455029][ T306] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 200.465201][ T306] usb 4-1: config 0 interface 0 altsetting 252 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 200.476340][ T306] usb 4-1: config 0 interface 0 altsetting 252 endpoint 0x81 has invalid wMaxPacketSize 0 [ 200.486287][ T306] usb 4-1: config 0 interface 0 altsetting 252 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 200.499275][ T306] usb 4-1: config 0 interface 0 has no altsetting 0 [ 200.505894][ T306] usb 4-1: New USB device found, idVendor=1e7d, idProduct=3232, bcdDevice= 0.00 [ 200.514975][ T306] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.523662][ T306] usb 4-1: config 0 descriptor?? [ 200.686075][ T5438] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 3 [ 200.693526][ T5438] rust_binder: Write failure EINVAL in pid:199 [ 200.694780][ T5438] rust_kernel: panicked at rust/kernel/sync/poll.rs:54:18: [ 200.694780][ T5438] null pointer dereference occurred [ 200.700338][ T36] audit: type=1400 audit(1750718051.539:493): avc: denied { read } for pid=91 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 200.701314][ T5438] ------------[ cut here ]------------ [ 200.713882][ T36] audit: type=1400 audit(1750718051.539:494): avc: denied { search } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 200.735122][ T5438] kernel BUG at rust/helpers/bug.c:7! [ 200.741784][ T36] audit: type=1400 audit(1750718051.539:495): avc: denied { write } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 200.765043][ T5438] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 200.768518][ T36] audit: type=1400 audit(1750718051.539:496): avc: denied { add_name } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 200.789089][ T5438] CPU: 0 UID: 0 PID: 5438 Comm: syz.2.1821 Not tainted 6.12.30-syzkaller-g1d4f4d446dbd #0 c93aecf919cd453af8c9b0d1ce6d9747cbb4dbdf [ 200.789122][ T5438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 200.789137][ T5438] RIP: 0010:rust_helper_BUG+0x8/0x10 [ 200.789185][ T5438] Code: ce 82 e7 02 cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 0a fd 41 2d 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 <0f> 0b 66 0f 1f 44 00 00 b8 40 39 08 a1 90 90 90 90 90 90 90 90 90 [ 200.789204][ T5438] RSP: 0018:ffffc9000d2d71b0 EFLAGS: 00010246 [ 200.789234][ T5438] RAX: 000000000000005a RBX: 1ffff92001a5ae38 RCX: 95ca4e6dea0c0b00 [ 200.789252][ T5438] RDX: ffffc9000b199000 RSI: 0000000000001ad6 RDI: 0000000000001ad7 [ 200.887040][ T5438] RBP: ffffc9000d2d71b0 R08: ffffc9000d2d6ea7 R09: 1ffff92001a5add4 [ 200.895032][ T5438] R10: dffffc0000000000 R11: fffff52001a5add5 R12: 0000000000000000 [ 200.903009][ T5438] R13: dffffc0000000000 R14: ffffc9000d2d71e0 R15: ffffc9000d2d7210 [ 200.911001][ T5438] FS: 00007fd471c286c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 200.919942][ T5438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 200.926537][ T5438] CR2: 0000200000001000 CR3: 0000000116758000 CR4: 00000000003526b0 [ 200.934521][ T5438] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 200.942497][ T5438] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 200.950471][ T5438] Call Trace: [ 200.953756][ T5438] [ 200.956695][ T5438] _RNvCscSpY9Juk0HT_7___rustc17rust_begin_unwind+0x15b/0x160 [ 200.964172][ T5438] ? __cfi__RNvCscSpY9Juk0HT_7___rustc17rust_begin_unwind+0x10/0x10 [ 200.972172][ T5438] ? __cfi__RNvXs1b_NtCs9jEwPDbx20M_4core3fmtRNtNtNtB8_5panic10panic_info9PanicInfoNtB6_7Display3fmtCs43vyB533jt3_6kernel+0x10/0x10 [ 200.985732][ T5438] ? p9pdu_vwritef+0x2720/0x2720 [ 200.990685][ T5438] ? radix_tree_node_alloc+0x1af/0x400 [ 200.996148][ T5438] ? _RNvNtCs9jEwPDbx20M_4core9panicking18panic_nounwind_fmt+0xa2/0xf0 [ 201.004402][ T5438] ? __asan_memcpy+0x5a/0x80 [ 201.009006][ T5438] _RNvNtCs9jEwPDbx20M_4core9panicking18panic_nounwind_fmt+0xec/0xf0 [ 201.017085][ T5438] ? __cfi__RNvNtCs9jEwPDbx20M_4core9panicking18panic_nounwind_fmt+0x10/0x10 [ 201.025879][ T5438] ? p9pdu_writef+0xdb/0x130 [ 201.030482][ T5438] ? p9pdu_vwritef+0x2720/0x2720 [ 201.035432][ T5438] _RNvNtCs9jEwPDbx20M_4core9panicking30panic_null_pointer_dereference+0x49/0x4c [ 201.044732][ T5438] _RNvMNtNtCs43vyB533jt3_6kernel4sync4pollNtB2_9PollTable8from_ptr+0x40/0x40 [ 201.053587][ T5438] ? _RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0xce/0x570 [ 201.061496][ T5438] _RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0xe2/0x570 [ 201.069143][ T5438] ? p9_client_prepare_req+0x732/0xa10 [ 201.074615][ T5438] ? __cfi__RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0x10/0x10 [ 201.083021][ T5438] ? __kasan_check_write+0x18/0x20 [ 201.088141][ T5438] ? _raw_spin_lock+0x8c/0x120 [ 201.092924][ T5438] ? tun_chr_poll+0x127/0x770 [ 201.097606][ T5438] ? _raw_spin_lock+0x8c/0x120 [ 201.102383][ T5438] ? __cfi__RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0x10/0x10 [ 201.110641][ T5438] p9_fd_request+0x443/0x500 [ 201.115255][ T5438] p9_client_rpc+0x2f9/0xb40 [ 201.119858][ T5438] ? __cfi__RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0x10/0x10 [ 201.128139][ T5438] ? p9_fid_create+0x3d0/0x3d0 [ 201.132917][ T5438] ? __cfi__RNvCshgDM7dBCdno_11rust_binder16rust_binder_poll+0x10/0x10 [ 201.141352][ T5438] ? p9_conn_create+0x4c9/0x570 [ 201.146224][ T5438] ? p9_fd_create+0x2f3/0x4c0 [ 201.150907][ T5438] p9_client_create+0x96a/0x1190 [ 201.155864][ T5438] ? __cfi_p9_client_create+0x10/0x10 [ 201.161246][ T5438] ? kasan_save_alloc_info+0x40/0x50 [ 201.166539][ T5438] ? __kasan_kmalloc+0x96/0xb0 [ 201.171316][ T5438] ? kstrdup+0x7b/0x140 [ 201.175485][ T5438] ? __kasan_check_write+0x18/0x20 [ 201.180609][ T5438] v9fs_session_init+0x1e1/0x1820 [ 201.185663][ T5438] ? __cfi_v9fs_session_init+0x10/0x10 [ 201.191137][ T5438] ? kasan_save_alloc_info+0x40/0x50 [ 201.196442][ T5438] ? __kasan_kmalloc+0x96/0xb0 [ 201.201220][ T5438] ? v9fs_mount+0xbd/0xa00 [ 201.205650][ T5438] v9fs_mount+0xd7/0xa00 [ 201.209908][ T5438] ? __cfi_v9fs_mount+0x10/0x10 [ 201.214770][ T5438] ? selinux_capable+0x38/0x50 [ 201.219545][ T5438] legacy_get_tree+0x103/0x1b0 [ 201.224317][ T5438] ? __cfi_v9fs_mount+0x10/0x10 [ 201.229181][ T5438] vfs_get_tree+0xa1/0x290 [ 201.233609][ T5438] do_new_mount+0x251/0xb40 [ 201.238123][ T5438] ? security_capable+0xcf/0xf0 [ 201.242984][ T5438] path_mount+0x688/0x1050 [ 201.247408][ T5438] ? putname+0x113/0x150 [ 201.251665][ T5438] __se_sys_mount+0x2bd/0x480 [ 201.256356][ T5438] ? __x64_sys_mount+0xf0/0xf0 [ 201.261139][ T5438] ? __kasan_check_write+0x18/0x20 [ 201.266258][ T5438] ? fpregs_restore_userregs+0x11d/0x260 [ 201.271901][ T5438] __x64_sys_mount+0xc3/0xf0 [ 201.276504][ T5438] x64_sys_call+0x2021/0x2ee0 [ 201.281299][ T5438] do_syscall_64+0x58/0xf0 [ 201.285763][ T5438] ? clear_bhb_loop+0x50/0xa0 [ 201.290452][ T5438] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 201.296352][ T5438] RIP: 0033:0x7fd470d8e929 [ 201.300789][ T5438] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 201.320491][ T5438] RSP: 002b:00007fd471c28038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 201.328911][ T5438] RAX: ffffffffffffffda RBX: 00007fd470fb5fa0 RCX: 00007fd470d8e929 [ 201.336887][ T5438] RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 0000000000000000 [ 201.344966][ T5438] RBP: 00007fd470e10b39 R08: 0000200000000240 R09: 0000000000000000 [ 201.352955][ T5438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 201.360928][ T5438] R13: 0000000000000000 R14: 00007fd470fb5fa0 R15: 00007ffea40eb288 [ 201.368908][ T5438] [ 201.371955][ T5438] Modules linked in: [ 201.375901][ T36] audit: type=1400 audit(1750718051.539:497): avc: denied { create } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 201.376508][ T5438] ---[ end trace 0000000000000000 ]--- [ 201.396377][ T36] audit: type=1400 audit(1750718051.539:498): avc: denied { append open } for pid=91 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 201.396408][ T36] audit: type=1400 audit(1750718051.539:499): avc: denied { getattr } for pid=91 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 201.449548][ T5438] RIP: 0010:rust_helper_BUG+0x8/0x10 [ 201.455131][ T306] ryos 0003:1E7D:3232.0012: hidraw0: USB HID vff.ff Device [HID 1e7d:3232] on usb-dummy_hcd.3-1/input0 [ 201.467840][ T5438] Code: ce 82 e7 02 cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 0a fd 41 2d 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 48 89 e5 <0f> 0b 66 0f 1f 44 00 00 b8 40 39 08 a1 90 90 90 90 90 90 90 90 90 [ 201.487941][ T5438] RSP: 0018:ffffc9000d2d71b0 EFLAGS: 00010246 [ 201.494087][ T5438] RAX: 000000000000005a RBX: 1ffff92001a5ae38 RCX: 95ca4e6dea0c0b00 [ 201.502131][ T5438] RDX: ffffc9000b199000 RSI: 0000000000001ad6 RDI: 0000000000001ad7 [ 201.510167][ T5438] RBP: ffffc9000d2d71b0 R08: ffffc9000d2d6ea7 R09: 1ffff92001a5add4 [ 201.518158][ T5438] R10: dffffc0000000000 R11: fffff52001a5add5 R12: 0000000000000000 [ 201.526172][ T5438] R13: dffffc0000000000 R14: ffffc9000d2d71e0 R15: ffffc9000d2d7210 [ 201.534381][ T5438] FS: 00007fd471c286c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 201.543502][ T5438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 201.550137][ T5438] CR2: 0000200000001000 CR3: 0000000116758000 CR4: 00000000003526b0 [ 201.558120][ T5438] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 201.566190][ T5438] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 201.574211][ T5438] Kernel panic - not syncing: Fatal exception [ 201.580634][ T5438] Kernel Offset: disabled [ 201.584966][ T5438] Rebooting in 86400 seconds..