last executing test programs: 35.745505529s ago: executing program 2 (id=520): getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$netlink(r0, 0x10e, 0x4, &(0x7f00000003c0)=""/31, &(0x7f0000000400)=0x1f) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, 0x0, 0x0) r1 = ioctl$USERFAULTFD_IOC_NEW(0xffffffffffffffff, 0xaa00) ioctl$UFFDIO_MOVE(r1, 0xc028aa05, &(0x7f0000000040)={&(0x7f000055b000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x4000, 0x2}) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) write$cgroup_int(r2, &(0x7f0000000540), 0xfffffdd8) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20e02, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r3, 0x45809000) syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000081000/0x400000)=nil) 35.148818779s ago: executing program 2 (id=533): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00', 0x0}) r2 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r2, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x6, 0x0, r1, 0x1, 0x0, 0x6, @random="4a99fee2a74d"}, 0x14) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0xa, 0x2}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x29) r5 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000540)=[@wr_crn={0x46, 0x20, {0x2, 0x10001}}, @rdmsr={0x32, 0x18, {0x946}}, @uexit={0x0, 0x18, 0x4}, @cpuid={0x14, 0x18, {0x7ff, 0xb}}, @code={0xa, 0x55, {"66baf80cb8b8650d80ef66bafc0ced470f00123e6566440f38807a06c48275931c7d000000000f20e035200000000f22e09b410f01cb66b8a8000f00d0f30f01ea0f23f3"}}, @cpuid={0x14, 0x18, {0x4, 0x8}}, @rdmsr={0x32, 0x18, {0xbde}}, @wr_crn={0x46, 0x20, {0x0, 0x1}}, @wrmsr={0x1e, 0x20, {0xa61, 0x4}}, @wrmsr={0x1e, 0x20, {0x227, 0x7}}, @code={0xa, 0x7a, {"65450f01cff2450f08c74424001e000000c7442402570bf7daff2c24c74424000d000000c7442402ea000000ff1c24646764470f01ca64440fc7a87089e74fb805000000b90d0000000f01d9f26d450fc73500000000c7442400dd000000c744240200000000ff2c24"}}, @code={0xa, 0x43, {"66b82f018ec0c4e2619fcfc4213166c08f6978d6e6673e0f01c9263e440f01ca4701c10f01d13666430f382169006446dbe1"}}, @rdmsr={0x32, 0x18, {0xb2d}}, @uexit={0x0, 0x18, 0x27080}, @wrmsr={0x1e, 0x20, {0x39c, 0x80}}, @uexit={0x0, 0x18, 0x80}, @rdmsr={0x32, 0x18, {0xad5}}, @code={0xa, 0x7f, {"66b829008ed80f226740f6b51ffd0000670f01b8536b0000b9800000c00f3235002000000f30b9bb020000b8068ad2fbba42d4ec4b0f302664f24e0f2d94b76e3f5a3f66baf80cb8b08dba83ef66bafc0ced66f75e4848b88000c0fe000000000f23d00f21f835000000070f23f8"}}, @uexit={0x0, 0x18, 0x5}], 0x321}) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000400)=[@text16={0x10, &(0x7f0000000180)="66b97107000066b8ee73000066ba000000000f300f01dff00fba6e061567650f201067660f3a60c47a66b8010000000f01d9650f0d55002d630066b96c0a00000f320f08", 0x44}], 0x1, 0x14, &(0x7f0000000440), 0x0) sched_setscheduler(0x0, 0x2, 0x0) r6 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r6, &(0x7f0000000040), 0x10) listen(r6, 0x0) r7 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r7, &(0x7f0000000080), 0x10) setsockopt$sock_linger(r7, 0x1, 0xd, &(0x7f0000000140)={0x1, 0x9}, 0x8) close(r7) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000003c0), r8) sendmsg$IEEE802154_LLSEC_DEL_KEY(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r9, 0x1, 0x70bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x10) sendmsg$IEEE802154_LLSEC_DEL_DEV(r8, 0x0, 0x40020) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x50, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/165, 0x0, 0x1, 0x1e}, @flat=@weak_handle={0x77682a85, 0x200a, 0x2}, @flat=@handle={0x73682a85, 0x110f, 0x3}}, &(0x7f0000000100)={0x0, 0x20, 0x38}}}], 0x0, 0x0, 0x0}) 35.001183642s ago: executing program 2 (id=537): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000dfff00000300800d0001007564703a73797a300000000044000400200001000a004e2300000007ff02000000000000000000000000000109000000200002000a00000000000000ff01b0000000000000000000000000010000000000000000002bdcd65307b197c918fb1ff384421f090523c933696f2265ba004c7ef79dceb11b926ee2c254f8e0585905f7cabf33b8141acf251f236c4c4ff186858f719c69221c015949d17223232b5995ce630869fadbead1aaf8ca63bd11c8717994f29c5b5ea777a17e9d65d766ccb78b12b88718c49b04525f995b3d20d4b393ecb2821d86d338611f0153389abec53a7b5e8b2eb2a8f2f415d4db896d6486fb7549365bd03dbe73f3e873df5c6942e832c1b5d2e8d08efce6a53ede3dbedda1185b8a23b3a9752168c48e061ae6025bf8bb32299c2efc4abf76bdafa4b09dd38578f74f97821a5c2d7d9de8abe31a018bfb2a5e126a7ac8bfb086341abe8f30a184714bedbfbcdc397133efd879185a9ed31c6893b66e17c8ba7324fc9700943be8da6735ad7ea57d5ca212dbdd72000073c500c6e3f05437048853b8912e09bbd108da13622a0b1f57efd04cd7fa78c4cdf481d2530811e798ef3926617d775e24812b65b7bcd991d06271445078281b5deff19ba4bbc8002d16b0694da7cef8cdac614a0b87323940fb16b109164aa819ac7a3cc77e84c0fc4341359b743d8578e60e6246a70f0bc683cf50cb797adde531f33bce9a881bda263fc4abe4980dbbc635d3690bc8bce31366105a0e49ceb9f8075e0aab2dbed6e0cbd9"], 0x6c}}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0xc) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_int(r5, 0x0, 0xf, 0x0, &(0x7f0000004840)) ioctl$KVM_SET_GUEST_DEBUG(r4, 0x4048ae9b, &(0x7f00000001c0)={0x70003, 0x0, [0x7, 0xb, 0x2, 0xc, 0x7, 0x5, 0x3000000002, 0xffffffffffffffed]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 34.995758062s ago: executing program 2 (id=539): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) listxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)=""/172, 0xac) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x205) close_range(r0, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='oom_adj\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) read$eventfd(r2, &(0x7f0000000080), 0x8) getsockopt$CAN_RAW_JOIN_FILTERS(r1, 0x65, 0x6, &(0x7f0000000080), &(0x7f0000000100)=0x4) 34.923583603s ago: executing program 2 (id=544): r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000000201010100000000000000000200000004"], 0x44}}, 0x0) syz_open_procfs(0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000002200"], 0x1c}], 0x1}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x28}, 0x1, 0x0, 0x0, 0x4008040}, 0x20008000) pipe(&(0x7f0000000040)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) prctl$PR_SET_MM_EXE_FILE(0x53564d41, 0xd, 0xffffffffffffffff) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f00000000c0), 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB='max=\x00']) 34.899018343s ago: executing program 2 (id=546): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) (async, rerun: 64) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (rerun: 64) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) mount$incfs(&(0x7f0000000140)='./cgroup\x00', &(0x7f0000000200)='./cgroup\x00', &(0x7f00000001c0), 0x1014000, 0x0) (async) openat$ptmx(0xffffffffffffff9c, 0x0, 0x8000, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0x54, 0x0, &(0x7f0000000400)=[@increfs, @acquire={0x40046305, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)={0x30, 0x30, 0x30}}}], 0x0, 0x0, 0x0}) 34.849102174s ago: executing program 32 (id=546): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) (async, rerun: 64) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (rerun: 64) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) mount$incfs(&(0x7f0000000140)='./cgroup\x00', &(0x7f0000000200)='./cgroup\x00', &(0x7f00000001c0), 0x1014000, 0x0) (async) openat$ptmx(0xffffffffffffff9c, 0x0, 0x8000, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0x54, 0x0, &(0x7f0000000400)=[@increfs, @acquire={0x40046305, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)={0x30, 0x30, 0x30}}}], 0x0, 0x0, 0x0}) 1.972636698s ago: executing program 1 (id=1124): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000000)={0x0, 0x0, 0x9}) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000880)={'filter\x00', 0x1002, 0x4, 0x3f0, 0xe8, 0x1f8, 0xe8, 0x308, 0x3f0, 0x308, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1f8}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @mac, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0xf, 0xffffffff}}}, {{@arp={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, 0xff000000, 0x0, 0x6, 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x22}, {[0x0, 0x0, 0x0, 0x0, 0xff, 0xff]}}, {@empty, {[0x0, 0xff, 0x0, 0xff, 0x0, 0xff]}}, 0x6, 0x81, 0x1, 0x1, 0xd13, 0xe106, 'pimreg1\x00', 'veth1_virt_wifi\x00', {0xff}, {0xff}, 0x0, 0x4}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @mac=@random="3330cb30ca8a", @private=0xa010102, @broadcast}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) (async) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000040)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x0, 0x0, 0xc}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) 1.948086328s ago: executing program 1 (id=1125): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x1, 0x0) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x0, 0x2}) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000180)=0x7f, 0x4) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0xb}, 0x8}, 0x1c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) writev(r1, &(0x7f0000000900)=[{&(0x7f00000001c0)="15455cb71185a88afa4d1edd83201024d05c6d20fe6fad428db25f26f9b554f8347ab3cb6c31421df2c21f9c9f85a79e5d1cf16aed3b83767a63bb5e8181b27694af9e075aecbc83415fdc41", 0x4c}, {&(0x7f0000000340)="fd9e64c391783e5f0b2f36b648d36d7e4d80b3e5254efdbf473ea0c21f080b7de08ce93492118053eede114543bb3cf85ab88cb8", 0x34}, {0x0}, {0x0}, {0x0}], 0x5) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x1) r2 = open(&(0x7f0000000000)='./file0\x00', 0x80140, 0x0) mlockall(0x1) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000240)) syz_clone3(&(0x7f00000005c0)={0x200000, 0x0, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, &(0x7f0000000580)=[0x0], 0x1}, 0x58) fcntl$setlease(r2, 0x400, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x800}]}) r3 = accept$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000180)=0x14) setsockopt$packet_int(r3, 0x107, 0x7, &(0x7f00000001c0)=0x4b2, 0x4) fsopen(0x0, 0x0) r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1a5042, 0x0) fsync(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) r6 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$packet(0x11, 0xa, 0x300) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000200)={'veth0_to_team\x00', 0x0}) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r7, &(0x7f00000000c0)="3f051c000302140006001e089ce9aaa911f14092820088a8d1baea8fda084e161b7880610cc9", 0x26, 0x0, &(0x7f0000000540)={0xc9, 0x0, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) syz_usb_connect$cdc_ecm(0x0, 0x5c, &(0x7f0000000880)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x4a, 0x1, 0x1, 0x0, 0x20, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x2, 0x2, 0x0, 0xfe, {{0x5}, {0x5, 0x24, 0x0, 0x175a}, {0xd, 0x24, 0xf, 0x1, 0x80000000, 0x0, 0x2000}, [@country_functional={0x6, 0x24, 0x7, 0x6, 0x7}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x400, 0x5, 0x3, 0xfa}}], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x0, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x0, 0xf8}}}}}]}}]}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f00000000c0)=[@mss={0x2, 0x8}, @timestamp], 0x2) 1.283441999s ago: executing program 3 (id=1143): setresgid(0xee00, 0x0, 0x0) (async) r0 = syz_clone(0x62a2180, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) writev(r1, &(0x7f00000004c0)=[{&(0x7f00000001c0)="0f9f148315a5bb2e8335a16a376d16c4db3731d3009d31d0cc4ef6d2de6582570d00cd28783b3bf3b7ba356404152f4685d21d3bb4bcab0c2519a8d9f69ed2e243e473", 0x43}, {&(0x7f0000000240)="8bc0f77a12d88b2c59a5f8393f4cd1513e983f0261ac7ba9d76e9a98dc8cf78183feb4fbc9f499092f4d02285015d70bc242db3359e0928c62f55c5017167f4e1cd00b4fa257b2d534df87db4915b768454813e9f7f69b8968f3b7", 0x5b}, {&(0x7f00000002c0)="d1a9bf72e88b633295fb49a352be01f36aec40e876e32ff142f5ae48b08cc47e85305c025208b692f33cc1ad9271abb95927363d2386e50239d2229113f838c179ea310797835a074f613a2d15901e69e0", 0x51}, {&(0x7f0000000380)="8af4b59cd509753541e2a022670a03b0a223d2cc3708d9ec72f196", 0x1b}, {&(0x7f00000003c0)="18a1dffa825994f885a2471a580f93ffdd324a2b0b8a2c2be2c3d93a6425f3f9", 0x20}, {&(0x7f0000000400)="70410689446cfd3e6687c202bce04693d6d9abc21e6f4565955b90b48a2ee8dfb0fc3559a399352d73cd60e36d99aa0563e37bc24cca35e2c1c88830d30c469d54a0e011630f0defe379dc49ca888b7c0f6d6b4504", 0x55}, {&(0x7f0000000480)="39b649960859b5fa9bafae0e86e52430929af7676d0a645d6359e3f34547552e323697ee8d03be7f4f18", 0x2a}], 0x7) (async) r2 = syz_open_procfs(r0, &(0x7f00000000c0)='net/softnet_stat\x00') fchdir(r2) (async) socket$igmp(0x2, 0x3, 0x2) (async) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) ptrace$getregs(0xc, r0, 0x2, &(0x7f0000000100)=""/27) (async) syz_open_procfs(r0, &(0x7f0000000040)='attr/exec\x00') r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 1.20554613s ago: executing program 3 (id=1144): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) personality(0x5400004) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x99b33000) (async) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r3 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r4 = dup2(r2, r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x1e, 0x0, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_INFO(r5, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x0, [0x8, 0x4, 0x80000000]}, &(0x7f0000000080)=0x44) (async) ptrace(0x10, r1) (async) r6 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) (async) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) (async) connect$inet6(r7, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "0000000400", "6abc00000000000000000000001000", "f0630400", "c14ec98dcd2ad89f"}, 0x28) sendto$inet6(r7, &(0x7f0000000240)="c62ee5d6a89f2387cb4093532f7c0a22ce", 0xffffffffffffff69, 0x8040, 0x0, 0x0) (async) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff7fff}]}) close_range(r8, 0xffffffffffffffff, 0x0) (async) write$selinux_validatetrans(r6, 0x0, 0x79) (async) ptrace$poke(0x4, r1, &(0x7f00000000c0), 0x8) 1.204520001s ago: executing program 3 (id=1145): openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0), 0x240, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0xff, 0x1f}, {0x0, 0x0, 0x0, 0x4, 0xb6, 0x0, 0x0, 0x0, 0x0, 0x9}, {0x0, 0xfffd, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe}], 0x6}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.122640412s ago: executing program 3 (id=1146): r0 = syz_open_procfs(0xffffffffffffffff, 0x0) read$FUSE(r0, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f00000012c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1cf7bb"], 0x14}}, 0x8040) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000700), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000740)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_NAN(r0, &(0x7f0000000840)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x48, r1, 0x4, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0xc7e, 0x46}}}}, [@NL80211_ATTR_BANDS={0x8, 0xef, 0x8}, @NL80211_ATTR_BANDS={0x8, 0xef, 0x5}, @NL80211_ATTR_BANDS={0x8, 0xef, 0xc}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0xfb}]}, 0x48}}, 0x0) r3 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000080), 0x2) r4 = memfd_create(&(0x7f0000000000)='-&:{-\xaa]{\x00', 0x2) r5 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000000680)=0x0) fcntl$lock(r5, 0x5, &(0x7f0000000240)={0x0, 0x1, 0x32, 0x6, r6}) r7 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) pwrite64(r4, &(0x7f00000002c0)="e6", 0x1, 0x4002) getgroups(0x2, &(0x7f0000000140)=[0x0, 0xee00]) setregid(0x0, r9) setresgid(r9, r8, r9) fcntl$addseals(r4, 0x409, 0x6) r10 = ioctl$UDMABUF_CREATE_LIST(r3, 0x40087543, &(0x7f00000000c0)={0x0, 0x1, [{r4, 0x0, 0x0, 0x4000}]}) ioctl$DMA_BUF_IOCTL_SYNC(r10, 0x40086200, 0x0) pipe(&(0x7f00000004c0)={0xffffffffffffffff}) fstat(r11, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r12) sendmsg$netlink(r5, &(0x7f0000000280)={&(0x7f0000000180)=@kern={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)=[{&(0x7f0000000880)={0x358, 0x35, 0x4, 0x70bd2d, 0x25dfdbfe, "", [@generic="a6f77a5e68a51ecda0c0287a8632381b21a5a9030e006be907f23453dbeec0938d873a331bbc0926669f54d628c769ae98b233b29c0e95b00190a65ffa9075ce12e374c581d53d8cc3bfd0d87d3a4b2239db78b1e12362abc64a105621ce255c0a3f5ba3f274ded2b6b7b360898735eacbcbf5ed0a90696abf25ad6b6a7388508b73cb1c2ffd25ed37788242f140da4ea480ad60b4be924ec638358fc45bebf07a0b0517b8776f961892ff7d640689770ba9a1af12dcb3665538e6d85bc4f6a7765b18", @generic="57bc51534c386cc129118d5de8af78df6969f47992f57749f828f22eeb7fbb3273f0c5247887a6988b36eae110c561312e22f649d99e0e547de2b48aaf1708d4d1a25bd0a8f36157be3f", @typed={0x8, 0x5c, 0x0, 0x0, @uid=r12}, @generic="924d30989d4728d7dc52fdcdaedca51bdb8ac39d9e908dfb47756a68883cb0ae804157c047a0c92504b3653fe261f52ead091e0d8e8c965b69ce7961e49b0cc83f38db2e165c050b48cb3f1dd5b467b302f02667", @nested={0x102, 0x4d, 0x0, 0x1, [@typed={0x8, 0x130, 0x0, 0x0, @fd=r11}, @generic="2ee4d053c5a8a20d8af942f1804bab188a3da6b2fdaea0c2966e8bbdced39c97b1e7e11407646ed2183c5e30a2174aff6f7ad5bb12f4b86a2e13c678393c90a7565342afe0c2336e50da4d4e6fb9e7c193263f818defbed7151edaf7690d87f03c2dfc94e35e3940bb1716fd1a32554a8274ce87c9474aa8f28130b32a20c56b9275a8143ff11f94a2549fb456e43c42ec01d55ac463556cee85516cc808025b3101da1d3e835b3f2266ae7abd3564c6fe61187381960fa40e569749403fd34bd928fd0f5bfb5b7143db3233a99504ed2e6eef6fdc7c95ffa22b72b5a357a1e834b5c3b841c6c48d019eb973fcd885dab00271d00f0c"]}, @nested={0xd6, 0xd2, 0x0, 0x1, [@nested={0x4, 0x9}, @generic="62f426016d9e9c677553084b2509da80bb77a6c5d6b5dd8a4673986554685c736f8bdaa7b9872c8cdbccef8dcfda3c0af9832bed25cc9048d0722171be038c9ea07fe0591a0b98a6fef5bcd3dffdd0693b468b459123a539d28ab88bb1f60efeca230410b82cf1a4ba4d94c970e17508a2bc2d1ed8f6e6070deb53a5d40d992c8b1212e3613713adb4bda44c0a5c4c588aa2321a646d829fc5fccf55e01f4eadeeb1bacc02df80424a10516c8e653ed69cb5457146cb16ca5a328b1e224bdbe3554e948bff4d1aacc9e9a37f18e3"]}]}, 0x358}], 0x1, 0x0, 0x0, 0x881}, 0x90) getsockopt$inet6_buf(r7, 0x29, 0xca, &(0x7f0000000300)=""/129, &(0x7f0000000140)=0x81) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f00000000c0), 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB='max=\x00']) 1.105986462s ago: executing program 3 (id=1147): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x1, 0x0) prctl$PR_MCE_KILL(0x21, 0x1, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002abd7000fccdbef151cf267416dbf125", @ANYRES32=0x0, @ANYBLOB="04001d80"], 0x20}}, 0x20000000) (async) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096010006010003000000002a90a02700000000b3813e"], 0x0}, 0x0) (async) r4 = socket$inet6(0x10, 0x3, 0x0) write(r4, &(0x7f0000000300)="2400000021002551241c0165ff00fc020200002000100f000ee1000c00000000000000006e", 0x25) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r6, &(0x7f0000000040)=ANY=[@ANYBLOB="1500000065ffff017f000e0800395032303030"], 0x15) (async) r7 = dup(r6) (async) open(&(0x7f0000000100)='./file0\x00', 0x440, 0x0) write$FUSE_BMAP(r7, &(0x7f0000000000)={0x18, 0x0, 0x0, {0x3b9}}, 0x18) (async, rerun: 64) write$FUSE_INIT(r7, &(0x7f00000002c0)={0x50, 0x0, 0x0, {0x7, 0x2b, 0xc7, 0x8004000, 0x7, 0x8, 0x8000, 0x6, 0x0, 0x0, 0x10, 0x5}}, 0x50) (async, rerun: 64) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000080), 0x1010412, &(0x7f0000000380)=ANY=[@ANYBLOB="7472616e733d66642c7266646e6f3dc1d4685592e41e30ab4e75f0be683b73d561e144e32b52d89e731b3df7c0ceece4ded3ca2e1b4eb9541f776dd3eb45d8f900ae8f8e1deffb61ac15d53858a01bb38d", @ANYRESHEX=r5, @ANYBLOB=',wfdno=', @ANYRESHEX=r7, @ANYBLOB=',\x00']) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), 0xffffffffffffffff) (async, rerun: 32) chmod(&(0x7f00000000c0)='./file0\x00', 0x40) (async, rerun: 32) read$FUSE(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io(r3, 0x0, 0x0) (async, rerun: 32) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x2000, 0x40002, 0x0, 0x4000, 0x200, 0xffffffff}) (async, rerun: 32) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000200)={'macsec0\x00', &(0x7f0000000100)=@ethtool_rxnfc={0x2e, 0x12, 0x1, {0x2, @ah_ip6_spec={@private2, @ipv4={'\x00', '\xff\xff', @remote}, 0x40008, 0x5}, {0x0, @local, 0xfffe, 0x1ff, [0x7, 0x6]}, @tcp_ip6_spec={@private2, @remote, 0x4e22, 0x4e21, 0x6}, {0x0, @local, 0xb289, 0x3, [0x401]}, 0xfffffffffffff200, 0xe}}}) (async) getdents64(r7, &(0x7f0000000240)=""/20, 0x14) (async) ioctl$TCSETSW2(0xffffffffffffffff, 0x5453, 0x0) (async) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) 757.373798ms ago: executing program 1 (id=1150): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x391000, 0x0) write$vga_arbiter(r0, &(0x7f0000000080)=ANY=[@ANYBLOB='target PCI:0:'], 0x13) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='exfat\x00', 0x200000, 0x0) 672.625069ms ago: executing program 1 (id=1152): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x41, 0x10000000}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000040)={0x41, 0x1}, 0x10) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) (async) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x180) (async) r3 = syz_open_dev$evdev(&(0x7f0000000180), 0x1, 0xa2242) write$evdev(r3, 0x0, 0x0) read(r3, &(0x7f0000000000)=""/16, 0x10) write$cgroup_int(r2, &(0x7f0000000040)=0x10000000000000, 0x12) r4 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f0000000240), 0x2c) (async) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) (async) syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000081000/0x400000)=nil) 597.39436ms ago: executing program 1 (id=1156): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="0100000001000000ffffffff00000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000900000002000040ff00"], 0x48}, 0x1, 0x0, 0x0, 0x881}, 0x4000044) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x8, r3) ptrace$pokeuser(0x6, r3, 0x358, 0xffff8881f6e4ea00) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$can_bcm(0x1d, 0x2, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) (async) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) (async) sendmsg$can_bcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="0100000001000000ffffffff00000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="000000000900000002000040ff00"], 0x48}, 0x1, 0x0, 0x0, 0x881}, 0x4000044) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) (async) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) ptrace(0x8, r3) (async) ptrace$pokeuser(0x6, r3, 0x358, 0xffff8881f6e4ea00) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) 582.162701ms ago: executing program 1 (id=1157): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) r1 = syz_usb_connect$hid(0x4, 0x36, &(0x7f00000005c0)=ANY=[@ANYRESOCT=r0], 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) fcntl$lock(r2, 0x7, &(0x7f0000000340)={0x2, 0x3, 0x3, 0x1005, 0xffffffffffffffff}) syz_usb_control_io$hid(r1, &(0x7f0000000240)={0x24, &(0x7f0000000380)=ANY=[@ANYBLOB='\x00\x00\f\x00\x00\x00\a', @ANYRES64=r1], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000600)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}) setsockopt$CAN_RAW_ERR_FILTER(0xffffffffffffffff, 0x65, 0x2, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000001200)={0x0, 0xffffff1e, 0xffffffff, 0x4, 0x19, "000bf100ee0000000000000000000000002000"}) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x52f3) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'sit0\x00', &(0x7f0000000080)={'syztnl0\x00', r3, 0x7800, 0x20, 0xac2, 0xa8cc, {{0x17, 0x4, 0x2, 0x8, 0x5c, 0x64, 0x0, 0x0, 0x29, 0x0, @empty, @broadcast, {[@ssrr={0x89, 0x1b, 0x3f, [@dev={0xac, 0x14, 0x14, 0x3e}, @multicast2, @multicast1, @empty, @remote, @empty]}, @rr={0x7, 0x13, 0x46, [@local, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, @loopback]}, @timestamp_prespec={0x44, 0x14, 0x28, 0x3, 0x3, [{@remote, 0x8}, {@empty, 0x8}]}, @lsrr={0x83, 0x3, 0xc3}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'sit0\x00', &(0x7f0000000080)={'syztnl0\x00', r3, 0x7800, 0x20, 0xac2, 0xa8cc, {{0x17, 0x4, 0x2, 0x8, 0x5c, 0x64, 0x0, 0x0, 0x29, 0x0, @empty, @broadcast, {[@ssrr={0x89, 0x1b, 0x3f, [@dev={0xac, 0x14, 0x14, 0x3e}, @multicast2, @multicast1, @empty, @remote, @empty]}, @rr={0x7, 0x13, 0x46, [@local, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, @loopback]}, @timestamp_prespec={0x44, 0x14, 0x28, 0x3, 0x3, [{@remote, 0x8}, {@empty, 0x8}]}, @lsrr={0x83, 0x3, 0xc3}]}}}}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) sendmsg$can_raw(r2, &(0x7f00000004c0)={&(0x7f0000000280)={0x1d, r4}, 0x10, &(0x7f00000002c0)={&(0x7f0000000440)=@canfd={{0x2, 0x0, 0x1}, 0x1a, 0x3, 0x0, 0x0, "e46ade4ef5a07dc4303db60c6e59b426aab868fe252136c82f6789b739eb8dbcbb1022bdeb193120168ccbdd2bef4743034f9cb635a366dda62815ecaf8c1181"}, 0x48}, 0x1, 0x0, 0x0, 0x24000001}, 0x804) (async) sendmsg$can_raw(r2, &(0x7f00000004c0)={&(0x7f0000000280)={0x1d, r4}, 0x10, &(0x7f00000002c0)={&(0x7f0000000440)=@canfd={{0x2, 0x0, 0x1}, 0x1a, 0x3, 0x0, 0x0, "e46ade4ef5a07dc4303db60c6e59b426aab868fe252136c82f6789b739eb8dbcbb1022bdeb193120168ccbdd2bef4743034f9cb635a366dda62815ecaf8c1181"}, 0x48}, 0x1, 0x0, 0x0, 0x24000001}, 0x804) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f00000000c0)={0x500, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090c0000000000000000000000030006000000000002810000e00000806a9df86a924e9a010000000000000000020001000000000000000300000000000300050000000000020000007f0000010000000000000000020013ec21c763c51e48121402677529d5927d008f96371fdd56f9", @ANYRES8=0x0, @ANYRES32=r5], 0x60}}, 0x0) (async) sendmsg$key(r6, &(0x7f00000000c0)={0x500, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090c0000000000000000000000030006000000000002810000e00000806a9df86a924e9a010000000000000000020001000000000000000300000000000300050000000000020000007f0000010000000000000000020013ec21c763c51e48121402677529d5927d008f96371fdd56f9", @ANYRES8=0x0, @ANYRES32=r5], 0x60}}, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) socket$tipc(0x1e, 0x5, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r7, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) (async) bind$inet6(r7, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r7, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) sendto$inet6(r7, 0x0, 0x0, 0x8000, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) (async) sendto$inet6(r7, 0x0, 0x0, 0x8000, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) socket$inet6(0xa, 0x5, 0x7) (async) socket$inet6(0xa, 0x5, 0x7) pselect6(0x40, &(0x7f0000000080)={0x75, 0x0, 0xfffffffffffffffa, 0xfffffffffffff5e8, 0x5, 0x3, 0xfffffffffffffffa, 0x331}, 0x0, 0x0, 0x0, 0x0) 440.008553ms ago: executing program 0 (id=1164): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$packet(0x11, 0x2, 0x300) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x2}) (async) r2 = socket$can_raw(0x1d, 0x3, 0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) (async) setsockopt$CAN_RAW_RECV_OWN_MSGS(r2, 0x65, 0x4, &(0x7f00000003c0)=0x101, 0x4) (async, rerun: 32) openat$kvm(0xffffffffffffff9c, 0x0, 0x191880, 0x0) (async, rerun: 32) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0xc, 0x0, &(0x7f0000000040)=[@release={0x40046306, 0x2}, @enter_looper], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) ioctl$PTP_PEROUT_REQUEST2(r5, 0x40043d14, &(0x7f0000000040)={{0x200000080000003, 0xff}, {0x0, 0x7}, 0xc, 0x1}) 439.496433ms ago: executing program 0 (id=1166): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x64, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0xfffffffffffffea4, 0x0, 0x0}, 0x400}, @acquire_done={0x40106309, 0x2}, @exit_looper], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r1, 0x0) io_pgetevents(0x0, 0x9, 0x0, 0x0, 0x0, &(0x7f0000000640)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 370.487504ms ago: executing program 0 (id=1170): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x183) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4c"], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="38010000fe0000"], 0x138) mount$9p_fd(0x0, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000004500), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',dfltuid=', @ANYRESHEX=0x0, @ANYBLOB]) readv(r2, &(0x7f0000000040)=[{&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000000140)=""/94, 0x5e}, {&(0x7f0000001680)=""/4096, 0x1000}], 0x3) r4 = open(&(0x7f0000000080)='./file1\x00', 0x10b942, 0x1) sendfile(r4, r0, 0x0, 0x80000000) 277.904696ms ago: executing program 4 (id=1175): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = dup(r0) ioctl$PTP_EXTTS_REQUEST2(r1, 0x3d13, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r3, 0x400455c8, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x67, 0x0, 0xffffffffffffff32) connect$inet6(r4, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendmmsg$inet6(r4, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000040), 0x6) close_range(r2, 0xffffffffffffffff, 0x0) 277.769005ms ago: executing program 0 (id=1176): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f0000000080)='smaps_rollup\x00') capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x9}) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f00000000c0)={@private0={0xfc, 0x0, '\x00', 0x1}, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000080)={@private0={0xfc, 0x0, '\x00', 0xb}, 0x800, 0x2, 0x1, 0x7, 0x7fc, 0xfffe}, 0x20) pread64(r1, &(0x7f0000002280)=""/4096, 0x1000, 0xd33) 213.629417ms ago: executing program 0 (id=1177): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000840)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000280)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x14}, @flat=@weak_binder={0x77622a85, 0x0, 0x3}, @flat=@weak_binder={0x77622a85, 0x110a, 0x2}}, 0x0}, 0x400}], 0x50, 0x0, &(0x7f0000000300)="ae3f238d87e4ee9205d0842b529db2744ccf6892f6f65ebc4671b63de4ba15bd1a1533502e2a569d6aea8936ab051cf9bfc0d34c0581506339d94a60289c526d8168e83c2efd49c75aa9d82de77714ff"}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000140)='./file0\x00', r1, &(0x7f0000000200)='./bus\x00', 0x0) setsockopt$inet_int(r1, 0x0, 0x6, &(0x7f0000000000)=0x10000, 0x4) 212.227417ms ago: executing program 4 (id=1178): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'veth1_to_team\x00', &(0x7f00000005c0)=@ethtool_rxnfc={0x37, 0x3, 0x0, {0x5, @udp_ip6_spec={@private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, 0x4e23, 0x4e24, 0x8}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x26}, 0x5, 0xf, [0x1, 0x793]}, @udp_ip4_spec={@loopback, @local, 0x4e20, 0x4e23, 0x1}, {0x0, @empty, 0x4, 0x6, [0x61c4ff47, 0x5]}, 0x4, 0xfffff3ac}}}) (async) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/sync_on_suspend', 0x406000, 0x8) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x4, 0x1, 0x5, 0x0, 0x0, {0x1, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20040061}, 0x10) (async) setsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000080)=0x8000, 0x4) (async) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r3, &(0x7f0000001140)=[{{&(0x7f0000000200)={0x2, 0x4e23, @remote}, 0x10, 0x0}}, {{&(0x7f00000000c0)={0x2, 0x4e23, @remote}, 0x10, 0x0}}], 0x2, 0x4044014) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$F2FS_IOC_DEFRAGMENT(r3, 0xc010f508, &(0x7f0000000a40)={0x8001, 0x6}) (async) clock_gettime(0x0, &(0x7f0000006f00)={0x0, 0x0}) recvmmsg(r3, &(0x7f0000006d80)=[{{&(0x7f0000000100)=@ax25={{0x3, @default}, [@netrom, @remote, @rose, @remote, @default, @netrom, @netrom, @bcast]}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000180)=""/126, 0x7e}, {&(0x7f0000000240)=""/161, 0xa1}, {&(0x7f0000000300)=""/226, 0xe2}, {&(0x7f0000000400)=""/140, 0x8c}, {&(0x7f00000004c0)=""/228, 0xe4}, {&(0x7f00000005c0)=""/122, 0x7a}, {&(0x7f0000000640)=""/211, 0xd3}, {&(0x7f0000000740)=""/72, 0x48}, {&(0x7f00000007c0)=""/99, 0x63}], 0x9, &(0x7f0000000900)=""/184, 0xb8}, 0xfb73}, {{&(0x7f00000009c0)=@xdp, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000a40)}, {&(0x7f0000000a80)=""/95, 0x5f}, {&(0x7f0000001440)=""/4096, 0x1000}, {&(0x7f0000000b00)=""/231, 0xe7}, {&(0x7f0000000c00)=""/14, 0xe}], 0x5, &(0x7f0000000cc0)=""/173, 0xad}, 0x4}, {{&(0x7f0000000d80)=@nl=@unspec, 0x80, &(0x7f0000000e00)=[{&(0x7f0000002440)=""/4096, 0x1000}], 0x1, &(0x7f0000000e40)=""/93, 0x5d}, 0x3}, {{&(0x7f0000000ec0)=@l2tp6={0xa, 0x0, 0x0, @private1}, 0x80, &(0x7f00000010c0)=[{&(0x7f0000000f40)=""/88, 0x58}, {&(0x7f0000000fc0)=""/104, 0x68}, {&(0x7f0000001040)=""/2, 0x2}, {&(0x7f0000003440)=""/4096, 0x1000}, {&(0x7f00000011c0)=""/193, 0xc1}, {&(0x7f00000012c0)=""/216, 0xd8}, {&(0x7f0000001080)=""/13, 0xd}], 0x7, &(0x7f0000004440)=""/149, 0x95}, 0xffff}, {{&(0x7f0000004500)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, &(0x7f0000005a40)=[{&(0x7f0000004580)=""/157, 0x9d}, {&(0x7f0000004640)=""/124, 0x7c}, {&(0x7f00000013c0)=""/9, 0x9}, {&(0x7f00000046c0)=""/4096, 0x1000}, {&(0x7f00000056c0)=""/215, 0xd7}, {&(0x7f00000057c0)=""/51, 0x33}, {&(0x7f0000005800)=""/224, 0xe0}, {&(0x7f0000005900)=""/20, 0x14}, {&(0x7f0000005940)=""/226, 0xe2}], 0x9}, 0x400}, {{&(0x7f0000005b00)=@pptp={0x18, 0x2, {0x0, @remote}}, 0x80, &(0x7f0000006cc0)=[{&(0x7f0000005b80)=""/185, 0xb9}, {&(0x7f0000005c40)=""/4096, 0x1000}, {&(0x7f0000006c40)=""/102, 0x66}], 0x3, &(0x7f0000006d00)=""/105, 0x69}, 0x1}], 0x6, 0x142, &(0x7f0000006f40)={r5, r6+60000000}) (async) ioctl$BINDER_FREEZE(r4, 0x400c620e, &(0x7f0000001400)={0x0, 0x0, 0xfc000000}) 206.481117ms ago: executing program 0 (id=1179): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/locks\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000200)='./bus/file0\x00', 0x100) faccessat2(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x3, 0x300) pread64(r0, &(0x7f0000001440)=""/126, 0x7e, 0x41) r1 = open(&(0x7f0000000380)='./bus\x00', 0x48141, 0x100) fcntl$setlease(r1, 0x400, 0x1) rename(&(0x7f00000002c0)='./bus\x00', &(0x7f00000001c0)='./file0\x00') r2 = socket$netlink(0x10, 0x3, 0x8) sendmsg$netlink(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)}, 0x0) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x64342, 0x0) ioctl$BLKDISCARDZEROES(r3, 0x127c, &(0x7f0000000040)) fdatasync(0xffffffffffffffff) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x6) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) mmap(&(0x7f00005e5000/0x2000)=nil, 0x2000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) sendfile(r3, 0xffffffffffffffff, 0x0, 0x7ffff000) syz_open_dev$loop(&(0x7f0000000140), 0x9, 0x22c4c2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x8d) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000001c0)={'veth1_to_hsr\x00', 0x0}) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r5, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0088f71327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) close(r4) r7 = socket$tipc(0x1e, 0x5, 0x0) listen(r7, 0x7) getresuid(&(0x7f0000000240), &(0x7f0000000300), &(0x7f0000000340)) 205.541697ms ago: executing program 4 (id=1180): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x180862) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000380)={@multicast2, @empty, 0x1}, 0x10) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$sock_int(r4, 0x1, 0x2d, 0x0, &(0x7f0000000080)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r3, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000400)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r5, &(0x7f0000000040)={0x18, 0xfffffffffffffff5, r6, {0x8}}, 0x18) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r5, 0x0, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xa]}}) pwritev(r0, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000280)="c71d5a9c", 0x4}], 0x2, 0x5, 0x78b) 78.608929ms ago: executing program 3 (id=1181): getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) write$cgroup_int(r0, &(0x7f0000000540), 0xfffffdd8) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000640)={0x28, 0x0, 0x2710, @local}, 0x10) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) fcntl$setpipe(r3, 0x407, 0x0) write$FUSE_INIT(r3, &(0x7f0000000340)={0x50, 0xfffffffffffffffe, 0x0, {0x7, 0x28, 0xd19e, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x10, 0x3}}, 0x50) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r4, 0x0, 0x16, &(0x7f0000000040)=0x6, 0x4) vmsplice(r3, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0) write$cgroup_int(r2, &(0x7f0000000080)=0x5, 0x12) fcntl$setpipe(r3, 0x407, 0x10ae) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r5, 0x2000) 77.626099ms ago: executing program 4 (id=1182): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') r1 = creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4c"], 0x15) r4 = dup(r3) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="38010000fe0000"], 0x138) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r5, &(0x7f0000000c40)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f00000008c0)=';', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000004080)=[{&(0x7f0000000f00)="52348bf9812fc081678b5760a4c4967393fd8939aaf12a894c5424df616c4eea14fbac2dad114a75c405d89fafa5715b56abba4bbceca456d8225e3f6eb57a03287e74c7bd74e40e3fda3150f92d181e7c82cb2f8ea0416fc4c0f111161cdb9a52911925644e25f871d02f403c83214f830f93b30b874e75cab53f1ed7871f21c0d654a47fab0637868517d7e8d9915e99b4dc2dcafdcb2ef2a012ec95418a544c32181fb969e01318e00a12fd1b2a0eb57bcf7de086e320f2d4be4e1453010be849e4d7dba41558329699aacd3d1c7d97b9bf74caf8b7946647309d209558b1965ef7ea4576ec0e289b73c2089310271d0a67d88a312f4cb0194c4f28ec3c2fe269311d0cec1fe0efef17d376d183b08e392b6cb58e930e1f959dd4528ec95350fc86e5297e6d59af036b132df17833881238ba8692842a8da4d5b4a37c94915331143d9128a197495433c2f550b4455a9ae03b937305e192e861ca3a60f9b3a14288e3daeb6936593485388a4aaab39b3843ee2960d9c8728eafb904333e7b78a270480e8dd89bc4cf0b791013cff43bf314e11a44d5f9c4fdad8a2fcdb04f76de29a50a0428148f4bc3eff1e84d25ea95dabddfba6162860a3c3389ee366450b6bcf1409f920caf1be5702af0402e2cef4896d9544a26ebfab694d7a47eca55bd2f62e7d7eb1f6061f7e441df5ab31344f02179764822036ef706133ea1a6380e042f074b2b0ddcc578cb8a668a846b9d5792f8d434f8ec7b562594587c49e8e6b3450e545fc070644bd06a36106cdb63f9e8ad7ae50b5b44e47f377961f5e29392330fb40d63c911ffd13e094f0452cc5c77b0731b56211b2d8a7554f6077ae593626a54f56d6dea49058fd1d48db02a7b33d50474b58a7e14e6a4d935bfaf4865f00074d59ece4b2d5f5e768e952733ee2c34b3e4b0be230f792f8b16f872afbbd155fe5314d4f54ea7b747eb2cd2410db7464c73ecd4815cda0bcc839fb603bb3f0c04b2d233b54a78b7aa3db974e469c8788e155cc2ef39bcf8491101058093c842df8cd0ac03d29e6d6902187f31eaf960b306debf734d8d26cc34a7e62c64a98b5a8a61020d81f5213d4d5722088be5b5ea6b1ee19b148d1f8b7172cd507533360d2d668e85252463b1d61302a75a7e3dc5e8c607a1026c66c2e8a6cbd34e3e5e99890da6cf07ed1247a07f004a6b1d643e00be7c156127bd7b39326e84ea6963d0530a4538eea35cf8048440a65148f1fe6314020bbe9c9358242589360fa5b1425d24b9f59141d81c0dbdd2e802eb82849e6342a4ffd0dcf3", 0x39e}], 0x1}}, {{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000200)="0155ed57dd4fe53964330203fec2474742e1be9ca93abdc23c23487cc28ae2d0bfb2324c6077a9ac9e9971a2ee8b32243dcd5db4584d1537dca844c78e3a18e85629da156671c51bed4e520bddf6a89a04d3b8c4fb5b61eedb7ef3a3a63beb378be6056804f09f0bb962551c7d2b09933366d9d256eea3", 0x77}, {&(0x7f0000000380)="db1927941e0935b1ca70afa18bb051d79ec0d6308dbca51717d724b6e34c6ea9cde7b951fe841ab15bb9b0accf35480e05629cc2bb29d622458e45c6ebda5cbafc9d28ad7b4a5b3303c9cb", 0x4b}], 0x2}}], 0x3, 0x44014) mount$9p_fd(0x0, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000004500), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@ignoreqv}, {@access_any}, {@afid={'afid', 0x3d, 0x8}}]}}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r7) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) r10 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x11, r10, 0x147a5000) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x20, r8, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@ETHTOOL_A_PRIVFLAGS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x91}, 0x40) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x3e) r11 = open(&(0x7f0000000080)='./file1\x00', 0x10b942, 0x1) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETTXFILTER(r12, 0x400454ca, &(0x7f0000000100)=ANY=[]) ioctl$SIOCGSTAMPNS(r7, 0x8907, &(0x7f0000000300)) sendfile(r11, r0, 0x0, 0x80000000) 18.89532ms ago: executing program 4 (id=1183): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 4 (id=1184): mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f00000000c0), 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB='max=00000000000000000000001,stats']) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_CREATE_OPEN(r0, &(0x7f0000000200)={0xa0, 0x0, r1, {{0x3, 0x1, 0xbc, 0x1, 0x8, 0x3e5c0532, {0x0, 0x4ac, 0x4, 0x0, 0x1, 0x83, 0x0, 0xffffffff, 0x4, 0x8000, 0xff, r2, r3, 0x2, 0xffff}}, {0x0, 0x4}}}, 0xa0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r5, 0x4010ae67, &(0x7f0000000000)={0x8080000, 0x1d000, 0x2}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000001040)=@newsa={0xf0, 0x10, 0x713, 0x14, 0x0, {{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x87}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4000000, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x35}, {0x0, 0x0, 0x5, 0x0, 0x0, 0x3fffffffffffe}, {0x2}, {0x1}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x44}}, 0xf0}, 0x1, 0xe}, 0x0) getgroups(0x5, &(0x7f0000000140)=[0x0, 0xee00, 0xee00, 0xee00, 0xffffffffffffffff]) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x102000, &(0x7f0000000280)={'trans=unix,', {[{@access_user}, {@access_uid={'access', 0x3d, r2}}, {@access_client}, {@fscache}, {@dfltgid={'dfltgid', 0x3d, r7}}], [{@smackfstransmute={'smackfstransmute', 0x3d, './binderfs\x00'}}, {@permit_directio}, {@obj_type={'obj_type', 0x3d, './binderfs\x00'}}, {@dont_appraise}, {@fscontext={'fscontext', 0x3d, 'system_u'}}, {@obj_type={'obj_type', 0x3d, 'binder\x00'}}]}}) kernel console output (not intermixed with test programs): tooth: hci0: command 0x1003 tx timeout [ 46.258488][ T328] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 46.308536][ T31] usb 3-1: new low-speed USB device number 7 using dummy_hcd [ 46.330752][ T31] usb 3-1: device descriptor read/8, error -71 [ 46.459535][ T31] usb 3-1: device descriptor read/8, error -71 [ 46.482150][ T901] overlayfs: conflicting lowerdir path [ 46.491012][ T305] Bluetooth: hci0: Frame reassembly failed (-84) [ 46.698581][ T31] usb 3-1: new low-speed USB device number 8 using dummy_hcd [ 46.725646][ T31] usb 3-1: device descriptor read/8, error -71 [ 46.859554][ T31] usb 3-1: device descriptor read/8, error -71 [ 46.968578][ T31] usb usb3-port1: unable to enumerate USB device [ 47.262760][ T914] rust_binder: Write failure EFAULT in pid:110 [ 47.392379][ T918] netlink: 'syz.0.181': attribute type 3 has an invalid length. [ 47.591819][ T923] rust_binder: 154: no such ref 2 [ 47.596882][ T925] rust_binder: 154: no such ref 2 [ 47.719726][ T943] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:160 [ 47.729838][ T945] 9pnet_fd: Insufficient options for proto=fd [ 47.836855][ T952] FAULT_INJECTION: forcing a failure. [ 47.836855][ T952] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 47.850365][ T952] CPU: 0 UID: 0 PID: 952 Comm: syz.3.191 Not tainted 6.12.30-syzkaller-g437e1d666d1d #0 a7e852bab5516ec71c4837645977b8b84c4f3040 [ 47.850397][ T952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 47.850415][ T952] Call Trace: [ 47.850421][ T952] [ 47.850429][ T952] __dump_stack+0x21/0x30 [ 47.850457][ T952] dump_stack_lvl+0x10c/0x190 [ 47.850478][ T952] ? __cfi_dump_stack_lvl+0x10/0x10 [ 47.850501][ T952] dump_stack+0x19/0x20 [ 47.850522][ T952] should_fail_ex+0x3d9/0x530 [ 47.850546][ T952] should_fail+0xf/0x20 [ 47.850566][ T952] should_fail_usercopy+0x1e/0x30 [ 47.850590][ T952] _copy_to_user+0x24/0xa0 [ 47.850616][ T952] simple_read_from_buffer+0xed/0x160 [ 47.850636][ T952] proc_fail_nth_read+0x19e/0x210 [ 47.850656][ T952] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 47.850677][ T952] ? bpf_lsm_file_permission+0xd/0x20 [ 47.850698][ T952] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 47.850718][ T952] vfs_read+0x278/0xb60 [ 47.850742][ T952] ? __cfi_vfs_read+0x10/0x10 [ 47.850764][ T952] ? __kasan_check_write+0x18/0x20 [ 47.850786][ T952] ? mutex_lock+0x92/0x1c0 [ 47.850810][ T952] ? __cfi_mutex_lock+0x10/0x10 [ 47.850834][ T952] ? __fget_files+0x2c5/0x340 [ 47.850858][ T952] ksys_read+0x141/0x250 [ 47.850881][ T952] ? __cfi_ksys_read+0x10/0x10 [ 47.850904][ T952] ? __kasan_check_write+0x18/0x20 [ 47.850925][ T952] ? __kasan_check_read+0x15/0x20 [ 47.850948][ T952] __x64_sys_read+0x7f/0x90 [ 47.850971][ T952] x64_sys_call+0x2638/0x2ee0 [ 47.850995][ T952] do_syscall_64+0x58/0xf0 [ 47.851015][ T952] ? clear_bhb_loop+0x50/0xa0 [ 47.851040][ T952] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 47.851063][ T952] RIP: 0033:0x7fbd8078d3bc [ 47.851087][ T952] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 47.851107][ T952] RSP: 002b:00007fbd816a8030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 47.851131][ T952] RAX: ffffffffffffffda RBX: 00007fbd809b5fa0 RCX: 00007fbd8078d3bc [ 47.851147][ T952] RDX: 000000000000000f RSI: 00007fbd816a80a0 RDI: 0000000000000003 [ 47.851160][ T952] RBP: 00007fbd816a8090 R08: 0000000000000000 R09: 0000000000000000 [ 47.851172][ T952] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 47.851185][ T952] R13: 0000000000000000 R14: 00007fbd809b5fa0 R15: 00007ffc9f151bf8 [ 47.851200][ T952] [ 48.163012][ T974] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:186 [ 48.163304][ T974] netlink: 'syz.3.197': attribute type 6 has an invalid length. [ 48.185242][ T36] kauditd_printk_skb: 10 callbacks suppressed [ 48.185258][ T36] audit: type=1400 audit(1753485388.750:295): avc: denied { bind } for pid=970 comm="syz.3.197" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 48.388485][ T31] usb 3-1: new low-speed USB device number 9 using dummy_hcd [ 48.475585][ T989] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.498485][ T328] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 48.498977][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 48.528094][ T990] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 48.528104][ T989] rust_binder: Error in use_page_slow: ESRCH [ 48.528116][ T989] rust_binder: use_range failure ESRCH [ 48.536338][ T990] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 48.542189][ T989] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 48.549424][ T990] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:129 [ 48.557058][ T989] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 48.565916][ T31] usb 3-1: unable to get BOS descriptor or descriptor too short [ 48.574144][ T989] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:129 [ 48.589830][ T31] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt [ 48.610235][ T31] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt [ 48.620356][ T31] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 48.636862][ T31] usb 3-1: string descriptor 0 read error: -22 [ 48.643245][ T31] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 48.652488][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.662503][ T973] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 48.672338][ T973] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 48.680546][ T31] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 48.814812][ T36] audit: type=1400 audit(1753485389.380:296): avc: denied { read } for pid=1015 comm="syz.1.212" name="/" dev="configfs" ino=2504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 48.837547][ T36] audit: type=1400 audit(1753485389.380:297): avc: denied { open } for pid=1015 comm="syz.1.212" path="/" dev="configfs" ino=2504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 48.842157][ T1016] rust_binder: Write failure EFAULT in pid:183 [ 48.859665][ T36] audit: type=1400 audit(1753485389.380:298): avc: denied { setattr } for pid=1015 comm="syz.1.212" path="/" dev="configfs" ino=2504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 48.892428][ T306] usb 3-1: USB disconnect, device number 9 [ 48.961492][ T1031] rust_binder: 189: no such ref 3 [ 48.982395][ T36] audit: type=1400 audit(1753485389.550:299): avc: denied { ioctl } for pid=1033 comm="syz.1.218" path="socket:[11660]" dev="sockfs" ino=11660 ioctlcmd=0x6686 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 48.982741][ T1034] rust_binder: 198: no such ref 3 [ 49.026159][ T36] audit: type=1400 audit(1753485389.590:300): avc: denied { mounton } for pid=1035 comm="syz.1.219" path="/syzcgroup/unified/syz1" dev="securityfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=dir permissive=1 [ 49.026205][ T1036] /dev/nbd1: Can't lookup blockdev [ 49.095838][ T1046] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 49.103862][ T1046] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 49.113172][ T1046] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 49.121502][ T1046] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 49.228795][ T36] audit: type=1400 audit(1753485389.800:301): avc: denied { read } for pid=1068 comm="syz.1.223" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 49.259509][ T36] audit: type=1400 audit(1753485389.800:302): avc: denied { open } for pid=1068 comm="syz.1.223" path="/64/file0/.pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 49.284455][ T36] audit: type=1400 audit(1753485389.800:303): avc: denied { ioctl } for pid=1068 comm="syz.1.223" path="/64/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x671e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 49.344159][ T1083] 9pnet_fd: Insufficient options for proto=fd [ 49.549374][ T36] audit: type=1400 audit(1753485390.120:304): avc: denied { append } for pid=1125 comm="syz.0.234" name="binder1" dev="binder" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 49.812611][ T1163] exFAT-fs (rnullb0): invalid boot record signature [ 49.819339][ T1163] exFAT-fs (rnullb0): failed to read boot sector [ 49.825736][ T1163] exFAT-fs (rnullb0): failed to recognize exfat type [ 49.833807][ T1163] exFAT-fs (rnullb0): invalid boot record signature [ 49.840510][ T1163] exFAT-fs (rnullb0): failed to read boot sector [ 49.846931][ T1163] exFAT-fs (rnullb0): failed to recognize exfat type [ 49.874043][ T1167] netlink: 'syz.1.242': attribute type 4 has an invalid length. [ 49.958528][ T788] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 50.088494][ T788] usb 4-1: device descriptor read/64, error -71 [ 50.099766][ T1189] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 50.248401][ T1207] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 50.248759][ T1207] rust_binder: Error while translating object. [ 50.255282][ T1207] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 50.261564][ T1207] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:260 [ 50.283936][ T1209] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 50.338510][ T788] usb 4-1: device descriptor read/64, error -71 [ 50.458191][ T1231] netlink: 4 bytes leftover after parsing attributes in process `syz.2.263'. [ 50.473525][ T1233] netlink: 4 bytes leftover after parsing attributes in process `syz.1.264'. [ 50.486576][ T1233] rust_binder: Write failure EFAULT in pid:273 [ 50.598474][ T788] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 50.738678][ T788] usb 4-1: device descriptor read/64, error -71 [ 50.944813][ T1273] 9pnet_fd: Insufficient options for proto=fd [ 50.978506][ T788] usb 4-1: device descriptor read/64, error -71 [ 51.050386][ T1279] netlink: 148 bytes leftover after parsing attributes in process `syz.1.279'. [ 51.088526][ T788] usb usb4-port1: attempt power cycle [ 51.198473][ T31] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 51.348466][ T31] usb 1-1: Using ep0 maxpacket: 16 [ 51.354998][ T31] usb 1-1: unable to get BOS descriptor or descriptor too short [ 51.363379][ T31] usb 1-1: config 1 has an invalid descriptor of length 176, skipping remainder of the config [ 51.373721][ T31] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 51.384656][ T31] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 51.393937][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.401945][ T31] usb 1-1: Product: syz [ 51.406106][ T31] usb 1-1: Manufacturer: syz [ 51.410712][ T31] usb 1-1: SerialNumber: syz [ 51.438496][ T788] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 51.459406][ T788] usb 4-1: device descriptor read/8, error -71 [ 51.589429][ T788] usb 4-1: device descriptor read/8, error -71 [ 51.705241][ T1287] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.725030][ T1287] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.757908][ T31] usb 1-1: invalid UAC_HEADER (v1) [ 51.765687][ T31] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 51.780404][ T31] usb 1-1: USB disconnect, device number 11 [ 51.797869][ T485] udevd[485]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 51.848482][ T788] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 51.871042][ T788] usb 4-1: device descriptor read/8, error -71 [ 51.908541][ T1297] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 51.999472][ T788] usb 4-1: device descriptor read/8, error -71 [ 52.038396][ T1309] block device autoloading is deprecated and will be removed. [ 52.064860][ T1309] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active [ 52.088481][ T1309] rust_binder: Write failure EINVAL in pid:282 [ 52.128618][ T788] usb usb4-port1: unable to enumerate USB device [ 52.151425][ T1313] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 52.204753][ T1314] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 52.223275][ T1314] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 52.223297][ T1314] rust_binder: Read failure Err(EFAULT) in pid:286 [ 52.741069][ T1317] SELinux: security_context_str_to_sid () failed with errno=-22 [ 52.771310][ T45] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 52.779720][ T45] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 52.791056][ T1322] usb usb8: usbfs: process 1322 (syz.0.292) did not claim interface 0 before use [ 52.838815][ T1323] fido_id[1323]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 52.912684][ T1336] netlink: 16 bytes leftover after parsing attributes in process `syz.2.296'. [ 53.029929][ T1347] netlink: 'syz.1.300': attribute type 4 has an invalid length. [ 53.037664][ T1347] netlink: 17 bytes leftover after parsing attributes in process `syz.1.300'. [ 53.108725][ T1352] veth0_vlan: entered allmulticast mode [ 53.126777][ T1357] binder: Bad value for 'stats' [ 53.131724][ T788] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 53.175359][ T1359] 9pnet_fd: Insufficient options for proto=fd [ 53.178470][ T306] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 53.223735][ T36] kauditd_printk_skb: 15 callbacks suppressed [ 53.223823][ T36] audit: type=1400 audit(1753485393.790:320): avc: denied { listen } for pid=1362 comm="syz.2.305" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 53.288743][ T1370] netlink: 'syz.2.307': attribute type 30 has an invalid length. [ 53.297148][ T788] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 128, changing to 11 [ 53.312774][ T788] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 53.322761][ T788] usb 4-1: New USB device found, idVendor=05ac, idProduct=024f, bcdDevice= 0.00 [ 53.328516][ T306] usb 1-1: device descriptor read/64, error -71 [ 53.332128][ T788] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.347825][ T788] usb 4-1: config 0 descriptor?? [ 53.438470][ T45] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 53.548474][ T70] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 53.553757][ T1319] netlink: 'syz.3.291': attribute type 40 has an invalid length. [ 53.570750][ T788] usbhid 4-1:0.0: can't add hid device: -71 [ 53.578469][ T306] usb 1-1: device descriptor read/64, error -71 [ 53.580713][ T788] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 53.594171][ T788] usb 4-1: USB disconnect, device number 12 [ 53.600275][ T45] usb 2-1: config 1 interface 0 altsetting 11 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 53.612248][ T45] usb 2-1: config 1 interface 0 altsetting 11 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 53.625393][ T45] usb 2-1: config 1 interface 0 has no altsetting 0 [ 53.633428][ T45] usb 2-1: New USB device found, idVendor=17ef, idProduct=60fe, bcdDevice= 0.40 [ 53.642483][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.650549][ T45] usb 2-1: Product: 뗉ṥ㳯ɏ᷃䰦蒔⭡뾕ሤ섍믦셗ێ蓉扄ᶆ鍔룂潸㼪퐰㐐⼒志柾锥ꡃ涝ݸ숕⃾咭ꙞὩ롅헋ݛ⯹炐樆餚୨狙붾╿廒闐¹뮰쿋ý㋇鍷╘ᢽ僆鮾ｫⴤ㳞ᘣ멽ᛡ祕䁒ધ鹶끣Н戺憪ሕ䶠［錜⟛嘡ᷥ苠鿁쉣츟㗏ȼ퀆덀媗♲牣咛鉴맱ᆳ纅荬陠雏饖譗놸寰므䓜པ髥娮똬殦뗋ᜡꇙ岒 [ 53.686453][ T45] usb 2-1: Manufacturer: ૫耐ꤾ癨뺸暚퇴頯뎑Ġ뽋렢 [ 53.693989][ T45] usb 2-1: SerialNumber: Ⰱ [ 53.699472][ T1361] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 53.708476][ T70] usb 3-1: Using ep0 maxpacket: 32 [ 53.714612][ T70] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 53.725539][ T70] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 53.735370][ T70] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 53.744429][ T70] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.752978][ T70] usb 3-1: config 0 descriptor?? [ 53.828513][ T306] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 53.908615][ T788] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 53.918721][ T45] usbhid 2-1:1.0: can't add hid device: -71 [ 53.924656][ T45] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 53.933452][ T45] usb 2-1: USB disconnect, device number 4 [ 53.958477][ T306] usb 1-1: device descriptor read/64, error -71 [ 54.048489][ T788] usb 4-1: device descriptor read/64, error -71 [ 54.166006][ T1370] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 54.166039][ T1370] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:255 [ 54.177508][ T70] usbhid 3-1:0.0: can't add hid device: -71 [ 54.192680][ T70] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 54.198486][ T306] usb 1-1: device descriptor read/64, error -71 [ 54.201702][ T70] usb 3-1: USB disconnect, device number 10 [ 54.288560][ T788] usb 4-1: device descriptor read/64, error -71 [ 54.318568][ T306] usb usb1-port1: attempt power cycle [ 54.424142][ T1376] devpts: called with bogus options [ 54.528578][ T788] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 54.658488][ T306] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 54.658488][ T788] usb 4-1: device descriptor read/64, error -71 [ 54.678495][ T70] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 54.699462][ T306] usb 1-1: device descriptor read/8, error -71 [ 54.829500][ T306] usb 1-1: device descriptor read/8, error -71 [ 54.829556][ T70] usb 2-1: config 1 interface 0 altsetting 5 bulk endpoint 0x1 has invalid maxpacket 1024 [ 54.845704][ T70] usb 2-1: config 1 interface 0 altsetting 5 bulk endpoint 0x82 has invalid maxpacket 8 [ 54.855557][ T70] usb 2-1: config 1 interface 0 has no altsetting 0 [ 54.863543][ T70] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 54.872601][ T70] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.880594][ T70] usb 2-1: Product: Ъ [ 54.884659][ T70] usb 2-1: Manufacturer: 《 [ 54.889343][ T70] usb 2-1: SerialNumber: ᬗ⭫熊⋬址풚즭ꭜῺ⦳창抡疠폀藿⧺ᢊὖ⳿헳⊈ɭ᫕끮롑✑鼤跖풼ѡ࡬暴ٍ牣륋ᄂ瘜ב뙮Ǥെ৵랩»ꕤᡊ [ 54.907277][ T1378] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 54.908477][ T788] usb 4-1: device descriptor read/64, error -71 [ 54.914795][ T1378] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 55.028603][ T788] usb usb4-port1: attempt power cycle [ 55.068485][ T306] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 55.089531][ T306] usb 1-1: device descriptor read/8, error -71 [ 55.128178][ T1378] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.135848][ T1382] rust_binder: 307: no such ref 3 [ 55.143817][ T70] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 5 if 0 alt 5 proto 1 vid 0x0525 pid 0xA4A8 [ 55.157641][ T70] usb 2-1: USB disconnect, device number 5 [ 55.164225][ T70] usblp0: removed [ 55.229745][ T306] usb 1-1: device descriptor read/8, error -71 [ 55.338564][ T306] usb usb1-port1: unable to enumerate USB device [ 55.368525][ T788] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 55.389572][ T788] usb 4-1: device descriptor read/8, error -71 [ 55.519475][ T788] usb 4-1: device descriptor read/8, error -71 [ 55.545676][ T1384] netlink: 'syz.2.312': attribute type 27 has an invalid length. [ 55.560305][ T1384] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.567486][ T1384] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.588213][ T1384] veth0_vlan: left allmulticast mode [ 55.656301][ T1388] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.657072][ T36] audit: type=1400 audit(1753485396.220:321): avc: denied { setopt } for pid=1386 comm="syz.1.313" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 55.758499][ T788] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 55.779404][ T788] usb 4-1: device descriptor read/8, error -71 [ 55.838468][ T306] usb 3-1: new low-speed USB device number 11 using dummy_hcd [ 55.909524][ T788] usb 4-1: device descriptor read/8, error -71 [ 55.938513][ T70] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 55.989480][ T306] usb 3-1: config 0 has an invalid interface number: 255 but max is 0 [ 55.997685][ T306] usb 3-1: config 0 has no interface number 0 [ 56.003825][ T306] usb 3-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 56.015004][ T306] usb 3-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 56.028612][ T788] usb usb4-port1: unable to enumerate USB device [ 56.028815][ T306] usb 3-1: config 0 interface 255 has no altsetting 0 [ 56.041773][ T306] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 56.050843][ T306] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 56.060083][ T306] usb 3-1: config 0 descriptor?? [ 56.089527][ T70] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 56.101842][ T70] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 56.112914][ T70] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 56.122905][ T70] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 56.138387][ T70] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 56.147663][ T70] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 56.159681][ T70] usb 2-1: config 0 descriptor?? [ 56.988511][ T414] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 57.026395][ T70] plantronics 0003:047F:FFFF.0003: ignoring exceeding usage max [ 57.036929][ T70] plantronics 0003:047F:FFFF.0003: item fetching failed at offset 10/15 [ 57.045722][ T70] plantronics 0003:047F:FFFF.0003: parse failed [ 57.052040][ T70] plantronics 0003:047F:FFFF.0003: probe with driver plantronics failed with error -22 [ 57.093521][ T1422] rust_binder: Failed copying remainder into alloc: EFAULT [ 57.093551][ T1422] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 57.101027][ T1422] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 57.109310][ T1422] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:250 [ 57.136190][ T36] audit: type=1400 audit(1753485397.700:322): avc: denied { execute } for pid=1425 comm="syz.0.327" path="/dev/ashmem" dev="devtmpfs" ino=201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 57.159322][ T414] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 57.179981][ T414] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 57.196785][ T414] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 57.205935][ T414] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.281285][ T1384] loop9: detected capacity change from 0 to 1 [ 57.287712][ T1384] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.295693][ T1384] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.303672][ T1384] loop9: unable to read partition table [ 57.309497][ T1384] loop_reread_partitions: partition scan of loop9 (被xڬdGݡ [ 57.309497][ T1384] ) failed (rc=-5) [ 57.312022][ T485] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.324566][ T36] audit: type=1400 audit(1753485397.890:323): avc: denied { map } for pid=1383 comm="syz.2.312" path="socket:[13290]" dev="sockfs" ino=13290 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 57.331010][ T485] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.357279][ T1448] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:275 [ 57.361726][ T306] asix 3-1:0.255 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 57.363048][ T485] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.376612][ T306] asix 3-1:0.255 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 57.386199][ T485] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.393129][ T1450] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 57.399836][ T485] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.407172][ T9] rust_binder: 0: removing orphan mapping 0:1024 [ 57.415805][ T485] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.423256][ T306] asix 3-1:0.255: probe with driver asix failed with error -71 [ 57.430181][ T485] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.440491][ T306] usb 3-1: USB disconnect, device number 11 [ 57.447654][ T485] Buffer I/O error on dev loop9, logical block 0, async page read [ 57.455750][ T1450] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 57.458979][ T36] audit: type=1400 audit(1753485398.020:324): avc: denied { read } for pid=1449 comm="syz.0.334" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 57.512872][ T36] audit: type=1400 audit(1753485398.080:325): avc: denied { mount } for pid=1452 comm="syz.0.335" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 57.541040][ T1458] rust_binder: 286: no such ref 2 [ 57.546176][ T1458] rust_binder: Write failure EFAULT in pid:286 [ 57.608514][ T1462] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 57.617895][ T9] rust_binder: 1460: removing orphan mapping 0:1048 [ 57.639378][ T414] aiptek 4-1:17.0: Aiptek using 400 ms programming speed [ 57.646816][ T414] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:17.0/input/input10 [ 57.659941][ T414] usb 4-1: USB disconnect, device number 17 [ 57.868484][ T9] usb 1-1: new low-speed USB device number 16 using dummy_hcd [ 58.018478][ T9] usb 1-1: Invalid ep0 maxpacket: 64 [ 58.149012][ T9] usb 1-1: new low-speed USB device number 17 using dummy_hcd [ 58.195213][ T1487] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 58.207380][ T36] audit: type=1400 audit(1753485398.763:326): avc: denied { remount } for pid=1486 comm="syz.3.345" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 58.227415][ T1487] binder: Unknown parameter '0x0000000000000000' [ 58.318482][ T9] usb 1-1: Invalid ep0 maxpacket: 64 [ 58.320383][ T36] audit: type=1326 audit(1753485398.883:327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1489 comm="syz.3.346" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fbd8078e9a9 code=0x0 [ 58.328671][ T9] usb usb1-port1: attempt power cycle [ 58.397923][ T1491] rust_binder: 278: no such ref 1 [ 58.406719][ T1491] rust_binder: 278: no such ref 2 [ 58.502479][ T1493] rust_binder: 1492 RLIMIT_NICE not set [ 58.688473][ T9] usb 1-1: new low-speed USB device number 18 using dummy_hcd [ 58.707250][ T70] usb 2-1: USB disconnect, device number 6 [ 58.728810][ T9] usb 1-1: Invalid ep0 maxpacket: 64 [ 58.858492][ T9] usb 1-1: new low-speed USB device number 19 using dummy_hcd [ 58.904302][ T9] usb 1-1: Invalid ep0 maxpacket: 64 [ 58.916661][ T9] usb usb1-port1: unable to enumerate USB device [ 58.940471][ T36] audit: type=1400 audit(1753485399.503:328): avc: denied { connect } for pid=1504 comm="syz.2.350" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 59.138488][ T70] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 59.157276][ T9] rust_binder: 1489: removing orphan mapping 0:1048 [ 59.174428][ T1521] rust_binder: 283: no such ref 3 [ 59.289556][ T70] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 59.301819][ T70] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 56, changing to 9 [ 59.312972][ T70] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 17310, setting to 1024 [ 59.324286][ T70] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 59.337365][ T70] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 59.346512][ T70] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 59.355809][ T70] usb 2-1: config 0 descriptor?? [ 59.383256][ T1532] capability: warning: `syz.3.358' uses 32-bit capabilities (legacy support in use) [ 59.514543][ T36] audit: type=1400 audit(1753485400.073:329): avc: denied { write } for pid=1541 comm="syz.3.360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 59.551056][ T1547] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 59.568483][ T1547] rust_binder: inc_ref_done called when no active inc_refs [ 59.696453][ T36] audit: type=1400 audit(1753485400.253:330): avc: denied { setattr } for pid=1560 comm="syz.3.365" path="/dev/kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 59.779903][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.790965][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.798907][ T1563] /dev/rnullb0: Can't open blockdev [ 59.804225][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.811834][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.819609][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.832435][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.840114][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.847811][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.856699][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.864978][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.872514][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.880028][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.887508][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.895065][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.895239][ T1565] fuse: Bad value for 'group_id' [ 59.902567][ T70] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 59.915147][ T70] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 59.917867][ T1565] fuse: Bad value for 'group_id' [ 59.927842][ T70] plantronics 0003:047F:FFFF.0004: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 60.241495][ T36] audit: type=1400 audit(1753485400.803:331): avc: denied { ioctl } for pid=1575 comm="syz.2.370" path="/dev/usbmon0" dev="devtmpfs" ino=87 ioctlcmd=0x920a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 60.316512][ T1577] netlink: 'syz.2.370': attribute type 27 has an invalid length. [ 60.502631][ T1584] netlink: 16 bytes leftover after parsing attributes in process `syz.2.372'. [ 60.601045][ T305] Bluetooth: hci0: Frame reassembly failed (-84) [ 60.735257][ T36] audit: type=1400 audit(1753485401.293:332): avc: denied { getopt } for pid=1587 comm="syz.0.373" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 60.736016][ T1588] 9pnet_fd: Insufficient options for proto=fd [ 62.128473][ T9] usb 2-1: reset high-speed USB device number 7 using dummy_hcd [ 62.136196][ T306] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 62.268543][ T9] usb 2-1: device descriptor read/64, error -71 [ 62.289805][ T306] usb 3-1: unable to get BOS descriptor or descriptor too short [ 62.297801][ T306] usb 3-1: not running at top speed; connect to a high speed hub [ 62.306291][ T306] usb 3-1: config 13 has an invalid interface number: 90 but max is 0 [ 62.314486][ T306] usb 3-1: config 13 has no interface number 0 [ 62.320679][ T306] usb 3-1: config 13 interface 90 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 62.333664][ T306] usb 3-1: New USB device found, idVendor=0499, idProduct=100d, bcdDevice=81.b7 [ 62.342727][ T306] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 62.350822][ T306] usb 3-1: Product: syz [ 62.354993][ T306] usb 3-1: Manufacturer: syz [ 62.359628][ T306] usb 3-1: SerialNumber: syz [ 62.508489][ T9] usb 2-1: device descriptor read/64, error -71 [ 62.568517][ T1606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 62.577687][ T1606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 62.637225][ T1610] rust_binder: 1606 RLIMIT_NICE not set [ 62.642562][ T306] usb 3-1: USB disconnect, device number 12 [ 62.658749][ T53] Bluetooth: hci0: command 0x1003 tx timeout [ 62.662288][ T308] udevd[308]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:13.90/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 62.664761][ T328] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 62.749450][ T9] usb 2-1: reset high-speed USB device number 7 using dummy_hcd [ 62.810055][ T1545] Bluetooth: hci0: Frame reassembly failed (-84) [ 62.817502][ T1612] fuse: Bad value for 'rootmode' [ 62.878460][ T9] usb 2-1: device descriptor read/64, error -71 [ 63.119551][ T9] usb 2-1: device descriptor read/64, error -71 [ 63.149203][ T306] rust_binder: 1605: removing orphan mapping 0:1048 [ 63.240377][ T1624] netlink: 16 bytes leftover after parsing attributes in process `syz.2.383'. [ 63.313809][ T306] rust_binder: 1625: removing orphan mapping 0:1048 [ 63.330003][ T1629] netlink: 'syz.2.385': attribute type 4 has an invalid length. [ 63.368510][ T9] usb 2-1: reset high-speed USB device number 7 using dummy_hcd [ 63.399477][ T9] usb 2-1: device descriptor read/8, error -71 [ 63.529517][ T9] usb 2-1: device descriptor read/8, error -71 [ 63.618472][ T306] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 63.768550][ T9] usb 2-1: reset high-speed USB device number 7 using dummy_hcd [ 63.777111][ T306] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 63.788064][ T306] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 63.797872][ T306] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 63.806950][ T306] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 63.815652][ T9] usb 2-1: device descriptor read/8, error -71 [ 63.821961][ T306] usb 3-1: config 0 descriptor?? [ 63.949464][ T9] usb 2-1: device descriptor read/8, error -71 [ 64.058665][ T414] usb 2-1: USB disconnect, device number 7 [ 64.160495][ T1639] bridge0: entered allmulticast mode [ 64.198467][ T414] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 64.328517][ T414] usb 2-1: device descriptor read/64, error -71 [ 64.408501][ T9] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 64.429477][ T1633] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 64.437964][ T1633] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 64.559787][ T9] usb 1-1: not running at top speed; connect to a high speed hub [ 64.568199][ T9] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 64.576979][ T414] usb 2-1: device descriptor read/64, error -71 [ 64.583257][ T9] usb 1-1: config 1 has an invalid descriptor of length 143, skipping remainder of the config [ 64.593606][ T9] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 64.603891][ T9] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 64.612968][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 64.621018][ T9] usb 1-1: Product: syz [ 64.625168][ T9] usb 1-1: Manufacturer: ꁾ衤豯乥וּ镧蠦स⵲䧹᫄鏆顉ᯕ綑흽䵠㏡Ċ广囂풂겸䟱ꅸ䘀஀䟶ⓦꄽ凖쉁餉闗瘭흵巢≌텷ᛌﴳ鹧䔶벂逄罞啧㗾礓茣貫怞佤젞ẫ埕ٵ㣇훟찯◙꫰ﳸ眠纔神៸错끧蚛䙹ᔗ밎洰蒤䁀踟ႚ䦖籛뒃熃⤈៝쌲Ề [ 64.654391][ T9] usb 1-1: SerialNumber: syz [ 64.677462][ T1647] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 64.678285][ T1647] rust_binder: Error while translating object. [ 64.684763][ T1647] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 64.691003][ T1647] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:325 [ 64.758298][ T36] audit: type=1400 audit(1753485405.313:333): avc: denied { nlmsg_read } for pid=1652 comm="syz.1.394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 64.758653][ T1654] netlink: 104 bytes leftover after parsing attributes in process `syz.1.394'. [ 64.778660][ T1655] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 64.788216][ T1653] netlink: 104 bytes leftover after parsing attributes in process `syz.1.394'. [ 64.828501][ T328] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 65.078128][ T36] audit: type=1400 audit(1753485405.633:334): avc: denied { ioctl } for pid=1671 comm="syz.3.398" path="socket:[15786]" dev="sockfs" ino=15786 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 65.637079][ T1675] binder: Unknown parameter 'defcontext01777777777777777777777' [ 65.731362][ T414] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 65.744134][ T414] hid-generic 0000:0000:0000.0006: hidraw0: HID v0.00 Device [syz1] on syz0 [ 65.759611][ T1677] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 66.058675][ T1693] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 66.110888][ T36] audit: type=1400 audit(1753485406.673:335): avc: denied { mounton } for pid=1692 comm="syz.3.405" path="/dev/binderfs/binder0" dev="binder" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 66.115367][ T1694] rust_binder: Write failure EFAULT in pid:364 [ 66.156934][ T1698] binder: Unknown parameter 'obj_role' [ 66.331900][ T1713] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 66.332310][ T1713] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:347 [ 66.406378][ T1720] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 66.450797][ T306] usb 3-1: string descriptor 0 read error: -71 [ 66.457650][ T306] uclogic 0003:256C:006D.0005: failed retrieving string descriptor #200: -71 [ 66.466685][ T306] uclogic 0003:256C:006D.0005: failed retrieving pen parameters: -71 [ 66.474909][ T306] uclogic 0003:256C:006D.0005: failed probing pen v2 parameters: -71 [ 66.483123][ T306] uclogic 0003:256C:006D.0005: failed probing parameters: -71 [ 66.491071][ T306] uclogic 0003:256C:006D.0005: probe with driver uclogic failed with error -71 [ 66.504732][ T306] usb 3-1: USB disconnect, device number 13 [ 66.515065][ T1727] rust_binder: Write failure EFAULT in pid:347 [ 66.515923][ T1727] process 'syz.2.415' launched './file1' with NULL argv: empty string added [ 66.530993][ T36] audit: type=1400 audit(1753485407.093:336): avc: denied { execute_no_trans } for pid=1726 comm="syz.2.415" path="/101/file1" dev="tmpfs" ino=581 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 66.625166][ T1733] rust_binder: 353: no such ref 2 [ 66.630427][ T1733] rust_binder: Write failure EFAULT in pid:353 [ 66.938495][ T70] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 67.078496][ T70] usb 3-1: device descriptor read/64, error -71 [ 67.129027][ T306] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 67.147002][ T306] hid-generic 0000:0000:0000.0007: hidraw0: HID v0.00 Device [syz1] on syz0 [ 67.189448][ T9] usb 1-1: 0:2 : does not exist [ 67.199184][ T9] usb 1-1: USB disconnect, device number 20 [ 67.219394][ T485] udevd[485]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 67.236132][ T1751] syz.0.424: attempt to access beyond end of device [ 67.236132][ T1751] loop0: rw=4096, sector=2, nr_sectors = 2 limit=0 [ 67.255197][ T1751] EXT4-fs (loop0): unable to read superblock [ 67.318478][ T70] usb 3-1: device descriptor read/64, error -71 [ 67.356477][ T1759] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:331 [ 67.356561][ T1759] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:331 [ 67.412182][ T36] audit: type=1400 audit(1753485407.973:337): avc: denied { mounton } for pid=1764 comm="syz.1.429" path="/proc/355/task" dev="proc" ino=16249 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 67.549730][ T1772] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 67.591511][ T70] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 67.608788][ T1774] exFAT-fs (rnullb0): invalid boot record signature [ 67.620135][ T1774] exFAT-fs (rnullb0): failed to read boot sector [ 67.633688][ T1774] exFAT-fs (rnullb0): failed to recognize exfat type [ 67.748504][ T70] usb 3-1: device descriptor read/64, error -71 [ 67.792082][ T36] audit: type=1326 audit(1753485408.353:338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1784 comm="syz.1.434" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3f9ad8e9a9 code=0x0 [ 67.838661][ T36] audit: type=1326 audit(1753485408.373:339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1784 comm="syz.1.434" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3f9ad8e9a9 code=0x0 [ 67.917382][ T1787] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 67.937616][ T36] audit: type=1400 audit(1753485408.493:340): avc: denied { create } for pid=1789 comm="syz.1.435" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 68.018528][ T70] usb 3-1: device descriptor read/64, error -71 [ 68.024214][ T1794] bpf: Bad value for 'mode' [ 68.074121][ T36] audit: type=1400 audit(1753485408.633:341): avc: denied { getopt } for pid=1798 comm="syz.1.439" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 68.107968][ T36] audit: type=1400 audit(1753485408.663:342): avc: denied { setopt } for pid=1800 comm="syz.1.440" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 68.130373][ T70] usb usb3-port1: attempt power cycle [ 68.139025][ T1804] netlink: 8 bytes leftover after parsing attributes in process `syz.1.441'. [ 68.232604][ T1812] netlink: 12 bytes leftover after parsing attributes in process `syz.3.443'. [ 68.468489][ T70] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 68.478492][ T788] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 68.489453][ T70] usb 3-1: device descriptor read/8, error -71 [ 68.619496][ T70] usb 3-1: device descriptor read/8, error -71 [ 68.628480][ T788] usb 4-1: Using ep0 maxpacket: 16 [ 68.634853][ T788] usb 4-1: unable to get BOS descriptor or descriptor too short [ 68.643232][ T788] usb 4-1: config 13 has an invalid interface number: 50 but max is 0 [ 68.651399][ T788] usb 4-1: config 13 has no interface number 0 [ 68.657567][ T788] usb 4-1: config 13 interface 50 altsetting 167 bulk endpoint 0x8 has invalid maxpacket 16 [ 68.667689][ T788] usb 4-1: config 13 interface 50 has no altsetting 0 [ 68.676333][ T788] usb 4-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 68.685401][ T788] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.693403][ T788] usb 4-1: Product: syz [ 68.697553][ T788] usb 4-1: Manufacturer: syz [ 68.702149][ T788] usb 4-1: SerialNumber: syz [ 68.708813][ T1812] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 68.868488][ T70] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 68.889424][ T70] usb 3-1: device descriptor read/8, error -71 [ 68.919876][ T788] usb 4-1: MIDIStreaming interface descriptor not found [ 68.929468][ T788] usb 4-1: USB disconnect, device number 18 [ 69.019587][ T70] usb 3-1: device descriptor read/8, error -71 [ 69.116002][ T1818] binder: Unknown parameter 'context' [ 69.128654][ T70] usb usb3-port1: unable to enumerate USB device [ 69.285643][ T1825] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 69.475101][ T1839] rust_binder: Error while translating object. [ 69.475137][ T1839] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 69.481386][ T1839] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:415 [ 69.585099][ T1849] fuse: Bad value for 'user_id' [ 69.599150][ T1849] fuse: Bad value for 'user_id' [ 69.873522][ T36] kauditd_printk_skb: 4 callbacks suppressed [ 69.873539][ T36] audit: type=1326 audit(1753485410.433:347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1868 comm="syz.2.460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a0118e9a9 code=0x7ffc0000 [ 69.902815][ T36] audit: type=1326 audit(1753485410.433:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1868 comm="syz.2.460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a0118e9a9 code=0x7ffc0000 [ 69.927861][ T36] audit: type=1326 audit(1753485410.473:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1868 comm="syz.2.460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a0118e9a9 code=0x7ffc0000 [ 69.952154][ T36] audit: type=1326 audit(1753485410.473:350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1868 comm="syz.2.460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a0118e9a9 code=0x7ffc0000 [ 69.975446][ T36] audit: type=1326 audit(1753485410.473:351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1868 comm="syz.2.460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a0118e9a9 code=0x7ffc0000 [ 69.998696][ T36] audit: type=1326 audit(1753485410.473:352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1868 comm="syz.2.460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a0118e9a9 code=0x7ffc0000 [ 70.021986][ T36] audit: type=1326 audit(1753485410.473:353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1868 comm="syz.2.460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a0118e9a9 code=0x7ffc0000 [ 70.045388][ T36] audit: type=1326 audit(1753485410.473:354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1868 comm="syz.2.460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a0118e9a9 code=0x7ffc0000 [ 70.068640][ T36] audit: type=1326 audit(1753485410.473:355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1868 comm="syz.2.460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a0118e9a9 code=0x7ffc0000 [ 70.092038][ T36] audit: type=1326 audit(1753485410.473:356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1868 comm="syz.2.460" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9a0118e9a9 code=0x7ffc0000 [ 70.351265][ T1891] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 70.351345][ T1892] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 70.358285][ T1891] rust_binder: Error while translating object. [ 70.365452][ T1891] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 70.371959][ T1891] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:421 [ 70.399689][ T1887] binder: Bad value for 'max' [ 70.717899][ T1917] binder: Unknown parameter '1j"w϶2sVͶcU +r˳j`UT#[AW _GڷFEVVR [ 70.717899][ T1917] BGqxΠ?z/%p] X]uIR$XӮx:#TT).GXKl+?/^72q' [ 70.775844][ T1926] tap0: tun_chr_ioctl cmd 1074025678 [ 70.803210][ T1926] tap0: group set to 0 [ 70.828671][ T1926] tap0: tun_chr_ioctl cmd 1074025675 [ 70.839583][ T1926] tap0: persist disabled [ 70.863387][ T1933] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 70.864178][ T1933] rust_binder: Write failure EFAULT in pid:433 [ 70.916533][ T1937] __vm_enough_memory: pid: 1937, comm: syz.0.475, bytes: 18014402804453376 not enough memory for the allocation [ 71.440508][ T1946] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 71.538610][ T1953] x_tables: duplicate entry at hook 2 [ 71.664588][ T1958] /dev/rnullb0: Can't open blockdev [ 71.682071][ T1960] fuse: Unknown parameter '' [ 71.700733][ T1960] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:347 [ 72.087790][ T1980] netlink: 112 bytes leftover after parsing attributes in process `syz.1.492'. [ 72.106828][ T1980] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 72.106861][ T1980] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:452 [ 72.117847][ T1980] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 72.127683][ T1980] rust_binder: Read failure Err(EFAULT) in pid:452 [ 72.272207][ T1991] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 72.290023][ T1994] netlink: 'syz.2.497': attribute type 4 has an invalid length. [ 72.320743][ T1994] rust_binder: Write failure EFAULT in pid:434 [ 72.419288][ T2008] netlink: 'syz.2.502': attribute type 12 has an invalid length. [ 72.524406][ T2030] binder: Unknown parameter 'D' [ 72.546778][ T2032] /dev/rnullb0: Can't open blockdev [ 72.552903][ T2033] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 72.554658][ T2033] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 72.568458][ T2033] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 72.576469][ T2033] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:465 [ 72.604392][ T2037] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 72.700636][ T2040] rust_binder: Write failure EFAULT in pid:376 [ 73.309054][ T2069] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=2069 comm=syz.3.522 [ 73.361076][ T2075] /dev/rnullb0: Can't open blockdev [ 73.447805][ T2089] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 73.800620][ T2106] binder: Unknown parameter 'fscontext?}' [ 73.842918][ T2108] rust_binder: Got transaction with invalid offset. [ 73.842956][ T2108] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 73.849962][ T2108] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:457 [ 73.873108][ T2098] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 73.884093][ T2098] rust_binder: Read failure Err(EFAULT) in pid:385 [ 73.896062][ T2115] netlink: 88 bytes leftover after parsing attributes in process `syz.2.537'. [ 73.952019][ T2122] rust_binder: Failed to vm_insert_page(35184388853760): vma_addr:35184388849664 i:1 err:EFAULT [ 73.952053][ T2122] rust_binder: Error in use_page_slow: EFAULT [ 73.962716][ T2122] rust_binder: use_range failure EFAULT [ 73.968968][ T2122] rust_binder: Failed to allocate buffer. len:4104, is_oneway:true [ 73.974585][ T2122] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 73.994259][ T2122] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:388 [ 74.031592][ T2133] tap0: tun_chr_ioctl cmd 1074025675 [ 74.051237][ T2133] tap0: persist enabled [ 74.068492][ T2133] tap0: tun_chr_ioctl cmd 1074025675 [ 74.073930][ T2133] tap0: persist enabled [ 74.107602][ T305] bridge_slave_1: left allmulticast mode [ 74.118467][ T305] bridge_slave_1: left promiscuous mode [ 74.124339][ T305] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.148895][ T305] bridge_slave_0: left allmulticast mode [ 74.154560][ T305] bridge_slave_0: left promiscuous mode [ 74.168370][ T305] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.342810][ T788] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 74.395906][ T2142] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.408458][ T2142] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.415571][ T2142] bridge_slave_0: entered allmulticast mode [ 74.421987][ T2142] bridge_slave_0: entered promiscuous mode [ 74.428936][ T2142] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.435968][ T2142] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.443111][ T2142] bridge_slave_1: entered allmulticast mode [ 74.449416][ T2142] bridge_slave_1: entered promiscuous mode [ 74.509546][ T788] usb 1-1: Using ep0 maxpacket: 8 [ 74.519930][ T788] usb 1-1: config 0 has an invalid interface number: 31 but max is 0 [ 74.532215][ T2142] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.539298][ T2142] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.546564][ T2142] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.553609][ T2142] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.560913][ T788] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 74.578672][ T788] usb 1-1: config 0 has no interface number 0 [ 74.586439][ T788] usb 1-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 74.596678][ T788] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.613140][ T788] usb 1-1: Product: syz [ 74.614740][ T2142] veth0_vlan: entered promiscuous mode [ 74.617325][ T788] usb 1-1: Manufacturer: syz [ 74.631109][ T2142] veth1_macvtap: entered promiscuous mode [ 74.635367][ T788] usb 1-1: SerialNumber: syz [ 74.642086][ T70] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 74.652371][ T788] usb 1-1: config 0 descriptor?? [ 74.748116][ T2159] rust_binder: Error in use_page_slow: ESRCH [ 74.748137][ T2159] rust_binder: use_range failure ESRCH [ 74.754230][ T2159] rust_binder: Failed to allocate buffer. len:64, is_oneway:false [ 74.759744][ T2159] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 74.767640][ T2159] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:493 [ 74.778589][ T70] usb 2-1: device descriptor read/64, error -71 [ 74.862396][ T9] usb 1-1: USB disconnect, device number 21 [ 74.928507][ T788] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 75.028496][ T70] usb 2-1: device descriptor read/64, error -71 [ 75.089521][ T788] usb 5-1: descriptor type invalid, skip [ 75.095488][ T788] usb 5-1: not running at top speed; connect to a high speed hub [ 75.103967][ T788] usb 5-1: config 0 has no interfaces? [ 75.110808][ T788] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 75.119889][ T788] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.128001][ T788] usb 5-1: Product: syz [ 75.132224][ T788] usb 5-1: Manufacturer: syz [ 75.136805][ T788] usb 5-1: SerialNumber: syz [ 75.142297][ T788] usb 5-1: config 0 descriptor?? [ 75.268555][ T70] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 75.347850][ T2154] __vm_enough_memory: pid: 2154, comm: syz.4.547, bytes: 18014402804453376 not enough memory for the allocation [ 75.360541][ T9] usb 5-1: USB disconnect, device number 2 [ 75.398527][ T70] usb 2-1: device descriptor read/64, error -71 [ 75.476870][ T2174] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:400 [ 75.484069][ T2176] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:402 [ 75.638532][ T70] usb 2-1: device descriptor read/64, error -71 [ 75.746938][ T36] kauditd_printk_skb: 82 callbacks suppressed [ 75.746965][ T36] audit: type=1400 audit(1753485416.303:439): avc: denied { nlmsg_read } for pid=2183 comm="syz.3.561" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 75.773639][ T70] usb usb2-port1: attempt power cycle [ 76.118518][ T70] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 76.126148][ T788] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 76.149539][ T70] usb 2-1: device descriptor read/8, error -71 [ 76.280558][ T788] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 76.290311][ T70] usb 2-1: device descriptor read/8, error -71 [ 76.296677][ T788] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 76.306744][ T788] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 76.322207][ T788] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 76.331682][ T788] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.340304][ T788] usb 5-1: Product: syz [ 76.344609][ T788] usb 5-1: Manufacturer: syz [ 76.350111][ T788] usb 5-1: SerialNumber: syz [ 76.356819][ T788] hub 5-1:1.0: bad descriptor, ignoring hub [ 76.362950][ T788] hub 5-1:1.0: probe with driver hub failed with error -5 [ 76.500273][ T2197] netlink: 4 bytes leftover after parsing attributes in process `syz.3.566'. [ 76.509161][ T2197] bridge_slave_1: left allmulticast mode [ 76.514865][ T2197] bridge_slave_1: left promiscuous mode [ 76.520684][ T2197] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.528322][ T2197] bridge_slave_0: left allmulticast mode [ 76.534156][ T2197] bridge_slave_0: left promiscuous mode [ 76.539880][ T2197] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.548632][ T70] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 76.558139][ T788] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 76.571665][ T70] usb 2-1: device descriptor read/8, error -71 [ 76.689207][ T2200] Restarting kernel threads ... [ 76.689208][ T36] audit: type=1400 audit(1753485417.253:440): avc: denied { ioctl } for pid=2199 comm="syz.3.567" path="/dev/snapshot" dev="devtmpfs" ino=21 ioctlcmd=0x3305 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 76.694305][ T2200] done. [ 76.719974][ T70] usb 2-1: device descriptor read/8, error -71 [ 76.727787][ T36] audit: type=1400 audit(1753485417.283:441): avc: denied { accept } for pid=2199 comm="syz.3.567" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 76.758466][ T36] audit: type=1400 audit(1753485417.313:442): avc: denied { mount } for pid=2201 comm="syz.3.568" name="/" dev="pstore" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=filesystem permissive=1 [ 76.761220][ T2189] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.789258][ T2189] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.802999][ T36] audit: type=1400 audit(1753485417.363:443): avc: denied { read write } for pid=2188 comm="syz.4.563" name="lp0" dev="devtmpfs" ino=525 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 76.825177][ T2209] 9pnet_fd: Insufficient options for proto=fd [ 76.826461][ T36] audit: type=1400 audit(1753485417.363:444): avc: denied { open } for pid=2188 comm="syz.4.563" path="/dev/usb/lp0" dev="devtmpfs" ino=525 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 76.856556][ T70] usb usb2-port1: unable to enumerate USB device [ 76.860177][ T2211] netlink: 44 bytes leftover after parsing attributes in process `syz.3.571'. [ 76.872450][ T2211] netlink: 43 bytes leftover after parsing attributes in process `syz.3.571'. [ 76.881339][ T2211] netlink: 'syz.3.571': attribute type 6 has an invalid length. [ 76.889097][ T2211] netlink: 'syz.3.571': attribute type 5 has an invalid length. [ 76.896711][ T2211] netlink: 43 bytes leftover after parsing attributes in process `syz.3.571'. [ 77.072672][ T2212] exFAT-fs (rnullb0): invalid boot record signature [ 77.079324][ T2212] exFAT-fs (rnullb0): failed to read boot sector [ 77.085645][ T2212] exFAT-fs (rnullb0): failed to recognize exfat type [ 77.278475][ T31] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 77.429503][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 77.439693][ T31] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 77.454346][ T31] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 77.463482][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 77.471561][ T31] usb 4-1: SerialNumber: syz [ 77.629309][ T36] audit: type=1400 audit(1753485418.193:445): avc: denied { accept } for pid=2233 comm="syz.1.579" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 77.668910][ T788] usb 5-1: USB disconnect, device number 3 [ 77.675317][ T788] usblp0: removed [ 77.680920][ T2219] tipc: Started in network mode [ 77.685857][ T2219] tipc: Node identity ac1414aa, cluster identity 4711 [ 77.693113][ T2219] tipc: Enabled bearer , priority 10 [ 77.701006][ T31] usb 4-1: 0:2 : does not exist [ 77.707348][ T31] usb 4-1: USB disconnect, device number 19 [ 77.790924][ T2246] syz.1.583 (2246): attempted to duplicate a private mapping with mremap. This is not supported. [ 78.233541][ T2252] netlink: 32 bytes leftover after parsing attributes in process `syz.3.585'. [ 78.258608][ T36] audit: type=1400 audit(1753485418.813:446): avc: denied { mounton } for pid=2251 comm="syz.3.585" path="/syzcgroup/unified/syz3" dev="pstore" ino=1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:pstore_t tclass=dir permissive=1 [ 78.386770][ T2261] rust_binder: Write failure EFAULT in pid:15 [ 78.493917][ T36] audit: type=1400 audit(1753485419.053:447): avc: denied { create } for pid=2270 comm="syz.3.592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 78.494444][ T2271] incfs: Error accessing: ./bus. [ 78.539893][ T2271] incfs: mount failed -2 [ 78.750190][ T36] audit: type=1400 audit(1753485419.313:448): avc: denied { unmount } for pid=290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 78.798468][ T788] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 78.818466][ T31] tipc: Node number set to 2886997162 [ 78.832602][ T2302] rust_binder: Error in use_page_slow: ESRCH [ 78.832620][ T2302] rust_binder: use_range failure ESRCH [ 78.850589][ T2302] rust_binder: Failed to allocate buffer. len:96, is_oneway:false [ 78.850612][ T2302] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 78.878468][ T2302] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:417 [ 78.965130][ T2312] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 78.968537][ T788] usb 4-1: device descriptor read/64, error -71 [ 78.970111][ T2312] rust_binder: Error while translating object. [ 78.981319][ T2312] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 78.987485][ T2312] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:526 [ 79.208486][ T788] usb 4-1: device descriptor read/64, error -71 [ 79.308487][ T9] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 79.458703][ T788] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 79.469532][ T9] usb 5-1: config index 0 descriptor too short (expected 35577, got 27) [ 79.477996][ T9] usb 5-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 79.486634][ T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 79.495639][ T9] usb 5-1: config 1 has no interface number 0 [ 79.501761][ T9] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 79.512746][ T9] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 79.525643][ T9] usb 5-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 79.534702][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.588485][ T788] usb 4-1: device descriptor read/64, error -71 [ 79.789061][ T9] usb 5-1: USB disconnect, device number 4 [ 79.797250][ T2321] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 79.838487][ T788] usb 4-1: device descriptor read/64, error -71 [ 79.948584][ T788] usb usb4-port1: attempt power cycle [ 80.167312][ T2335] rust_binder: 432: no such ref 2 [ 80.172432][ T2335] rust_binder: Write failure EFAULT in pid:432 [ 80.288575][ T788] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 80.319495][ T788] usb 4-1: device descriptor read/8, error -71 [ 80.449602][ T788] usb 4-1: device descriptor read/8, error -71 [ 80.698491][ T788] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 80.719435][ T788] usb 4-1: device descriptor read/8, error -71 [ 80.849459][ T788] usb 4-1: device descriptor read/8, error -71 [ 80.958803][ T788] usb usb4-port1: unable to enumerate USB device [ 81.138494][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 81.138519][ T328] Bluetooth: hci0: command 0x1003 tx timeout [ 81.169750][ T2364] x_tables: duplicate underflow at hook 1 [ 81.366900][ T2376] binder: Bad value for 'max' [ 81.380110][ T36] kauditd_printk_skb: 1 callbacks suppressed [ 81.380126][ T36] audit: type=1400 audit(1753485421.943:450): avc: denied { write } for pid=2377 comm="syz.4.625" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 81.418680][ T2383] binder: Bad value for 'stats' [ 81.423704][ T2383] binder: Bad value for 'stats' [ 81.437722][ T36] audit: type=1400 audit(1753485421.993:451): avc: denied { append } for pid=2385 comm="syz.4.628" name="loop0" dev="devtmpfs" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 81.598609][ T70] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 81.660043][ T2400] rust_binder: Error in use_page_slow: ESRCH [ 81.660061][ T2400] rust_binder: use_range failure ESRCH [ 81.666111][ T2400] rust_binder: Failed to allocate buffer. len:64, is_oneway:false [ 81.671660][ T2400] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 81.679578][ T2400] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:66 [ 81.759499][ T70] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 81.779285][ T70] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 81.790144][ T70] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 81.799893][ T70] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 81.818826][ T70] usb 2-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 81.827869][ T70] usb 2-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 81.836153][ T70] usb 2-1: Manufacturer: syz [ 81.844264][ T70] usb 2-1: config 0 descriptor?? [ 81.898473][ T788] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 81.931460][ T36] audit: type=1400 audit(1753485422.493:452): avc: denied { validate_trans } for pid=2411 comm="syz.4.636" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 81.959150][ T36] audit: type=1400 audit(1753485422.523:453): avc: denied { nlmsg_write } for pid=2413 comm="syz.4.637" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 81.982324][ T36] audit: type=1400 audit(1753485422.543:454): avc: denied { name_bind } for pid=2417 comm="syz.4.638" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 82.003378][ T36] audit: type=1400 audit(1753485422.543:455): avc: denied { wake_alarm } for pid=2417 comm="syz.4.638" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 82.037089][ T36] audit: type=1326 audit(1753485422.593:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2417 comm="syz.4.638" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5cc298e9a9 code=0x0 [ 82.078451][ T788] usb 4-1: Using ep0 maxpacket: 16 [ 82.085153][ T788] usb 4-1: config 14 has an invalid interface number: 213 but max is 2 [ 82.093445][ T788] usb 4-1: config 14 contains an unexpected descriptor of type 0x1, skipping [ 82.102263][ T788] usb 4-1: config 14 has an invalid descriptor of length 0, skipping remainder of the config [ 82.112466][ T788] usb 4-1: config 14 has 1 interface, different from the descriptor's value: 3 [ 82.121439][ T788] usb 4-1: config 14 has no interface number 0 [ 82.127602][ T788] usb 4-1: config 14 interface 213 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 82.140756][ T788] usb 4-1: config 14 interface 213 has no altsetting 0 [ 82.149038][ T788] usb 4-1: New USB device found, idVendor=2c7c, idProduct=0306, bcdDevice=38.8a [ 82.158089][ T788] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.166084][ T788] usb 4-1: Manufacturer: з [ 82.170606][ T788] usb 4-1: SerialNumber: Д [ 82.261463][ T70] appleir 0003:05AC:8243.0008: item fetching failed at offset 0/1 [ 82.269449][ T70] appleir 0003:05AC:8243.0008: parse failed [ 82.275371][ T70] appleir 0003:05AC:8243.0008: probe with driver appleir failed with error -22 [ 82.463300][ T70] usb 2-1: USB disconnect, device number 14 [ 82.606220][ T2438] rust_binder: 2437 RLIMIT_NICE not set [ 82.606419][ T2437] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 4232, size: 4097) [ 82.612046][ T2437] rust_binder: Error while translating object. [ 82.622738][ T2437] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 82.628909][ T2437] rust_binder: Failure BR_FAILED_REPLY { source: EINVAL } during reply - delivering BR_FAILED_REPLY to sender. [ 82.638265][ T2437] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:466 [ 82.653542][ T9] rust_binder: 2436: removing orphan mapping 0:1048 [ 82.684450][ T2440] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 82.684471][ T2440] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:469 [ 82.706724][ T2442] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 82.733541][ T2444] rust_binder: Write failure EFAULT in pid:473 [ 82.882386][ T36] audit: type=1400 audit(1753485423.443:457): avc: denied { getopt } for pid=2450 comm="syz.0.649" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 82.927229][ T2453] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 82.939336][ T2455] rust_binder: 90: no such ref 1 [ 82.943939][ T2453] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 82.944298][ T2455] rust_binder: 90: no such ref 2 [ 82.958472][ T2453] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 82.966581][ T2453] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 83.013478][ T2466] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 83.024352][ T2466] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:90 [ 83.027728][ T2466] rust_binder: 2455 RLIMIT_NICE not set [ 83.045442][ T70] rust_binder: 2454: removing orphan mapping 0:1048 [ 83.241804][ T36] audit: type=1400 audit(1753485423.803:458): avc: denied { unmount } for pid=2489 comm="syz.4.662" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 83.370618][ T70] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 83.416644][ T36] audit: type=1400 audit(1753485423.973:459): avc: denied { mount } for pid=2496 comm="syz.4.664" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 83.528523][ T70] usb 2-1: Using ep0 maxpacket: 32 [ 83.535579][ T70] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 83.544988][ T70] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 83.553782][ T70] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 83.563314][ T70] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 2763, setting to 1024 [ 83.574778][ T70] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 83.585087][ T70] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 83.595295][ T70] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 83.605458][ T70] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 83.618867][ T70] usb 2-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 83.628056][ T70] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.641378][ T70] usb 2-1: config 0 descriptor?? [ 83.659251][ T2479] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 83.670392][ T70] usblp0: Disabling reads from problematic bidirectional printer [ 83.883591][ T70] usblp 2-1:0.0: usblp0: USB Unidirectional printer dev 15 if 0 alt 0 proto 3 vid 0x03F0 pid 0x0004 [ 83.902935][ T70] usb 2-1: USB disconnect, device number 15 [ 83.912200][ T70] usblp0: removed [ 84.196014][ T2511] cgroup: noprefix used incorrectly [ 84.373749][ T2522] SELinux: security_context_str_to_sid () failed with errno=-22 [ 84.510212][ T31] usb 4-1: USB disconnect, device number 24 [ 84.689544][ T2570] /dev/nullb0: Can't lookup blockdev [ 84.698819][ T2571] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 84.709827][ T2571] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 84.726530][ T2571] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 84.744697][ T2571] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:578 [ 84.758468][ T2571] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 84.764211][ T9] hid-generic 1002:0000:0000.0009: unknown main item tag 0x0 [ 84.778804][ T2571] rust_binder: Read failure Err(EFAULT) in pid:578 [ 84.798226][ T9] hid-generic 1002:0000:0000.0009: unknown main item tag 0x0 [ 84.831518][ T9] hid-generic 1002:0000:0000.0009: unknown main item tag 0x0 [ 84.848490][ T9] hid-generic 1002:0000:0000.0009: unknown main item tag 0x0 [ 84.858101][ T9] hid-generic 1002:0000:0000.0009: unknown main item tag 0x0 [ 84.869704][ T9] hid-generic 1002:0000:0000.0009: unknown main item tag 0x0 [ 84.881441][ T9] hid-generic 1002:0000:0000.0009: unknown main item tag 0x0 [ 84.893238][ T9] hid-generic 1002:0000:0000.0009: unknown main item tag 0x0 [ 84.903955][ T9] hid-generic 1002:0000:0000.0009: unknown main item tag 0x0 [ 84.914445][ T9] hid-generic 1002:0000:0000.0009: hidraw0: HID v63.cf Device [syz0] on syz1 [ 84.936872][ T2586] fido_id[2586]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 84.976613][ T2591] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 85.268463][ T306] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 85.449767][ T306] usb 4-1: unable to get BOS descriptor or descriptor too short [ 85.458796][ T306] usb 4-1: not running at top speed; connect to a high speed hub [ 85.470500][ T306] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 85.483917][ T306] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 147, changing to 4 [ 85.506447][ T306] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 85.515609][ T306] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.529971][ T306] usb 4-1: Product: syz [ 85.539571][ T306] usb 4-1: Manufacturer: syz [ 85.549620][ T306] usb 4-1: SerialNumber: syz [ 85.916895][ T306] usb 4-1: unit 2 not found! [ 85.923082][ T306] usb 4-1: unknown interface protocol 0x1, assuming v1 [ 85.929989][ T306] usb 4-1: cannot find UAC_HEADER [ 85.938649][ T306] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 85.948377][ T306] usb 4-1: USB disconnect, device number 25 [ 86.627200][ T2645] netlink: 44 bytes leftover after parsing attributes in process `syz.3.713'. [ 86.636145][ T2645] netlink: 'syz.3.713': attribute type 6 has an invalid length. [ 86.644009][ T2645] netlink: 'syz.3.713': attribute type 5 has an invalid length. [ 86.651894][ T2645] netlink: 'syz.3.713': attribute type 4 has an invalid length. [ 86.660340][ T2645] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 86.740485][ T2653] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 86.748501][ T2653] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 86.756941][ T2653] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 86.765137][ T2653] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 86.791081][ T2655] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:599 [ 86.939085][ T9] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 86.966318][ T2658] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:602 [ 86.966530][ T2658] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 87.004273][ T36] kauditd_printk_skb: 6 callbacks suppressed [ 87.004290][ T36] audit: type=1400 audit(1753485427.563:466): avc: denied { create } for pid=2666 comm="syz.4.724" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 87.049991][ T2667] veth0_vlan: entered allmulticast mode [ 87.110337][ T36] audit: type=1400 audit(1753485427.673:467): avc: denied { setopt } for pid=2675 comm="syz.4.727" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 87.168482][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 87.181847][ T9] usb 4-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 87.199987][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.221181][ T9] usb 4-1: config 0 descriptor?? [ 87.235459][ T36] audit: type=1400 audit(1753485427.793:468): avc: denied { write } for pid=2699 comm="syz.1.731" name="snmp" dev="proc" ino=4026532508 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 87.629218][ T9] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 87.646896][ T9] asix 4-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffe0 [ 87.669384][ T9] asix 4-1:0.0: probe with driver asix failed with error -32 [ 87.685203][ T9] usb 4-1: USB disconnect, device number 26 [ 87.779083][ T2727] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 87.780353][ T2727] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:615 [ 88.160670][ T2762] 9pnet_fd: Insufficient options for proto=fd [ 88.263258][ T2778] netlink: 'syz.3.757': attribute type 4 has an invalid length. [ 88.272227][ T2778] netlink: 'syz.3.757': attribute type 4 has an invalid length. [ 88.290223][ T2780] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 88.298133][ T2780] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 88.306771][ T2780] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 88.314853][ T2780] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 88.362660][ T2783] netlink: 100 bytes leftover after parsing attributes in process `syz.3.759'. [ 88.372413][ T2783] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1173769364 (75121239296 ns) > initial count (17488810624 ns). Using initial count to start timer. [ 88.417677][ T2775] SELinux: Context ϧ-):E2٭ؾ)đJu36ޢ{@m[ is not valid (left unmapped). [ 88.448470][ T306] usb 1-1: new low-speed USB device number 22 using dummy_hcd [ 88.608508][ T306] usb 1-1: Invalid ep0 maxpacket: 32 [ 88.738470][ T306] usb 1-1: new low-speed USB device number 23 using dummy_hcd [ 88.749673][ T2819] input: syz0 as /devices/virtual/input/input13 [ 88.868980][ T36] audit: type=1400 audit(1753485429.433:469): avc: denied { search } for pid=2827 comm="syz.4.776" name="/" dev="configfs" ino=2504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 88.908461][ T306] usb 1-1: Invalid ep0 maxpacket: 32 [ 88.913930][ T306] usb usb1-port1: attempt power cycle [ 89.058490][ T788] usb 4-1: new full-speed USB device number 27 using dummy_hcd [ 89.220192][ T788] usb 4-1: not running at top speed; connect to a high speed hub [ 89.238733][ T788] usb 4-1: config 1 interface 0 altsetting 127 endpoint 0x1 has invalid maxpacket 1023, setting to 64 [ 89.250087][ T788] usb 4-1: config 1 interface 0 altsetting 127 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 89.258464][ T306] usb 1-1: new low-speed USB device number 24 using dummy_hcd [ 89.268506][ T788] usb 4-1: config 1 interface 0 has no altsetting 0 [ 89.289477][ T788] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 89.298564][ T788] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.298787][ T306] usb 1-1: Invalid ep0 maxpacket: 32 [ 89.306628][ T788] usb 4-1: Product: syz [ 89.316011][ T788] usb 4-1: Manufacturer: syz [ 89.320690][ T788] usb 4-1: SerialNumber: syz [ 89.328915][ T2830] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 89.336370][ T2830] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 89.359509][ T36] audit: type=1326 audit(1753485429.913:470): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2798 comm="syz.1.764" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f9ad8e9a9 code=0x7fc00000 [ 89.388613][ T2836] netlink: 'syz.1.779': attribute type 4 has an invalid length. [ 89.396279][ T2836] netlink: 3657 bytes leftover after parsing attributes in process `syz.1.779'. [ 89.396614][ T36] audit: type=1326 audit(1753485429.913:471): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2798 comm="syz.1.764" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f3f9ad8e9a9 code=0x7fc00000 [ 89.438792][ T2838] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 89.439058][ T2838] rust_binder: inc_ref_done called when no active inc_refs [ 89.442960][ T306] usb 1-1: new low-speed USB device number 25 using dummy_hcd [ 89.488955][ T306] usb 1-1: Invalid ep0 maxpacket: 32 [ 89.494856][ T306] usb usb1-port1: unable to enumerate USB device [ 89.559414][ T788] usb 4-1: USB disconnect, device number 27 [ 90.272262][ T2853] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 90.351946][ T2860] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:643 [ 90.383126][ T2860] rust_binder: Read failure Err(EFAULT) in pid:643 [ 90.413925][ T2871] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 90.418343][ T2869] fuse: Unknown parameter '' [ 90.423973][ T2870] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:645 [ 90.432292][ T2870] rust_binder: Error while translating object. [ 90.443080][ T2870] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 90.449355][ T2870] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:645 [ 90.559799][ T36] audit: type=1400 audit(1753485431.123:472): avc: denied { create } for pid=2892 comm="syz.3.799" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 90.589489][ T36] audit: type=1400 audit(1753485431.123:473): avc: denied { mounton } for pid=2892 comm="syz.3.799" path="/187/file0" dev="tmpfs" ino=1069 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 90.678994][ T2898] binder: Unknown parameter 'context' [ 90.697117][ T2901] binder: Unknown parameter 'defcontext' [ 90.848584][ T9] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 91.008466][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 91.014546][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 91.024803][ T9] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 91.035718][ T9] usb 2-1: config 1 interface 1 has no altsetting 1 [ 91.043713][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 91.052787][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.061075][ T9] usb 2-1: Product: syz [ 91.065248][ T9] usb 2-1: Manufacturer: syz [ 91.072121][ T9] usb 2-1: SerialNumber: syz [ 91.095789][ T36] audit: type=1400 audit(1753485431.653:474): avc: denied { mount } for pid=2927 comm="syz.3.810" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 91.117661][ T36] audit: type=1400 audit(1753485431.653:475): avc: denied { mounton } for pid=2927 comm="syz.3.810" path="/197/file0" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 91.328489][ T788] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 91.377711][ T2943] rust_binder: Write failure EFAULT in pid:565 [ 91.387711][ T2946] SELinux: failed to load policy [ 91.408465][ T2946] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 91.424616][ T2950] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 91.424642][ T2950] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 91.478480][ T788] usb 4-1: Using ep0 maxpacket: 16 [ 91.495854][ T788] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 78, changing to 10 [ 91.507199][ T788] usb 4-1: New USB device found, idVendor=5543, idProduct=0781, bcdDevice= 0.00 [ 91.517209][ T788] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.526081][ T788] usb 4-1: config 0 descriptor?? [ 91.934361][ T788] uclogic 0003:5543:0781.000A: item fetching failed at offset 1/5 [ 91.951198][ T788] uclogic 0003:5543:0781.000A: parse failed [ 91.957409][ T788] uclogic 0003:5543:0781.000A: probe with driver uclogic failed with error -22 [ 92.135169][ T788] usb 4-1: USB disconnect, device number 28 [ 92.303479][ T2972] rust_binder: 582: no such ref 1 [ 92.308624][ T2972] rust_binder: 582: no such ref 2 [ 92.407558][ T2975] rust_binder: Write failure EFAULT in pid:582 [ 92.646416][ T36] kauditd_printk_skb: 3 callbacks suppressed [ 92.646443][ T36] audit: type=1400 audit(1753485433.205:479): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 92.827020][ T36] audit: type=1400 audit(1753485433.385:480): avc: denied { ioctl } for pid=3007 comm="syz.0.833" path="socket:[24085]" dev="sockfs" ino=24085 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 92.846351][ T3008] rust_binder: Write failure EFAULT in pid:598 [ 92.911770][ T3017] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 92.935360][ T3019] binder: Unknown parameter 'contextp' [ 92.941689][ T3019] binder: Unknown parameter 'contextp' [ 93.118481][ T306] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 93.248471][ T306] usb 4-1: device descriptor read/64, error -71 [ 93.399801][ T3040] rust_binder: 612: no such ref 1 [ 93.404911][ T3040] rust_binder: 612: no such ref 2 [ 93.449938][ T3045] fuse: Bad value for 'user_id' [ 93.454919][ T3045] fuse: Bad value for 'user_id' [ 93.518477][ T306] usb 4-1: device descriptor read/64, error -71 [ 93.544122][ T9] usb 2-1: selecting invalid altsetting 1 [ 93.556536][ T9] cdc_ncm 2-1:1.0: bind() failure [ 93.569167][ T9] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 93.578462][ T9] cdc_ncm 2-1:1.1: bind() failure [ 93.586997][ T9] usb 2-1: USB disconnect, device number 16 [ 93.621858][ T36] audit: type=1400 audit(1753485434.185:481): avc: denied { module_load } for pid=3067 comm="syz.4.853" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 93.621933][ T3070] Invalid ELF header type: 2 != 1 [ 93.683634][ T36] audit: type=1400 audit(1753485434.245:482): avc: denied { write } for pid=3072 comm="syz.1.854" name="file2" dev="tmpfs" ino=1181 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 93.707869][ T3074] netlink: 56 bytes leftover after parsing attributes in process `syz.4.853'. [ 93.778475][ T306] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 93.818231][ T36] audit: type=1400 audit(1753485434.375:483): avc: denied { accept } for pid=3081 comm="syz.1.857" path="socket:[25007]" dev="sockfs" ino=25007 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 93.908477][ T306] usb 4-1: device descriptor read/64, error -71 [ 94.158485][ T306] usb 4-1: device descriptor read/64, error -71 [ 94.268587][ T306] usb usb4-port1: attempt power cycle [ 94.348476][ T3097] __vm_enough_memory: pid: 3097, comm: syz.1.861, bytes: 18014402804453376 not enough memory for the allocation [ 94.475460][ T3113] netlink: 36 bytes leftover after parsing attributes in process `syz.4.867'. [ 94.568933][ T36] audit: type=1326 audit(1753485435.135:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3116 comm="syz.4.868" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5cc298e9a9 code=0x0 [ 94.611862][ T306] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 94.649454][ T306] usb 4-1: device descriptor read/8, error -71 [ 94.779441][ T306] usb 4-1: device descriptor read/8, error -71 [ 95.014681][ T3169] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 95.023888][ T3169] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 95.023924][ T306] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 95.032535][ T3169] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 95.047903][ T3169] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 95.079476][ T306] usb 4-1: device descriptor read/8, error -71 [ 95.209420][ T306] usb 4-1: device descriptor read/8, error -71 [ 95.249024][ T3203] tipc: Started in network mode [ 95.253893][ T3203] tipc: Node identity a6020fcc74f1, cluster identity 4711 [ 95.264567][ T3203] tipc: Enabled bearer , priority 0 [ 95.288026][ T3203] syzkaller0: entered promiscuous mode [ 95.293788][ T3203] syzkaller0: entered allmulticast mode [ 95.302061][ T3203] tipc: Resetting bearer [ 95.319007][ T306] usb usb4-port1: unable to enumerate USB device [ 95.406073][ T3201] tipc: Resetting bearer [ 95.428208][ T3201] tipc: Disabling bearer [ 95.510036][ T3230] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 95.517113][ T3230] rust_binder: Write failure EINVAL in pid:716 [ 95.567546][ T3233] bridge0: port 3(veth1_to_team) entered blocking state [ 95.597676][ T3233] bridge0: port 3(veth1_to_team) entered disabled state [ 95.605030][ T3233] veth1_to_team: entered allmulticast mode [ 95.617717][ T3233] veth1_to_team: entered promiscuous mode [ 95.629232][ T3233] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=io+mem:owns=io+mem [ 95.711035][ T36] audit: type=1400 audit(1753485442.277:485): avc: denied { checkpoint_restore } for pid=3242 comm="syz.4.888" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 95.734667][ T3246] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 95.751263][ T36] audit: type=1400 audit(1753485442.297:486): avc: denied { execute } for pid=3245 comm="syz.1.889" name="file0" dev="ramfs" ino=25477 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 95.859217][ T3269] fuse: Bad value for 'rootmode' [ 95.951712][ T36] audit: type=1400 audit(1753485442.517:487): avc: denied { create } for pid=3275 comm="syz.3.897" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 96.050921][ T36] audit: type=1400 audit(1753485442.617:488): avc: denied { read } for pid=148 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 96.052992][ T3293] can0: slcan on ptm1. [ 96.129495][ T3292] can0 (unregistered): slcan off ptm1. [ 96.202280][ T3313] netlink: 12 bytes leftover after parsing attributes in process `syz.0.905'. [ 96.233770][ T3326] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 96.233794][ T3326] rust_binder: Read failure Err(EFAULT) in pid:729 [ 96.408472][ T306] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 96.488627][ T9] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 96.568472][ T306] usb 4-1: Using ep0 maxpacket: 32 [ 96.578161][ T306] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 96.602589][ T306] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 96.612569][ T306] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.620695][ T306] usb 4-1: Product: syz [ 96.628518][ T306] usb 4-1: Manufacturer: syz [ 96.633121][ T306] usb 4-1: SerialNumber: syz [ 96.639829][ T306] usb 4-1: config 0 descriptor?? [ 96.645753][ T306] usb 4-1: bad CDC descriptors [ 96.650968][ T306] usb 4-1: unsupported MDLM descriptors [ 96.657848][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 96.668111][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 96.677771][ T9] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 96.686875][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 96.694905][ T9] usb 2-1: SerialNumber: syz [ 96.847703][ T306] usb 4-1: USB disconnect, device number 33 [ 96.904052][ T9] usb 2-1: 0:2 : does not exist [ 96.911207][ T9] usb 2-1: USB disconnect, device number 17 [ 96.921595][ T485] udevd[485]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 97.043250][ T3379] netlink: 12 bytes leftover after parsing attributes in process `syz.4.918'. [ 97.114679][ T3388] tipc: Enabling of bearer rejected, failed to enable media [ 97.140290][ T3392] fuse: Bad value for 'group_id' [ 97.145303][ T3392] fuse: Bad value for 'group_id' [ 97.421279][ T3404] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 97.421530][ T3404] rust_binder: Failed to allocate buffer. len:1176, is_oneway:true [ 97.428014][ T3404] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 97.436165][ T3404] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:725 [ 97.483952][ T3420] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 97.493150][ T3420] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:714 [ 97.515988][ T3423] netlink: 12 bytes leftover after parsing attributes in process `syz.3.934'. [ 97.534217][ T3424] binder: Unknown parameter 'defcontext01777777777777777777777' [ 97.534687][ T3423] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 97.541992][ T3423] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:716 [ 97.565921][ T3426] bridge0: port 3(vlan0) entered blocking state [ 97.568862][ T3428] FAT-fs (rnullb0): bogus number of reserved sectors [ 97.577188][ T3426] bridge0: port 3(vlan0) entered disabled state [ 97.582110][ T3428] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 97.588128][ T3426] vlan0: entered allmulticast mode [ 97.609214][ T3426] vlan0: entered promiscuous mode [ 97.614428][ T3426] bridge0: port 3(vlan0) entered blocking state [ 97.620707][ T3426] bridge0: port 3(vlan0) entered forwarding state [ 97.628289][ T3433] incfs: Options parsing error. -22 [ 97.633578][ T3433] incfs: mount failed -22 [ 97.665992][ T3437] rust_binder: Error in use_page_slow: ESRCH [ 97.666013][ T3437] rust_binder: use_range failure ESRCH [ 97.670941][ T36] kauditd_printk_skb: 17 callbacks suppressed [ 97.670956][ T36] audit: type=1400 audit(1753485444.237:506): avc: denied { connect } for pid=3439 comm="syz.3.940" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 97.672118][ T3437] rust_binder: Failed to allocate buffer. len:64, is_oneway:false [ 97.696962][ T3442] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:728 [ 97.703004][ T3437] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 97.725558][ T3437] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:739 [ 97.832677][ T3454] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=28701 sclass=netlink_xfrm_socket pid=3454 comm=syz.3.946 [ 97.880985][ T3460] netlink: 'syz.0.949': attribute type 27 has an invalid length. [ 97.891139][ T3459] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 97.901392][ T3459] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 97.912088][ T3459] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 97.920518][ T3459] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 97.934955][ T3460] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.942194][ T3460] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.969337][ T3460] veth0_vlan: left allmulticast mode [ 97.978792][ T3456] netlink: 12 bytes leftover after parsing attributes in process `syz.3.947'. [ 98.022739][ T3475] netlink: 5 bytes leftover after parsing attributes in process `syz.3.951'. [ 98.263628][ T3494] veth0_vlan: left promiscuous mode [ 98.269005][ T3494] veth0_vlan: entered allmulticast mode [ 98.274993][ T3494] veth0_vlan: entered promiscuous mode [ 98.292543][ T3500] rust_binder: Failed to allocate buffer. len:160, is_oneway:false [ 98.320291][ T36] audit: type=1400 audit(1753485444.887:507): avc: denied { write } for pid=3484 comm="syz.1.956" name="/" dev="configfs" ino=2504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 98.335148][ T9] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 98.350413][ T36] audit: type=1400 audit(1753485444.887:508): avc: denied { add_name } for pid=3484 comm="syz.1.956" name="file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 98.357563][ T36] audit: type=1400 audit(1753485444.887:509): avc: denied { create } for pid=3484 comm="syz.1.956" name="file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 98.374333][ T9] hid-generic 0000:0000:0000.000B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 98.452097][ T36] audit: type=1400 audit(1753485444.897:510): avc: denied { setattr } for pid=3484 comm="syz.1.956" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 98.808538][ T3530] rust_binder: 771: no such ref 0 [ 98.813577][ T3530] rust_binder: Write failure EINVAL in pid:771 [ 98.951336][ T3537] rust_binder: Failed copying remainder into alloc: EFAULT [ 98.957543][ T3537] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 98.964870][ T3537] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 98.973155][ T3537] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:777 [ 99.308485][ T9] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 99.478969][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 99.491632][ T9] usb 2-1: config 63 has an invalid interface number: 13 but max is 0 [ 99.500240][ T9] usb 2-1: config 63 has no interface number 0 [ 99.506496][ T9] usb 2-1: config 63 interface 13 has no altsetting 0 [ 99.516060][ T9] usb 2-1: New USB device found, idVendor=0f19, idProduct=0105, bcdDevice= 1.00 [ 99.525410][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.542157][ T9] usb 2-1: Product: syz [ 99.549316][ T9] usb 2-1: Manufacturer: syz [ 99.554166][ T9] usb 2-1: SerialNumber: syz [ 99.765472][ T9] usb-storage 2-1:63.13: USB Mass Storage device detected [ 99.789254][ T9] usb-storage 2-1:63.13: Quirks match for vid 0f19 pid 0105: 20 [ 99.846004][ T3561] binder: Bad value for 'stats' [ 99.869991][ T9] usb 2-1: USB disconnect, device number 18 [ 99.880309][ T3565] netlink: 'syz.0.980': attribute type 4 has an invalid length. [ 100.388826][ T3572] binder: Unknown parameter 'G(WA?O_6>8< !F'a7nEVX7i9^ME]A*X;{&k!5' [ 100.417232][ T3580] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 100.434825][ T3580] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 100.472391][ T3585] rust_binder: Failed to allocate buffer. len:1160, is_oneway:true [ 100.501520][ T36] audit: type=1400 audit(1753485447.067:511): avc: denied { map } for pid=3586 comm="syz.3.990" path="/proc/sys/net/ipv4/tcp_congestion_control" dev="proc" ino=23705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_net_t tclass=file permissive=1 [ 100.515213][ T3587] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 100.534795][ T3587] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:796 [ 100.548507][ T9] usb 2-1: new low-speed USB device number 19 using dummy_hcd [ 100.626873][ T36] audit: type=1400 audit(1753485447.187:512): avc: denied { mount } for pid=3604 comm="syz.3.997" name="/" dev="ramfs" ino=26549 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 100.636018][ T3605] erofs: (device erofs): erofs_read_superblock: cannot find valid erofs superblock [ 100.649098][ T36] audit: type=1400 audit(1753485447.197:513): avc: denied { mounton } for pid=3604 comm="syz.3.997" path="/file0" dev="ramfs" ino=27323 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 100.685154][ T3605] devpts: called with bogus options [ 100.685389][ T3607] binder: Bad value for 'max' [ 100.712393][ T9] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 100.722419][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.731914][ T9] usb 2-1: config 0 descriptor?? [ 100.764267][ T3614] rust_binder: 3610 RLIMIT_NICE not set [ 100.764509][ T3610] rust_binder: Error while translating object. [ 100.770105][ T3610] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 100.776267][ T3610] rust_binder: Failure BR_FAILED_REPLY { source: ENOENT } during reply - delivering BR_FAILED_REPLY to sender. [ 100.785667][ T3610] rust_binder: Transaction failed: BR_TRANSACTION_COMPLETE my_pid:822 [ 100.803307][ T31] rust_binder: 3609: removing orphan mapping 0:4120 [ 100.827132][ T36] audit: type=1400 audit(1753485447.387:514): avc: denied { mounton } for pid=3617 comm="syz.0.1001" path="/247/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="tmpfs" ino=1352 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 100.925288][ T3620] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 100.925896][ T3620] rust_binder: Error while translating object. [ 100.937906][ T3620] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 100.958465][ T3620] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:827 [ 101.083255][ T3629] overlayfs: failed to resolve './bus': -2 [ 101.207138][ T36] audit: type=1400 audit(1753485447.767:515): avc: denied { read } for pid=3639 comm="syz.3.1009" name="/" dev="configfs" ino=2504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 101.272268][ T3647] No source specified [ 101.373021][ T3650] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:819 [ 101.373779][ T3650] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1011'. [ 101.415734][ T70] rust_binder: 3649: removing orphan mapping 0:1048 [ 101.591916][ T3673] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 101.591950][ T3673] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:843 [ 101.669192][ T3678] rust_binder: 847: no such ref 3 [ 101.698487][ T306] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 101.759794][ T3688] binder: Bad value for 'stats' [ 101.873662][ T306] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 101.883856][ T306] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.896362][ T306] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 101.910712][ T306] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.918781][ T306] usb 4-1: Product: syz [ 101.922956][ T306] usb 4-1: Manufacturer: syz [ 101.927569][ T306] usb 4-1: SerialNumber: syz [ 101.933614][ T3705] rust_binder: 864: no such ref 3 [ 101.939284][ T306] usb 4-1: selecting invalid altsetting 1 [ 102.340348][ T306] cdc_mbim 4-1:1.0: failed GET_NTB_PARAMETERS [ 102.346728][ T306] cdc_mbim 4-1:1.0: bind() failure [ 102.357190][ T9] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 102.368066][ T306] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 102.374896][ T306] cdc_ncm 4-1:1.1: bind() failure [ 102.379943][ T9] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 102.391233][ T306] usb 4-1: USB disconnect, device number 34 [ 102.402300][ T9] asix 2-1:0.0: probe with driver asix failed with error -71 [ 102.415473][ T9] usb 2-1: USB disconnect, device number 19 [ 102.451275][ T3731] netlink: 'syz.4.1039': attribute type 9 has an invalid length. [ 102.460086][ T3731] overlayfs: failed to clone upperpath [ 102.873215][ T36] kauditd_printk_skb: 2 callbacks suppressed [ 102.873231][ T36] audit: type=1400 audit(1753485449.437:518): avc: denied { bind } for pid=3780 comm="syz.1.1048" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 102.916662][ T3788] cgroup: Bad value for 'name' [ 102.921865][ T3788] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 102.925639][ T3788] rust_binder: Failed to allocate buffer. len:1136, is_oneway:true [ 102.933161][ T3788] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 102.941150][ T3788] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:766 [ 102.971038][ T3792] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1545 sclass=netlink_route_socket pid=3792 comm=syz.1.1051 [ 103.044306][ T3796] tmpfs: Unknown parameter '0x0000000000000003' [ 103.208470][ T31] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 103.358518][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 103.369189][ T31] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 103.374614][ T3805] 2: renamed from lo (while UP) [ 103.377275][ T31] usb 4-1: config 0 has no interface number 0 [ 103.378810][ T31] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 103.397703][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.399481][ T3805] netlink: 'syz.4.1057': attribute type 4 has an invalid length. [ 103.405870][ T31] usb 4-1: Product: syz [ 103.413924][ T3805] netlink: 'syz.4.1057': attribute type 5 has an invalid length. [ 103.417747][ T31] usb 4-1: Manufacturer: syz [ 103.417766][ T31] usb 4-1: SerialNumber: syz [ 103.425783][ T3805] netlink: 3657 bytes leftover after parsing attributes in process `syz.4.1057'. [ 103.434524][ T31] usb 4-1: config 0 descriptor?? [ 103.451106][ T31] smsc95xx v2.0.0 [ 103.608614][ T3828] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 103.854571][ T31] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 103.865784][ T31] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 103.898535][ T788] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 104.049380][ T788] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 104.059554][ T788] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 104.070154][ T788] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 104.079291][ T788] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 104.087620][ T788] usb 1-1: SerialNumber: syz [ 104.276755][ T3863] 9pnet_fd: Insufficient options for proto=fd [ 104.304484][ T3828] netlink: 124 bytes leftover after parsing attributes in process `syz.0.1065'. [ 104.315530][ T3828] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 104.322907][ T3828] rust_binder: Write failure EINVAL in pid:921 [ 104.333006][ T788] usb 1-1: USB disconnect, device number 26 [ 104.398475][ T36] audit: type=1400 audit(1753485450.957:519): avc: denied { bpf } for pid=3870 comm="syz.4.1079" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 104.428469][ T36] audit: type=1400 audit(1753485450.987:520): avc: denied { read } for pid=3867 comm="syz.1.1078" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 104.678686][ T31] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000108: -71 [ 104.689775][ T31] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 104.703109][ T31] usb 4-1: USB disconnect, device number 35 [ 104.746621][ T36] audit: type=1400 audit(1753485451.307:521): avc: denied { read } for pid=3901 comm="syz.4.1089" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 104.897145][ T3909] rust_binder: 928: no such ref 1 [ 104.948687][ T36] audit: type=1400 audit(1753485451.517:522): avc: denied { bind } for pid=3907 comm="syz.0.1091" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 105.000708][ T3911] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:928 [ 105.143305][ T9] hid (null): unknown global tag 0xd [ 105.161322][ T9] hid-generic 0021:0000:0002.000C: unknown global tag 0xd [ 105.168461][ T9] hid-generic 0021:0000:0002.000C: item 0 2 1 13 parsing failed [ 105.176172][ T9] hid-generic 0021:0000:0002.000C: probe with driver hid-generic failed with error -22 [ 105.242352][ T36] audit: type=1400 audit(1753485451.807:523): avc: denied { write } for pid=3921 comm="syz.3.1096" dev="sockfs" ino=28201 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 105.308234][ T3929] SELinux: security_context_str_to_sid (uncoser=/dev/ppp) failed with errno=-22 [ 105.308233][ T36] audit: type=1400 audit(1753485451.867:524): avc: denied { mounton } for pid=3928 comm="syz.4.1097" path="/164/file0" dev="tmpfs" ino=908 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 105.367694][ T3938] Invalid ELF header type: 2 != 1 [ 105.508487][ T31] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 105.659447][ T31] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 105.670475][ T31] usb 4-1: config 27 interface 0 altsetting 0 has a duplicate endpoint with address 0xB, skipping [ 105.681134][ T31] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 105.690199][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.696498][ T414] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 105.700310][ T31] usb 4-1: invalid MIDI out EP 0 [ 105.710691][ T414] hid-generic 0000:0000:0000.000D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 105.712998][ T31] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 105.741620][ T3946] fido_id[3946]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 105.753743][ T315] udevd[315]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:27.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 105.758470][ T9] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 105.854638][ T36] audit: type=1326 audit(1753485452.417:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3949 comm="syz.0.1105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff533d8e9a9 code=0x7ffc0000 [ 105.878705][ T36] audit: type=1326 audit(1753485452.417:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3949 comm="syz.0.1105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff533d8e9a9 code=0x7ffc0000 [ 105.908876][ T31] usb 4-1: USB disconnect, device number 36 [ 105.916192][ T36] audit: type=1326 audit(1753485452.417:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3949 comm="syz.0.1105" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ff533d8d310 code=0x7ffc0000 [ 105.930507][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 105.959474][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 105.969382][ T9] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 105.978576][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 105.986577][ T9] usb 2-1: SerialNumber: syz [ 106.005824][ T3959] SELinux: security_context_str_to_sid () failed with errno=-22 [ 106.139303][ T3978] cgroup: fork rejected by pids controller in /syz4 [ 106.200375][ T3943] netlink: 1603 bytes leftover after parsing attributes in process `syz.1.1102'. [ 106.331648][ T3943] cgroup: Invalid name [ 106.338929][ T9] usb 2-1: 0:2 : does not exist [ 106.363836][ T9] usb 2-1: USB disconnect, device number 20 [ 106.962035][ T4072] SELinux: truncated policydb string identifier [ 106.968468][ T4072] SELinux: failed to load policy [ 107.033850][ T4082] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 112, limit: 112, size: 165) [ 107.033870][ T4082] rust_binder: Error while translating object. [ 107.044495][ T4082] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 107.050675][ T4082] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:957 [ 107.060795][ T4084] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 107.106388][ T4087] rust_binder: Write failure EFAULT in pid:962 [ 107.218469][ T306] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 107.378477][ T306] usb 2-1: Using ep0 maxpacket: 16 [ 107.384641][ T306] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 107.394537][ T306] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 107.404853][ T306] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 107.413906][ T306] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 107.422362][ T306] usb 2-1: SerialNumber: syz [ 107.429064][ T4073] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 107.436234][ T4073] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 107.556306][ T4121] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4121 comm=syz.4.1140 [ 107.558483][ T9] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 107.568882][ T4121] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4121 comm=syz.4.1140 [ 107.589408][ T4121] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4121 comm=syz.4.1140 [ 107.615938][ T4126] netlink: 'syz.3.1142': attribute type 4 has an invalid length. [ 107.624898][ T4126] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:857 [ 107.646396][ T306] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 107.672620][ T306] cdc_acm 2-1:1.0: ttyACM0: USB ACM device [ 107.687024][ T306] usb 2-1: USB disconnect, device number 21 [ 107.719577][ T9] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 107.731150][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 107.741333][ T9] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 107.756000][ T9] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 107.765907][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 107.774273][ T9] usb 1-1: Product: syz [ 107.780439][ T9] usb 1-1: Manufacturer: syz [ 107.785082][ T9] usb 1-1: SerialNumber: syz [ 107.817724][ T4143] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1147'. [ 107.992803][ T9] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 27 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 108.008276][ T9] usb 1-1: USB disconnect, device number 27 [ 108.022405][ T9] usblp0: removed [ 108.058474][ T70] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 108.163187][ T4151] exFAT-fs (rnullb0): invalid boot record signature [ 108.169994][ T4151] exFAT-fs (rnullb0): failed to read boot sector [ 108.176485][ T4151] exFAT-fs (rnullb0): failed to recognize exfat type [ 108.218479][ T70] usb 4-1: Using ep0 maxpacket: 16 [ 108.229196][ T70] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 108.240298][ T70] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 108.255715][ T70] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 108.269228][ T70] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 108.278720][ T70] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.293485][ T70] usb 4-1: config 0 descriptor?? [ 108.374725][ T4180] rust_binder: 997: no such ref 3 [ 108.380506][ T4179] rust_binder: 997: no such ref 3 [ 108.488490][ T36] kauditd_printk_skb: 127 callbacks suppressed [ 108.488506][ T36] audit: type=1400 audit(1753485455.051:655): avc: denied { setattr } for pid=4203 comm="syz.4.1167" name="RAW" dev="sockfs" ino=30903 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 108.491196][ T4207] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 108.522526][ T4207] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:1007 [ 108.655385][ T36] audit: type=1400 audit(1753485455.221:656): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 108.720880][ T36] audit: type=1400 audit(1753485455.291:657): avc: denied { create } for pid=4234 comm="syz.0.1179" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 108.741450][ T4144] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1147'. [ 108.751547][ T70] microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 [ 108.759219][ T70] microsoft 0003:045E:07DA.000E: ignoring exceeding usage max [ 108.769180][ T70] microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 [ 108.778554][ T4238] 9pnet_fd: Insufficient options for proto=fd [ 108.795206][ T70] microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 [ 108.819327][ T70] microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 [ 108.826762][ T70] microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 [ 108.835319][ T70] microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 [ 108.848475][ T70] microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 [ 108.867455][ T70] microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 [ 108.877515][ T70] microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 [ 108.896516][ T70] microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 [ 108.916681][ T70] microsoft 0003:045E:07DA.000E: unknown main item tag 0x0 [ 108.931354][ T70] ================================================================== [ 108.939447][ T70] BUG: KASAN: slab-out-of-bounds in mon_bin_event+0x12c1/0x23e0 [ 108.947104][ T70] Read of size 3264 at addr ffff888114fd67a1 by task kworker/1:2/70 [ 108.955095][ T70] [ 108.957426][ T70] CPU: 1 UID: 0 PID: 70 Comm: kworker/1:2 Not tainted 6.12.30-syzkaller-g437e1d666d1d #0 a7e852bab5516ec71c4837645977b8b84c4f3040 [ 108.957459][ T70] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 108.957475][ T70] Workqueue: usb_hub_wq hub_event [ 108.957511][ T70] Call Trace: [ 108.957518][ T70] [ 108.957526][ T70] __dump_stack+0x21/0x30 [ 108.957552][ T70] dump_stack_lvl+0x10c/0x190 [ 108.957577][ T70] ? __cfi_dump_stack_lvl+0x10/0x10 [ 108.957602][ T70] ? __cfi__printk+0x10/0x10 [ 108.957632][ T70] print_address_description+0x71/0x220 [ 108.957653][ T70] print_report+0x4a/0x70 [ 108.957672][ T70] kasan_report+0x163/0x1a0 [ 108.957704][ T70] ? mon_bin_event+0x12c1/0x23e0 [ 108.957730][ T70] ? mon_bin_event+0x12c1/0x23e0 [ 108.957756][ T70] kasan_check_range+0x299/0x2a0 [ 108.957775][ T70] ? mon_bin_event+0x12c1/0x23e0 [ 108.957801][ T70] __asan_memcpy+0x31/0x80 [ 108.957826][ T70] mon_bin_event+0x12c1/0x23e0 [ 108.957854][ T70] ? mon_bin_complete+0x50/0x50 [ 108.957879][ T70] ? __kmalloc_noprof+0x1b1/0x450 [ 108.957912][ T70] ? __hid_request+0x1e5/0x410 [ 108.957939][ T70] ? hid_connect+0x49a/0x1a20 [ 108.957966][ T70] ? hid_hw_start+0xcb/0x160 [ 108.957992][ T70] ? ms_probe+0x194/0x460 [ 108.958016][ T70] ? __cfi_mon_bin_submit+0x10/0x10 [ 108.958042][ T70] mon_bin_submit+0x2b/0x40 [ 108.958067][ T70] mon_submit+0x1b9/0x230 [ 108.958089][ T70] usb_hcd_submit_urb+0x12d/0x1a20 [ 108.958110][ T70] ? bus_probe_device+0x18b/0x270 [ 108.958134][ T70] ? usb_probe_device+0x1d4/0x380 [ 108.958164][ T70] ? really_probe+0x2d3/0x890 [ 108.958194][ T70] ? __driver_probe_device+0x198/0x280 [ 108.958224][ T70] ? driver_probe_device+0x54/0x3f0 [ 108.958255][ T70] ? __device_attach_driver+0x2f1/0x4b0 [ 108.958287][ T70] usb_submit_urb+0x111b/0x1800 [ 108.958313][ T70] usb_start_wait_urb+0x11b/0x2f0 [ 108.958340][ T70] ? usb_api_blocking_completion+0xd0/0xd0 [ 108.958366][ T70] ? __kasan_kmalloc+0x96/0xb0 [ 108.958397][ T70] ? __kasan_check_write+0x18/0x20 [ 108.958421][ T70] ? usb_alloc_urb+0x9b/0x200 [ 108.958441][ T70] usb_control_msg+0x25a/0x490 [ 108.958467][ T70] usbhid_raw_request+0x457/0x590 [ 108.958493][ T70] __hid_request+0x1e5/0x410 [ 108.958519][ T70] hidinput_connect+0x241b/0x3340 [ 108.958556][ T70] hid_connect+0x49a/0x1a20 [ 108.958583][ T70] ? usbhid_start+0x1a67/0x2530 [ 108.958606][ T70] ? __cfi_hid_connect+0x10/0x10 [ 108.958649][ T70] hid_hw_start+0xcb/0x160 [ 108.958676][ T70] ms_probe+0x194/0x460 [ 108.958702][ T70] hid_device_probe+0x2c4/0x5d0 [ 108.958733][ T70] ? __cfi_hid_device_probe+0x10/0x10 [ 108.958763][ T70] really_probe+0x2d3/0x890 [ 108.958795][ T70] __driver_probe_device+0x198/0x280 [ 108.958825][ T70] driver_probe_device+0x54/0x3f0 [ 108.958855][ T70] ? __device_attach_driver+0x2db/0x4b0 [ 108.958886][ T70] __device_attach_driver+0x2f1/0x4b0 [ 108.958922][ T70] bus_for_each_drv+0x25d/0x2f0 [ 108.958946][ T70] ? __cfi___device_attach_driver+0x10/0x10 [ 108.958978][ T70] ? __cfi_bus_for_each_drv+0x10/0x10 [ 108.959003][ T70] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 108.959029][ T70] __device_attach+0x2bd/0x3a0 [ 108.959058][ T70] ? device_attach+0x40/0x40 [ 108.959085][ T70] ? _raw_spin_lock+0x8c/0x120 [ 108.959106][ T70] ? __cfi__raw_spin_lock+0x10/0x10 [ 108.959130][ T70] device_initial_probe+0x1e/0x30 [ 108.959159][ T70] bus_probe_device+0x18b/0x270 [ 108.959183][ T70] device_add+0x80c/0xc00 [ 108.959212][ T70] hid_add_device+0x39b/0x560 [ 108.959241][ T70] usbhid_probe+0xde3/0x12b0 [ 108.959266][ T70] usb_probe_interface+0x696/0xc00 [ 108.959298][ T70] ? __cfi_usb_probe_interface+0x10/0x10 [ 108.959329][ T70] really_probe+0x2d3/0x890 [ 108.959360][ T70] __driver_probe_device+0x198/0x280 [ 108.959390][ T70] driver_probe_device+0x54/0x3f0 [ 108.959420][ T70] ? __device_attach_driver+0x2db/0x4b0 [ 108.959452][ T70] __device_attach_driver+0x2f1/0x4b0 [ 108.959483][ T70] bus_for_each_drv+0x25d/0x2f0 [ 108.959507][ T70] ? __cfi___device_attach_driver+0x10/0x10 [ 108.959538][ T70] ? __cfi_bus_for_each_drv+0x10/0x10 [ 108.959562][ T70] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 108.959587][ T70] __device_attach+0x2bd/0x3a0 [ 108.959616][ T70] ? device_attach+0x40/0x40 [ 108.959643][ T70] ? _raw_spin_lock+0x8c/0x120 [ 108.959664][ T70] ? __cfi__raw_spin_lock+0x10/0x10 [ 108.959687][ T70] device_initial_probe+0x1e/0x30 [ 108.959714][ T70] bus_probe_device+0x18b/0x270 [ 108.959737][ T70] device_add+0x80c/0xc00 [ 108.959766][ T70] usb_set_configuration+0x1ad4/0x20b0 [ 108.959799][ T70] usb_generic_driver_probe+0x95/0x160 [ 108.959824][ T70] usb_probe_device+0x1d4/0x380 [ 108.959853][ T70] ? __cfi_usb_probe_device+0x10/0x10 [ 108.959883][ T70] really_probe+0x2d3/0x890 [ 108.959920][ T70] __driver_probe_device+0x198/0x280 [ 108.959951][ T70] driver_probe_device+0x54/0x3f0 [ 108.959983][ T70] ? __device_attach_driver+0x2db/0x4b0 [ 108.960016][ T70] __device_attach_driver+0x2f1/0x4b0 [ 108.960048][ T70] bus_for_each_drv+0x25d/0x2f0 [ 108.960072][ T70] ? __cfi___device_attach_driver+0x10/0x10 [ 108.960104][ T70] ? __cfi_bus_for_each_drv+0x10/0x10 [ 108.960129][ T70] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 108.960155][ T70] __device_attach+0x2bd/0x3a0 [ 108.960184][ T70] ? device_attach+0x40/0x40 [ 108.960211][ T70] ? _raw_spin_lock+0x8c/0x120 [ 108.960233][ T70] ? __cfi__raw_spin_lock+0x10/0x10 [ 108.960256][ T70] device_initial_probe+0x1e/0x30 [ 108.960285][ T70] bus_probe_device+0x18b/0x270 [ 108.960310][ T70] device_add+0x80c/0xc00 [ 108.960339][ T70] usb_new_device+0x9ed/0x1590 [ 108.960367][ T70] ? __cfi_usb_new_device+0x10/0x10 [ 108.960394][ T70] hub_event+0x2c81/0x4270 [ 108.960431][ T70] ? __cfi_hub_event+0x10/0x10 [ 108.960460][ T70] ? __kasan_check_write+0x18/0x20 [ 108.960485][ T70] ? pwq_dec_nr_in_flight+0x6c7/0xc60 [ 108.960514][ T70] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 108.960538][ T70] ? kick_pool+0xb9/0x550 [ 108.960557][ T70] process_scheduled_works+0x7d5/0x1020 [ 108.960590][ T70] worker_thread+0xc58/0x1250 [ 108.960621][ T70] kthread+0x2c7/0x370 [ 108.960639][ T70] ? __cfi_worker_thread+0x10/0x10 [ 108.960667][ T70] ? __cfi_kthread+0x10/0x10 [ 108.960685][ T70] ret_from_fork+0x64/0xa0 [ 108.960710][ T70] ? __cfi_kthread+0x10/0x10 [ 108.960728][ T70] ret_from_fork_asm+0x1a/0x30 [ 108.960759][ T70] [ 108.960767][ T70] [ 109.582365][ T70] Allocated by task 70: [ 109.586505][ T70] kasan_save_track+0x3e/0x80 [ 109.591178][ T70] kasan_save_alloc_info+0x40/0x50 [ 109.596273][ T70] __kasan_kmalloc+0x96/0xb0 [ 109.600855][ T70] __kmalloc_noprof+0x1b1/0x450 [ 109.605691][ T70] __hid_request+0xa9/0x410 [ 109.610182][ T70] hidinput_connect+0x241b/0x3340 [ 109.615199][ T70] hid_connect+0x49a/0x1a20 [ 109.619690][ T70] hid_hw_start+0xcb/0x160 [ 109.624095][ T70] ms_probe+0x194/0x460 [ 109.628236][ T70] hid_device_probe+0x2c4/0x5d0 [ 109.633076][ T70] really_probe+0x2d3/0x890 [ 109.637572][ T70] __driver_probe_device+0x198/0x280 [ 109.642851][ T70] driver_probe_device+0x54/0x3f0 [ 109.647867][ T70] __device_attach_driver+0x2f1/0x4b0 [ 109.653230][ T70] bus_for_each_drv+0x25d/0x2f0 [ 109.658066][ T70] __device_attach+0x2bd/0x3a0 [ 109.662822][ T70] device_initial_probe+0x1e/0x30 [ 109.667834][ T70] bus_probe_device+0x18b/0x270 [ 109.672670][ T70] device_add+0x80c/0xc00 [ 109.676988][ T70] hid_add_device+0x39b/0x560 [ 109.681657][ T70] usbhid_probe+0xde3/0x12b0 [ 109.686235][ T70] usb_probe_interface+0x696/0xc00 [ 109.691341][ T70] really_probe+0x2d3/0x890 [ 109.695835][ T70] __driver_probe_device+0x198/0x280 [ 109.701114][ T70] driver_probe_device+0x54/0x3f0 [ 109.706128][ T70] __device_attach_driver+0x2f1/0x4b0 [ 109.711490][ T70] bus_for_each_drv+0x25d/0x2f0 [ 109.716328][ T70] __device_attach+0x2bd/0x3a0 [ 109.721085][ T70] device_initial_probe+0x1e/0x30 [ 109.726098][ T70] bus_probe_device+0x18b/0x270 [ 109.730934][ T70] device_add+0x80c/0xc00 [ 109.735251][ T70] usb_set_configuration+0x1ad4/0x20b0 [ 109.740700][ T70] usb_generic_driver_probe+0x95/0x160 [ 109.746145][ T70] usb_probe_device+0x1d4/0x380 [ 109.750983][ T70] really_probe+0x2d3/0x890 [ 109.755478][ T70] __driver_probe_device+0x198/0x280 [ 109.760797][ T70] driver_probe_device+0x54/0x3f0 [ 109.765815][ T70] __device_attach_driver+0x2f1/0x4b0 [ 109.771185][ T70] bus_for_each_drv+0x25d/0x2f0 [ 109.776019][ T70] __device_attach+0x2bd/0x3a0 [ 109.780773][ T70] device_initial_probe+0x1e/0x30 [ 109.785794][ T70] bus_probe_device+0x18b/0x270 [ 109.790638][ T70] device_add+0x80c/0xc00 [ 109.794959][ T70] usb_new_device+0x9ed/0x1590 [ 109.799711][ T70] hub_event+0x2c81/0x4270 [ 109.804118][ T70] process_scheduled_works+0x7d5/0x1020 [ 109.809651][ T70] worker_thread+0xc58/0x1250 [ 109.814317][ T70] kthread+0x2c7/0x370 [ 109.818365][ T70] ret_from_fork+0x64/0xa0 [ 109.822770][ T70] ret_from_fork_asm+0x1a/0x30 [ 109.827542][ T70] [ 109.829851][ T70] The buggy address belongs to the object at ffff888114fd67a0 [ 109.829851][ T70] which belongs to the cache kmalloc-8 of size 8 [ 109.843548][ T70] The buggy address is located 1 bytes inside of [ 109.843548][ T70] allocated 7-byte region [ffff888114fd67a0, ffff888114fd67a7) [ 109.857328][ T70] [ 109.859635][ T70] The buggy address belongs to the physical page: [ 109.866031][ T70] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114fd6 [ 109.874869][ T70] flags: 0x4000000000000000(zone=1) [ 109.880054][ T70] page_type: f5(slab) [ 109.884024][ T70] raw: 4000000000000000 ffff888100041500 ffffea00043a98c0 dead000000000002 [ 109.892597][ T70] raw: 0000000000000000 0000000080800080 00000001f5000000 0000000000000000 [ 109.901165][ T70] page dumped because: kasan: bad access detected [ 109.907560][ T70] page_owner tracks the page as allocated [ 109.913255][ T70] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 630, tgid 627 (syz.1.95), ts 36763201624, free_ts 36674507180 [ 109.931906][ T70] post_alloc_hook+0x3b9/0x3f0 [ 109.936707][ T70] prep_new_page+0x1c/0x120 [ 109.941195][ T70] get_page_from_freelist+0x46bb/0x4750 [ 109.946726][ T70] __alloc_pages_noprof+0x30d/0x6c0 [ 109.951916][ T70] alloc_slab_page+0x6b/0x1f0 [ 109.956583][ T70] allocate_slab+0x69/0x440 [ 109.961075][ T70] ___slab_alloc+0x59a/0x8b0 [ 109.965677][ T70] __kmalloc_node_track_caller_noprof+0x23a/0x440 [ 109.972078][ T70] kstrdup+0x4d/0x140 [ 109.976045][ T70] kstrdup_const+0x45/0x60 [ 109.980445][ T70] __kernfs_new_node+0x9d/0x700 [ 109.985285][ T70] kernfs_new_node+0x154/0x280 [ 109.990046][ T70] kernfs_create_dir_ns+0x4b/0x130 [ 109.995137][ T70] sysfs_create_dir_ns+0x11b/0x200 [ 110.000242][ T70] kobject_add_internal+0x703/0xc20 [ 110.005429][ T70] kobject_init_and_add+0x126/0x190 [ 110.010621][ T70] page last free pid 611 tgid 610 stack trace: [ 110.016753][ T70] free_unref_folios+0xcb0/0x1570 [ 110.021770][ T70] folios_put_refs+0x4c9/0x5c0 [ 110.026519][ T70] free_pages_and_swap_cache+0x272/0x460 [ 110.032140][ T70] tlb_flush_mmu+0x7ce/0xaf0 [ 110.036729][ T70] tlb_finish_mmu+0xcf/0x1d0 [ 110.041310][ T70] exit_mmap+0x405/0xb60 [ 110.045548][ T70] __mmput+0x93/0x320 [ 110.049523][ T70] mmput+0x55/0x170 [ 110.053322][ T70] do_exit+0x910/0x2630 [ 110.057462][ T70] do_group_exit+0x22a/0x300 [ 110.062036][ T70] get_signal+0x139d/0x14f0 [ 110.066526][ T70] arch_do_signal_or_restart+0x96/0x720 [ 110.072147][ T70] syscall_exit_to_user_mode+0x58/0xb0 [ 110.077597][ T70] do_syscall_64+0x64/0xf0 [ 110.081995][ T70] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 110.087917][ T70] [ 110.090252][ T70] Memory state around the buggy address: [ 110.095862][ T70] ffff888114fd6680: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 110.103915][ T70] ffff888114fd6700: fa fc fc fc fa fc fc fc 07 fc fc fc fa fc fc fc [ 110.111956][ T70] >ffff888114fd6780: fa fc fc fc 07 fc fc fc fa fc fc fc fa fc fc fc [ 110.119994][ T70] ^ [ 110.125082][ T70] ffff888114fd6800: fa fc fc fc 00 fc fc fc fa fc fc fc fa fc fc fc [ 110.133125][ T70] ffff888114fd6880: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 110.141165][ T70] ================================================================== [ 110.149212][ T70] Disabling lock debugging due to kernel taint [ 110.179009][ T36] audit: type=1400 audit(1753485456.741:658): avc: denied { read } for pid=91 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 110.202513][ T36] audit: type=1400 audit(1753485456.741:659): avc: denied { search } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.224014][ T36] audit: type=1400 audit(1753485456.741:660): avc: denied { write search } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.238912][ T70] microsoft 0003:045E:07DA.000E: No inputs registered, leaving [ 110.246027][ T36] audit: type=1400 audit(1753485456.741:661): avc: denied { add_name } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 110.265481][ T70] microsoft 0003:045E:07DA.000E: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 110.277089][ T36] audit: type=1400 audit(1753485456.741:662): avc: denied { create } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 110.305158][ T70] microsoft 0003:045E:07DA.000E: no inputs found [ 110.318775][ T70] microsoft 0003:045E:07DA.000E: could not initialize ff, continuing anyway [ 110.321211][ T36] audit: type=1400 audit(1753485456.741:663): avc: denied { append open } for pid=91 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 110.344226][ T70] usb 4-1: USB disconnect, device number 37 [ 110.350497][ T36] audit: type=1400 audit(1753485456.741:664): avc: denied { getattr } for pid=91 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1