last executing test programs: 5m40.771927622s ago: executing program 32 (id=38): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, &(0x7f0000000100)=""/190, &(0x7f0000000040)=0xbe) syz_usb_connect(0x2, 0xb6, &(0x7f0000000080)=ANY=[@ANYBLOB="12010003cf7e8f4040201f7200f2010203010902a400018104004f0904870605a97a37020a24010a0b06020102092403050703020496062404029cfe09050b004000800000072501af82a7ce1932dc70000464040507250103"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x2, &(0x7f0000000180)=ANY=[@ANYBLOB="0303"]}, {0x0, 0x0}]}) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000440)={"240db29095245dda56286f6b1c099610", 0x0, 0x0, {0x74d}, {0x3916, 0x6}, 0x0, [0x1, 0x7, 0x8, 0x2, 0x7, 0x25a4, 0xfffffffffffffbd2, 0x8, 0x0, 0x1000, 0x1, 0xfffffffffffffff7, 0x7fffffff, 0x101, 0x0, 0x1]}) ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(r1, 0x4008941a, &(0x7f0000000080)) r2 = userfaultfd(0x80801) getpeername$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000005c0)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000006c0)={'gretap0\x00', &(0x7f0000000600)={'syztnl2\x00', r3, 0x10, 0x7a0, 0x9, 0x2, {{0x28, 0x4, 0x0, 0x3c, 0xa0, 0x64, 0x0, 0xa6, 0x29, 0x0, @private=0xa010102, @empty, {[@timestamp={0x44, 0x10, 0xb2, 0x0, 0xb, [0x2, 0x2d97, 0x6]}, @lsrr={0x83, 0x13, 0x45, [@broadcast, @loopback, @local, @broadcast]}, @cipso={0x86, 0x1a, 0x3, [{0x2, 0x8, "0d089ffef505"}, {0x2, 0xc, "dad343fda41262731802"}]}, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x24, 0x36, 0x3, 0x9, [{@rand_addr=0x64010101, 0xfffffffd}, {@rand_addr=0x64010102, 0x7}, {@dev={0xac, 0x14, 0x14, 0x1f}, 0x10000}, {@local, 0x401}]}, @generic={0x88, 0x12, "9eb6502907ca9ebdc178b12baa30048c"}, @timestamp_addr={0x44, 0x14, 0x88, 0x1, 0x6, [{@multicast2, 0x4}, {@remote, 0x4}]}]}}}}}) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x749}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000000)="03684a7b99a4fde940f3ec0d105ea2c8267323117153aa4a4f099c3835a607cd5cbd77b83cc33d13bbb6c6bcae59db739af84a4b5d34bffc145f3cc27ed3d4f9d9b3103699a1e1cc4ddfb6c1afd07ddfc18e358cd62649479724ce867fefc0a15041bee9f6084842fb982d5c2cf1488d668b741c64f0a6fd2643e729ac5a56462a6b64d5a0a751fda4fadf63ba0dc2fd14ecbf546918db77095545b41ab170e5d6e8ec8bf9ce9b8d53b832e90c701fe52af7999f8fd509577ead1be27891ada8564167f2c7d2eea1c1c9c65d8e151c58ddee43ec34e74d330ec50cbbb2bb21892c7ca995066e3cbea8a69d94dc6bcef5f3c0ef630e774d092ea58627f3e09c66a9c7d1abcf4f8f8af87f4269df288aca9bbf758275ce9695256e764d185a91a7570fca3aab16c75ecaff6b8dda371c3226d6ec6e55c5c4d8cfc5c33892bacc956a3613bcfa849da1b5e070a7911d7488b3e628d9339718e8b821f1bb5d5c45f0316bb563d0a442801412dfd5a4d61ca657e04d6686f7d5863d57954400aeee8e79be8f3cc4cbb3d4b91269df039c3d3543e500b90a2bdc6eb60cc7afab7b5187d88fbd76e6212ea29e872b73f925287bdc808b4a4f8ec7f8aa08bc90b29e217c3eef69d8deae4141f4f9bd110b7bde9320e7b45f422e9a6111bcaf99c9911e46e219d3bab477926bd5d2e78d4cd0eca133c232b1e863fd7799dbf609f3670b323e5518e8f4bd36e9b3da2c68a28eaec9cac688b4dd0b73adc24a8c7acc264399b7facbc2f43e8e40b6cae9f8e956d1dbfe259f12bae75ad362c354050ffdd6e954f2d7615fafce888bd6f672a81c9fd4318caba765069c0a425e898bf7611b77f0fe61c27d318159dba42f011900246c64557d27b77aef928ab04a147baca37863cf998a2ac30b903c0314449ddb218887c309ec7184c8c733f5d4e7b2d79516e9531c9a5becf8294d6ccd777f285b13160e1c949d3069c6c66c0daa62bac679bc9b69825398d1c290d765e882fa2c8708b20ccec885ab6785dc22696b61c109ff84bc5407932c3e5bf12069a68b8e3333a26d3dd390ef9bc01b86013fbcb5c28a1f4d2b8084f1502fccc4027a124c3629d8f4a8befd14b597cebda5f94f36050a31b95087cbac347788a71a90e87f2187fae600aa42719c05c2859cb30ae0fd58a7bba681f7a6027a00583071def2c9a94456e5d9acb9fd2d11fdea524582489c02377bf7f590948985c769b3822cb6366681d79113c6a6c752f2475caba77b7b2e8f293d7fd9b991f63e254c98dec94f4f3def4fee9cdb56ff3ba7fe6a718cbe9a7f04710e257ea8a49d6605266048fc122d4f3173d4b04b3e282bd3c5198d7fcb72ec38e0b07dd8a541b2807e601e5a0a01f07a281e0e1a261c65977088a54597efd0997c59647aeebb2605a89705eeff3ec780e302e24b23a0cbe4f81367c3f118545f01328d22eb8e802667389143166a9db9477c9b58eb5c76a19b8f8b2692b0d356003f08ae54dfc820d8e357ecbf91fb7e212cbef1262171abaf2f613a5bb59b783cad476fec50d16ca0ac13c08a59a3097e6e3fde700a4b987d10311fc22d4aa210956cd859799f78010e4c0f25b715876aa253df15009490f71be3b0022875161f537c70b14bdb9e2d87a5a11b414a1198533c7de6fc4d22228133bc26b19d9f1e7627b14c72e3c39d3fa2186a42e50a0d1867dc312f94c7209d51475ed4aa80b2ccb0557a40422bf7317de2fdf3296727723a2d23babd5e23f7c3edf4942bb485b95a122e6aba41b8f80f684f84605462448d5a4fd66dfe9bbf80590b9999b4780d4f4f189a20f4400b2975df85b584c8c8f9fa3095f13aede1f52dac98be358b0a0d72bed4df71cd23973e326179580268c4e5d1be4b2ae2e1e2dba913998faa6088af128fc8fd3ae26203a898882b67d86d63f6ee8f8e216337330db6d928facf9d0ca273845ee5b33a0a136aeb48b7c52d3b95fe73efaf06197ec8753ee0349f19db8730917d0f18a2de9602d3b887bc583ff64dfee67e2bdf4d5cc1c341b89acd3dd5176d2c15ec2a77120b8a49591ca438ae36c52845e5dca550e539da9ba2a2eda49be316f3d6d4b7c83666bd4759940347c29dedd273adac722630a940e104316b4806553ded47132be4e31a50600f5a4dd56825b245b7aae853f56f79e0ec31f7b5db945ee3bb92865acb0d8828598e77446ee50ecd8bf5e7ccbd963445a09e3be215709b0b3bff2e9d12e6549924338f236b4ff973682e2e03fbf6b167e3b3a0f8c3f3c1e8d0e21a71937c918cabab50dd74c011a1a5531cfcf88a5df5fa58f17715f7c7b3a64d9dab6f20a596288969191420ed71daccbae7c1ec88bf74811b5e1f4bd306f3d810c4f3600df2903ffdf8db40ac7153fd93327a1065cf2c4590c8ba9f9391eb6aa600cb42aff8793e4721afeb3d470beda45dad9adfc6f4fdb24eafc63792f5015c656ca37cee82b7ee382bda31d786d6e03d4c8611c4ca464e2360ca747815c9eebd38c8fc7d5eea2db96b29d771a96dc5c884029077125bcc31980564555d21ecce5d0388e1bc1e618c7dfb31b02b1a6730db7eda387dd4ceb96f65178bb088e81133e5086f73c458f84139685ef930945a51979faeab539e4964244709dcb8b38f575d3a3ec1328a0df65fb34241db7cb3250b8ae0dbc44670d2b5cc3a1785d8d281c05256ef2beee3b202d8bce053e55ce1fb2bb208e65d488ae24484b00c2e343fc3544ca546406688022db6e29ceca9539ec095a2a2cfc5f516230f75fc961c5de1e8d33222331f57db02cac5f9208029c6114d041bb1cc7f959f77511f5790a564600c018afc253e5ecd5010bd769b45a04296ca09e87fb63bf3d3b51dd8b3f6d4426a03c0944d09dff654c5718ab1fef063caba34029be6811502e8bb785011dd1e34b0c192915adeeb40faad0725a8f9a62acf61b944a271d20567f350cdee22d76e3cc5966ba742d9c43823af19ba74c60da0df0c5f4e7e26af7224147774a1f8ae09f929066e1769ffb3c40ba9fed13d2670b9e865a155426ed5c83648c0ad34e46f5308b455e0835730fe529668b606f3f52b0d04534d0e14bc0ff0f742359550e6980ac9978455adb3de0f292af12a3700453e035a49eafe98fc0d7f26e42a6c41f380448607b7c96291f98fa6bbd7e32c249a49171f8fa81762a490a1ce5c39d66d35c6ed6c0679440c06197c2e24d48e1de81c711164c02820816afb5393d3d6c801c3c062ac46d1494f52c45ca36faf94894eec9d71e1be6c7256f4aee8dc080156b28623c821ef8d1826ebf0a41332620f42589270e142561374c825e828e2bd9ae41fd34959db48319d54ffe7a1b58ae8f7361cbaee8e26e0e7e1b7f125f8cd99788825efd01c38ec987904190a0ad52bc20cd36cc7209f9269ac87b2fa44d2456661d3056d893cf912c69ae6b2b83d0c781a6d6c33df1910867b71257ab74e244e3ebbac07445069418fe2e440a384e16feedf8e3165676e67866430eb6a8a5334620d8c2cda15b0328bb0c50630886353f95241cf4f3b647a4ff812c70e1b074c4befdc70fbfdbf868bcc81652034b5bfa831f1b686724046dcd17ac91ace83711e9ec7465d14c9d508bce93676a58ef7dae37221436865ad34ac2fd691e3b3e12aee6736dbdeec9b1c05fcedf8b9ced547259a1a40471ebe8b4bfda69d2f884da025e2809fb9f159150bbcb331ca3c502012a7fe76b4fc2771976aeb624ad7f2d72c707f5f19d8ded84581ac5afa697ff99d27d88c9588fe769839c9cc9d6786a0f814667527c53b6253b1825bfe17e7d734d96d61da0ae7349d0922774fa9b4baf332a4568e32cafa417ec659c4ad72cd656a1e2c59c8dee38890ed3acd8b4f8657de41f670106c38c38ba1a553f0f589a57c61f5105d70e0c0953459383cb9337ca972cda1d2cd3056eb07f21c1f5b995a04997fecf501bb201c67fd2afe4d44fedea595969b6b3706087b0f59d2ddbb099d60436a94f0ba33282b29f6e914fe92add4b33cf70b680b905cfa2b2ccb00b9967f99806e8d69783fd35a2d7fbb424e9fde2647609aecb0208bc3864bf95f05e50ba12123edaca8de927b338dfcb3cc597947c606c08315061a7fec98c48f480e2febd26fcc8dc12289aeb0adefa2c2be1766a5bc74ef1aab6c2cdbdfbf1810d956bc889c8e614b7b933ff6e336bb208db5b592775fe71c3ebfad5f47e0d074e1c0cb36761481ec677794f23c3698bd35875719f242e3fc939bc3668f9723f31effe189dabdf4ebbed073eab952c88f13059eee22230bc7724d7266b15726a0b0898cdd274e3e56d0a356166b5d16456249e9e92e84e39f61c0ecdf99ec2cd230440c03fd21cf68f27306628d35ea47367775f39d20a07f3959b38d49e3674061fc1018b647047ad39f77027878badd29927c5806f95aebde5f070fed28ed34052550678d3c6b677a3b5a46f76a98264c42206bf62caa95df5437092b68e025ee9ce2ad733b6db3ec97fd33cdc3b2f77ee90dd86d8bd289ae1a437c86f4153ddcff5e846347bfecc1499bb42980e4fa91790faee1b1991dfead5d7c460348631f0469b2b9e8f65207a00985511e0c41f441d9a3154f5a0298c172fd7135d4bf95c11cdf1769db1cc55f392aec309037599327a7c53c10a56d1ace8ad19186a2fc75dfa9d657c114eae99c1c1a6b4a58440718bea82290bd1c2a67048938c381648ea2b2c7110d748c9c8d782f20430b1427b51d7036e55b0997c6f75717db67a82c88d3647ee036b49392f0467d6010b32f9de3e5e79ef082c5bb975d11d2bf76a97f7159c11a7753db8a065d3126ccda9abbebd2c54374e389942c24b27435868fadb45bb060d3c1084b211e2afa8dfaa2d8dab8dc47fe10e6c32afece7c4976176a7c66d704125c0948c238c843b41b0246be1f50f8e07884cfe7ae8885ca06339a339c8d5978b079e0eb78facfa1dc67ca70733dfefc6c868ca149e0661b70e0134870a3107c8c46711fed14f892d6fc66d95306838688f13b19e904416a8d161cc33527878b38ad10b1c08db21457b2075608be7300d39748e4fcebe02b190f3e8ed32a0ef734b11ca43a21f5f809bba795f5aa0ea01050021d0f5213620af5b08fda6421a42b7c82804a20a6ef6d471babf76f46538327f943476d1d109a3f0dc531233d6f93d8dc27f4745735085f92adf63d617b373fba24f289035710e69eb80da12d36e8eaec22620ffaabadfb824bd5fc309a2c74959505856b5b890bba8f22bc571a9d87e93ba3b9aba6dcf26f7076c0c2e271641835ea25fd49d96c69d4fb8bb8731bd2cbc75146aed10d269f9060462339cde8830b535920be3dbf143eace0f1ea9469b95a64fbd7e5057eb880d4422cbf97cfc3f7140251d4923580ca2113f345cf24a66499ceffd2e39dc4fd74cf448638962957b409f0d218c165c13ffe107aa1dd1d9a02092cd46cf2b353dd2d2ca7b8a7ae8eda0ee18bba269bbffed0c7d400497aee4da0896cf6329d76ccea098fbef9075412d1c2a3644cf0f202b884303d204314ae92c56217b2feb5e7c1e15a99fbdd655fb8f6bbc3ab1259bf03b2ee17c5b7e9443695177ec5040eeff3fc36ceafe143393d76a3d735cfe6c9b632e52dbe64dc1265961e8a27ee9f76c0add9e0581e474d7678214f5b64c932903715befc6b766611f1d7e495573b9a3e009cfcb0ffef7ac57c3561badbfa41c119e541180aa2364de61a601699cd1bf3de01d15794b728e1444efd6ffa1e57d95489c8df91fbc057b66dd6d9f3a01b19f36bc99f0b54ed1f9905067dd1608bce47f5ff1981a25184aacd39e331d8ff3dfa7c012d7e667a69249cb4803b23f7eeaab8ed29c69ba3d2a1b88821ffefc5825650c53b6364f38e0a178312f5d29d5375423cceabc8e1c4e51a566ba3f9b176b858c8860440ff8ebdde725640d2dff6b9160bb69f188755b0ff766b410704cda4c33e1ae2c73b5799a00d2f55de73109728b350302b64df2ce3eaf2e0c6561009b60c2701ac493076305e97ed20c3b42f40b2bc7f13bba4ab8181e2085b07930c6f5579205dff696902be824e65ddc774e886e8d261fe74712a31e406b0f7725b4559d7ad0f27a1a870261aa5bb8a720e7c89ba933770d48821416de070df1abcc6eee1147c20bda090d940aeee2bd48c0f3d94675d9b9cf1a62ba50e31a7af0714dd8325d5fb7142e88c4d22ddb8f0278ee6ba88e361524e291b6d000f6523ad4188b021da9ef4a634ed09eb2002b9c726746c9ffc32f261edb448106aa1e2daaed865255fd1d296fedbbb2de3f7c1f15935e52006492b632ad125aa1e000c9d71bdb945792668e16b26122a3fd7cba1a40db8083068c5c48fd2aaa621c87d9f5621bba442fc26839030dbe4e37fda4046d6503bb03e0f928de25d4cd4e2a40ec93c9021dfcbb25f6e2c943cc85eba8123340d6364949581e8c8c2913d59dafe4297672c0b9e7418485f00cbcf672a588904beb3c074bebf339815b91c7c374ceed5a701e1ade8f5d87ca536120116307ac259577a8e12958425317c482d2c7089bf3d83e12318d1526107a050f3c094492de7255b22e18ca2ff261b3ed197f2f8e67b71b1c5a6a04b99158b58e9baad75201aabe13254617d0de0a9073af62491c67fc18d1ccbf7686a85a99b39e9d7d9c85a0777e47c9fd0e10c932c20f13ef287b44b9b706ec818aa0c48a10caac58a9b8355e84bc820698c2501f0c12e1b67df701cfcbe72dc47a2c87d43753ebfdb24cc838507e241d9fcd3d4955a373209ccda903a3ffced05e4232f2cca9bba197fdba8a9357cb1d6da6d9b4095027dc03e17d59ebc2d358e171da0044df102b193c79390ebcb58023b40c621df71e064b0056bfcf1eaee1eca85357cd1ac78feaa54bbbd85596977ba85003ea60d8685f4e3b756e4f81453077396590fa214f672929e81569442023667b798c24e06ee20dbf64cfccb51b2bca4e2a5b0df137bb37ab3e2854dc7e1b879866a72a5809b563596cc9fd3e53abdbccfd5dbc60662252ddc5c290d72230d79b7504b40fdb45ded2f02e926652c1e04ea4c1c488025ad1098adeebe98e385ab1caec4b9eb4d3bbd5ef3ddf1fd0d72784604a989558fd37f6d4fee20609090b3331e254fec98414a2c54589ee01c9429b7cb574b9167efede1d966a227bf2a8e422f38680d77d3c555cf1117e7d7e804ad730c36a78b7846473d6481bd0839bd3e6982ed47246c370a90b76e5b88de202346fb20b8b6b5ecb6a90b8478d17b175a1821df75b48ecc34866fe5c8960bf64d5ff92831bb9357474bec65e0dd1699b0f0340ee5ac5e9e9d3df66edca20201371fc21ad80aacd49c6b0abcfee9c876c15edcfccde823b55b61cb7b254487ef8c8781a22043f4adaf25df34580a6b3904fd014b50c59fa90eff75fa5fd32aaec9aa10df8a2b9b824952e475c964533942bbe30f4167a11fc15d548e0a31f911030569722f0c67e79e90483f6f0bee1c7f80face1a1b0f940c891be688cb16394f6c07fd29b5f248c211d1f76ec1292755d8bd963e191b3a8851472fbbd2cb732f4fd9fef3a8fb29aea097328173fdeaf56fa2279e86fb954306b040c960d0b601b3a741c96cf1f0bd1172f848585cb3b57d7d2e2a84914526f5a6f9895cf5aa4425b4dbf9f59037756a0321bba204a737e36277e86fd268f6047921f4f8fab69dfee137c07874f12f89084e7117e2c9221690a27f880f17d08d56f9dbc96ffef3920b55fb773dde72e1ba35f3e0c9872e339508281426ab04941df4885f7e0293149f1642c2573e2b6594b8fd953ae2468cf917cdaa0692cf461e3628860935def39af78af5e1540147ab1c70c3ab7f7c76abea0d8541feb43e632d7a2cc7bef15a4700304048ecf135968d0a9644ce899aad05b186a2224bab3836248cc6137472203ebceb29b3e87610df12417ee722f309c54b2e65591d8b929440f3ec43ee9ff8f7b7710668e4312610d1591303d5270394da0ab61e4515af5215dc81137f0dc90f951972731f8d98ceb8b4ea38da7d8dc153ccbae5068781eaf9a4a7b11b4319090261b61aa65a8536292eb5392020eb285b2db07f81e7f764d65037050f1e3748593474c6c1dc11cfcb56e1c916157280098a437265e1c682cbfed717e7275bc6c3bb6c6ef7f0f9fdd19ef82ff2c82284c3a061f57b21d3705aff97710108a7d1217a7ea3feda021d20f1fdca94bbef67e0aeaa3db6ccc2d060f7b33707fe19cb2d0232f1239373bb38e666cbbbf3a697c6d0e957ec6730f56034440e789a7a37304d09eb742f21019a77c608cf578162a55d0aea113c051b110b5281ed8b6638d2b31604e965cb019f2f106bc4e96d1313c70612f1ff18afdce7926270dd242c49cc53792f160d1e143e04d7eb3ca40828b153fac466bc53a084281987b47b806a4ef668859eb9035ef68e9c20bd6bb790fdf6f921569b4e97fae5b7edc761b4944c1d6d90f4df40bc3203ed838d4c61cdeb7a9bbb68d59b2cc00125eecaf06b759ac1b9dd68028225d0a60efa499e4436962362727011eef6cc55962dd4ffe2fd3892907e837045883cc9ba8892ab265a31924f3055d4dee68feff05d9f10ebdf1e8c1c1e7001b5b02a7fe26b9c0641e054ae37854187fb1bb6e9fae05b09e85a1e0e14bc801f2d8b9a178a9a72b147e137e0d83192664a88a3aca4fb6a4f0c5787b20c31bc5975dfbc8bcff8987573bd14b1ca434d93452e67ed01c60be99e535bb3f848888d224520b61cfc1de2d6b2ebef9f24674c31aada52784a0b7b60f351653c71d546cf951e6b4a0d917ac6afd0a713f41833f9f74a3a7d3c19b523299666da2b48676ca7aafebadef05b3bbf4b6b62834046f51d3d4582fb4c9de27a3f5e992853368e4f17f9dba27c8c4438307fc7405f53fb27cc81c1521452a1a5edb0cabdf7a73b1cab0675b619fd5a0fadb7147776e74695c042d9d8bfda045bcef7542b42249f34c7590605d0201a762390f2fee5f3cdb488426609c663c9fc4dc2a5277f3f589a14e6dcc202dfcd89bb148a368ff1792d230c19934143d2c260dbdfb334af863b856e415febd22fba01c568d8f48dba6d92f493cd1164a376f006d55db609cc2c9532a9f56da3b06e3db2a05f797eed57892e2fb677541324bcd763cf4669e7a871e322d0cc6e21befe3c767976f058dbe7a059d673c94c7ac5d49178bf19d32907b6fe66a92cc8ea30a858da43f74354390d6e97021da50812c59a78915e5b33221531bfa054c594ce3a2300e5a7d712773181901dfcf6922e980566fa62b1f2b669a27fbecce29e9be6d22058463e350163f33d18ce92a72d1b470857b6a37998aec5672521a8f0d66ab2bd01de516036ec47d1f63b95b437dc6d5a0168189d5a963cb0a80a9a5f20b03515396e3525f0ab13b0c1e5dd051b4c930da6d57ab6f7dd94ab3e689e0355af0b34871296152a76cce170d7b14d471ee4d9daa93de4ed755f30d45344f724288c17e4b22583158f1305ff55fecf7d526e207fa609886e14c9a168bf364b049409f63590f18a5515de8c1fd8c5a9710b6e33d2ecd01466b799f14be787612b8f17df0c05483a16097c0a504880249e28f1e067663c640a550a8c7ad9d090f7b2e902c5c20936869a5f3d3a014817f90babf847b43cf67ec23f120ae4abc63a418d1d99f359fc2c33a5bb34e1f5780576111a88c5ede834bc41e498548ddd128f9e884f4cd3e1bf1aaa1204079ce74e709306f38f2d6859128fc35d3a74c534ff1dccadfc8fe41f1be9510349af8710eb6d2dbc758be12b65622dad1cf48abc2fc409f5ed6a3af8d0b6548643c46dfba9db4e5827475e6e317c9c018a4dd5de391cc9cca85ec527537e26949e5091baca4f0b563d4c3969f15115e5ccdeb9e40788fe12f9d32d9488a70ae53b819726e4483ea6bbcb76f99775ca5e4f93c76edae462c08d596209f985aa55ef5e786701edcee8d831dd6dc0fee9ad01b6bdd63e886a5e55bdc593390c81e18dfd8c685b81306bad6b7a19a86b2bab5cbf4754708422e99f8f2497d798b3db565e709bcbba4c376c1c60b22b994fe8fdcb25215d505511cc1927f6a35344023d5da0a3ac0830e6aa80f5f7f0d94a67c99c6b22717078aecba2a599daa2acc054cda25e3965172e5fef464ec19aa71de5e84b6de30cc673fbab8c441ea37bfb3fc321a504371bc0996702e9be38db762e339ad7ad66dc2caa887e4ab60272d7963f85b14c941d31e545b85c640427302efe7142f0e0897a8c623ce57da213fbc2d1f90677142fd48cafca0b2934e572833ed6473218d0513dd1f6ecc578e5a1109ddae552b3be0cfe7246d7682a59fe9ae783a0f318d1800d5c466c80c5fd3facd0340f455f081068dd2cda5cda744018d902217152b6c05d37c090f8348b0471053152c2a4570fbab3f6dc30c8e49a63b88a00b3aac75180a633692e35ea976821694e133eb8bb4d31237d002fce1dd2ce55528dafcef2f0e00690562d144bb0e19576ce6ab72deac22067d8edac916b1b07e4eb57ff0b885b1b79f37dcf88135eedc17ffd948b61e4df4985033bcf891dd5b1448c8668947a271d93d03ce31216810a6bb45a6c5a12e290d97a60ad4b5c7384cf19421ac1ca64d346b50771e0b50e5caf1d9dfe056e8da247aa502ff04c8e29ca810a1d3ec7a89bc17dba2936f03a80228171f7999b3f2768617970efe57b14011c80666ac4999a568ebef74e2ca14df0ff6f0fcd47c538be96aaca1e65b53b98447101e49672b48167c0afc1afffe669b0f9718bd3305805c292db9738740b362564e4691cbdf061db1ed3f9db1f8bed82939f835d14f46818e3eb4e25f7a8d77d9d0d7913c45d8a81115c1a5e37b1d3bd1b7b5e6afaaefc81d9700bf83506fbf15457bc0f59f7008cc803efdcb6d39e388f6b28e80d47134265cc5438804b12d50e61a489da829dca05792d2ac182ba747331e88a7118f7dd38067f7d38f37be362260effacbc33863bb47aeebbadeae648a1090718266eedd2ed5a2c23f168759198aa92b2ac45c2a68ff212f29260e641a38541b066d39df4e95cd1c8e7e6ffae1b8017e6f629db3910b07496c8a81e4e66ac2321fd9e7ebfecf5bf6e922d7a79fb710a2d42dad1916c9b186c2c50c818fdb1afa19be867d943ee98f732fe3a01364281c0f6d0eb64a278721dc7bff5316256b0f4251abbd9b8ba7c7c12a3bf02a1fbc9ca94b965588fbc82343d07df8e06eaa5ed2137fec129351d80a9048a7d78b31ffaf2e388864a763c4af7aa53000e0bb2eb8ac0e4272cbb79dc6a7d65890f125c523c7cfddacdedbe87938aca915c92c807dab26be7d748827d4e3188676312ef1ac8460b29e8e715f4075e33104ce82e6785aadf17a7cf82d2a705e9f2d0fd25810ba33d76e54b48eda3effc01f37c89db38af81922fadc8c3361fe74ed51eac5e4437108106ffdedb339b406c082d62a8bf718989846d23f966e1ea39103010f767b3a6f0a0a2041b1dafcb787e69ffad75ed2a0081b92a4136ad5ae557c55a4b6219a390103428181ab36f329ad182a92957495c", 0x2000, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$TUNSETIFINDEX(r4, 0x400454da, &(0x7f0000000080)) madvise(&(0x7f0000c0c000/0x1000)=nil, 0x1000, 0x4) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) readv(r2, &(0x7f0000000480)=[{&(0x7f0000000040)=""/64, 0x4d}, {&(0x7f0000000540)=""/123, 0x7b}], 0x2) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000000)="0900bf65653f47f4020000008bd458d1e7cbdaf300000f34e7e4165f081ae36850f6d15c3e681411f7a496c0da04003c242f5bedaf6bec340dee49474362b24cb800edc500", 0x0, 0x48) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$netlink(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000740)=ANY=[@ANYBLOB="1c0000005a000100000000000000000004000080070005"], 0x1c}], 0x1}, 0x0) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x168000, 0x0) 5m16.885300823s ago: executing program 33 (id=405): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000036000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000003c0)={{0x30, 0x3000, 0x3, 0xa9, 0x3, 0x3, 0x7, 0x7, 0x0, 0x2b, 0xfd}, {0x4000, 0x3, 0x3, 0x20, 0x2, 0x7, 0x7f, 0x6, 0x3, 0x0, 0x3, 0x6}, {0x3000, 0xd000, 0x3, 0x5, 0x1, 0x1, 0x0, 0x9, 0x1, 0xa7, 0x1, 0x81}, {0x80a0000, 0xdddd0000, 0x0, 0xe7, 0x5, 0x2, 0x1, 0xf8, 0x8, 0x7, 0x6, 0x7}, {0xdddd0000, 0x2000, 0x8, 0x44, 0x5, 0x6, 0xa, 0x7f, 0x1, 0x0, 0x4, 0x3}, {0x80a0000, 0x4, 0x3, 0x80, 0xb1, 0x8, 0x1, 0x57, 0x80, 0xd, 0x1, 0x9}, {0xffff1000, 0xeeee8000, 0xc, 0x1, 0x0, 0x5, 0x1, 0x3, 0x1, 0x5, 0x3, 0x4}, {0x2, 0xffff1000, 0x0, 0x4, 0x5, 0x7, 0x1, 0x37, 0x2, 0x8, 0xf2, 0xa}, {0xeeef0000, 0x5}, {0xeeee0000, 0x4}, 0x80040031, 0x0, 0x80a0000, 0x2004, 0x5, 0x0, 0x3000, [0x8000000000000000, 0x6, 0x15e, 0x3]}) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0xc1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r5) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="c6547e22bade76f1a03b79e954ee20b943f7fe47218a02ff8ba942478a7b6946e9a6000055002cc15e854564e7d309f20d222f9220c8d9b1b0d196137252587ab1794808000000000000000e647c2e70"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r6, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000500)={0x44, 0x0, &(0x7f0000000600)=[@reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r6}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x2, 0x16}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 3m21.217346416s ago: executing program 34 (id=2754): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC(r3, 0x4068aea3, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000240)=ANY=[@ANYBLOB="080000000000000082000040"]) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x10b701) ioctl$USBDEVFS_CLAIM_PORT(r4, 0x80045518, &(0x7f0000000040)=0x1) syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[], 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 3m4.209152684s ago: executing program 35 (id=3033): mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='ext3\x00', 0x200000, 0x0) fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) (async) r0 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x1802, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) signalfd4(r1, &(0x7f0000000080)={[0xe97]}, 0x8, 0x80000) (async) r6 = signalfd4(r1, &(0x7f0000000080)={[0xe97]}, 0x8, 0x80000) fsetxattr$trusted_overlay_opaque(r6, &(0x7f0000000140), &(0x7f00000001c0), 0x2, 0x2) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001a000000200001801400020076657468315f746f5f6873720000000008000100", @ANYRES32=r5, @ANYBLOB="2c08c8c620ae1b775be52ddad545cafc48961a68bd840c192e51e7ba670cc639bc1cadd1a245282e78121ed0c2c99dc671b3b422291a760738dfa58d3183168545e0feb2f806dba4c977cafae348e1b3f34344ec09421ec144c1ee7ecad91f9e4d3001f20d5200ab68"], 0x34}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001a000000200001801400020076657468315f746f5f6873720000000008000100", @ANYRES32=r5, @ANYBLOB="2c08c8c620ae1b775be52ddad545cafc48961a68bd840c192e51e7ba670cc639bc1cadd1a245282e78121ed0c2c99dc671b3b422291a760738dfa58d3183168545e0feb2f806dba4c977cafae348e1b3f34344ec09421ec144c1ee7ecad91f9e4d3001f20d5200ab68"], 0x34}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) (async) r7 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$selinux_attr(r7, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) (async) write$selinux_attr(r7, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) r8 = fsmount(r0, 0x1, 0x0) openat$cgroup_procs(r8, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) (async) openat$cgroup_procs(r8, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) r9 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) ioctl$PTP_PEROUT_REQUEST2(r9, 0x40383d0c, &(0x7f0000000040)={{0xc161, 0x2}, {0x4eb, 0x109003ff}, 0xdb3d, 0x1}) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) 2m58.060574022s ago: executing program 5 (id=3148): unshare(0x62040200) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000080)="441f0803d938fd27fa00000005004ef564918000be0e1c2074ed27c1c6", 0x1d) getsockopt$inet_opts(r0, 0x0, 0x4, 0x0, &(0x7f0000000280)) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0xc6225a99193a0f6e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}], 0x0, 0x0, 0x0}) 2m58.030978833s ago: executing program 5 (id=3149): membarrier(0x8, 0x0) (async) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x190) (async) r1 = open(&(0x7f0000000040)='./file0\x00', 0x85a8c2, 0x1c) timer_create(0xa00, 0x0, 0x0) (async, rerun: 32) fcntl$setlease(r1, 0x400, 0x1) (rerun: 32) r2 = open(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', 0x1a1342, 0x0) r3 = syz_open_dev$loop(&(0x7f00000004c0), 0x8, 0x4000) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f0000000500)={r2, 0xd54f, {0x0, 0x0, 0x0, 0x4, 0x7f, 0x0, 0x12, 0x1c, 0x10, "479819c9e84944d9ef87eeec7c2380480cd473dcdb4cf693e3f061a96e189920549ba2365a16ebc8105b367149694f53ad70c80044ebe221d85c297398fe5e77", "369198d51e594843b3704dad71ffa203fc9c778a70f437a9581253e7e38d3eae5ba7dd11b7f21156027f5ba57ff905324c1e14d9f12faaf167f6cffe3d27cffb", "a57c1c984fc6e974865f7c2c3eec7964150c0ec4decd118f6f340389629b5bee", [0x8, 0x5]}}) fcntl$setlease(r0, 0x400, 0x1) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async, rerun: 64) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) (async, rerun: 64) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0xc6225a99193a0f6e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 2m57.953072815s ago: executing program 5 (id=3150): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x40980, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) write(r1, &(0x7f0000000300)="2400000021002551241c0165ff00fc020200002000100f000ee1000c00000000000000006e", 0x25) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @none}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0xf, &(0x7f0000000080), 0x4) r3 = socket(0xa, 0x3, 0x2) sendmmsg(r3, &(0x7f0000001b80)=[{{&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x362, @loopback, 0x9, 0x1000000}, 0x80, 0x0}}, {{&(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x6, 0x4}, 0x80, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000000000029"], 0x18}}], 0x2, 0x2c04c884) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r3, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="58000000030805000000000000000000050000020c00048008000140000007f80600024000000000050103000600000005000300060000000900010073797a3000080000050003003a000000040004800600024088f70000330bdcb0272815924d2cef2ac2f1ebd6b201cfc5ec1bef6c025b7aaae1fec75a46f59a39b99916a35cc0268a55a46675970cdf"], 0x58}, 0x1, 0x0, 0x0, 0x4040000}, 0x81) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x4) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000019080)=0x30) 2m55.952981593s ago: executing program 5 (id=3167): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000003000000580001800d0001007564703a73797a300000000044000400200001"], 0x6c}}, 0x0) mount$bind(&(0x7f0000000040)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) unshare(0x22020600) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) read$FUSE(r2, &(0x7f00000005c0)={0x2020}, 0x2020) 2m55.914737454s ago: executing program 5 (id=3168): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000f3ffff054d564b"]) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) r4 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x80000000010004, 0x12a041) close(0x3) r5 = dup(r4) ioctl$TUNSETDEBUG(r5, 0x400454c9, &(0x7f0000000000)=0x2) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') 2m55.800841446s ago: executing program 5 (id=3169): r0 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000200)={0x0, &(0x7f0000000000)=[@wrmsr={0x1e, 0x20, {0xae9, 0x4}}, @uexit={0x0, 0x18, 0x7f}, @rdmsr={0x32, 0x18, {0x1b}}, @code={0xa, 0x61, {"660f5b1d7d000000660f063e660f0137b99f080000b8c7750000ba000000000f30c481f851e7420fc7fb48b800580000000000000f23d00f21f8351000000b0f23f8c42261ae0a417400d295c19d0000"}}, @rdmsr={0x32, 0x18, {0x811}}, @code={0xa, 0x77, {"460fa3de66b821008ed066baf80cb8cc3a9d89ef66bafc0cb86c658d15efb92d080000b850000000ba000000000f30440f20c0350c000000440f22c0b805000000b99f0b00000f01d966430f63e5420f07b9800000c00f3235004000000f30b9520900000f32"}}, @wr_crn={0x46, 0x20, {0x2, 0xffff}}, @cpuid={0x14, 0x18, {0x4af0, 0xd403}}, @wrmsr={0x1e, 0x20, {0x490, 0xe}}, @uexit={0x0, 0x18, 0x10001}, @cpuid={0x14, 0x18, {0xb2b2, 0x3}}], 0x1c8}) ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f0000000240)) r1 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r0, 0x4048ae9b, &(0x7f00000002c0)={0x120000, 0x0, [0x7, 0x4, 0x1, 0x80, 0x4, 0x1, 0x2, 0x8]}) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000, 0x6, &(0x7f0000ffd000/0x2000)=nil) ioctl$KVM_DIRTY_TLB(r0, 0x4010aeaa, &(0x7f0000000340)={0x4e, 0x1c00000}) r2 = memfd_secret(0x80000) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f00000003c0)={'lo\x00', {0x2, 0x4e24, @local}}) ioctl$KVM_SET_SIGNAL_MASK(r2, 0x4004ae8b, &(0x7f0000000400)={0x7e, "b41e6fa0df0969041288b97efe7e2cf27798abaa6ad55b4f56de234853671172ab4f77357e9b216c4088a5e5ea5b59f9321d711f9095ee07df7b42d7360686ba53f7ec1384e23763079b0da87252c958e79bc1a12245ec456c89aebcd800139fb6b3194e3dfe5f98be0c071186e0525877e385b8207447e8cdc95e9aedbe"}) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f00000004c0)) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f0000000600)={'broute\x00', 0x0, 0x4, 0x9b, [0x8, 0xffffffffffffffff, 0x8001, 0xb, 0x53, 0x6b22], 0x2, &(0x7f0000000500)=[{}, {}], &(0x7f0000000540)=""/155}, &(0x7f0000000680)=0x78) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r2, 0x89f6, &(0x7f0000000740)={'sit0\x00', &(0x7f00000006c0)={@multicast1, 0x0, 0x0, 0x60, 0x0, [{@private}, {@multicast2}, {@private}, {@initdev}, {@private}, {@loopback}]}}) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) fcntl$setsig(r3, 0xa, 0x2d) ftruncate(r1, 0x3) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r2, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x34, 0x0, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4041}, 0x44090) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000880), 0x20000, 0x0) ioctl$SIOCGIFHWADDR(r4, 0x8927, &(0x7f00000008c0)={'ip6erspan0\x00'}) r5 = syz_create_resource$binfmt(&(0x7f0000000900)='./file0\x00') execveat$binfmt(r4, r5, &(0x7f0000000980)={[&(0x7f0000000940)='lo\x00']}, &(0x7f0000000a80)={[&(0x7f00000009c0)=':@:$${\xf7{\'\x00', &(0x7f0000000a00)='}\xd7\a!]:.\x00', &(0x7f0000000a40)='\'\x00']}, 0x400) fsync(r2) getsockopt$inet6_int(r2, 0x29, 0x33, &(0x7f0000000ac0), &(0x7f0000000b00)=0x4) writev(r3, &(0x7f0000002040)=[{&(0x7f0000000b40)="c92bd05d80197300ccd23ba4d2f5ae329b44455826a035a0e3ef870ff8ade6c83374d3bfdca86442a62a5c8dbe3d66776e62c46f7b9849dbb19a1bb8625d1f361b5f4dbc385c3d21ec9d14426cc8f8615a0a41d1e503792341304efbac108a767815f5d75bb7e8de962b134da789e819e504ec40d3950c7ebb56494afec8eef4526dd08bfeb88dc2e1c324c0f4e1c2ad90cfa20314bb9cc5715d", 0x9a}, {&(0x7f0000000c00)="6d293fd4c95ec9909547b04c5890d780335855ae82c83addd7dedc3d5252b4492f40aca61e503e5d8d3b04a084fdbbdf8223b7745bdae6ab6b174e02d16b16a52864dc27dae42083c369f096bf7ce47b9d0a0d6e6c8d89ea5cbb1869fda98f5d138cebe6997178ae9bdf61795c184df1aba8e7d09c440965299c3650bd58ffc3fa407dc3e678cd9beb1983f8f125739b94e267606b5dbc6d5bf1", 0x9a}, {&(0x7f0000000cc0)="d5e608673cc8b34c737407d0", 0xc}, {&(0x7f0000000d00)="8c34b2417e0b4fbdd9a6ddb08223184a70728a4888b9237c46d7b580ffd771fa19c662758105ebe52836f2d28ec32d01324d2f9fee57d41865ed7c7ba67bb56b119cc18a489273433ee5e4f75b59bfa413b2389ae69beee5f8af93f57d7ece95", 0x60}, {&(0x7f0000000d80)="7f643cd45f50d4bed34be31f5c888d6e7023e3dea6cee81ebeb7ad49ca2e58e785cd631de743162850dd97c922dabe8c86a0fe6e77400c8ee763350223c612f1a3225b0bf504260cde8454e9805aa1f989b7fd4fd849b2a65abe89868bccef61eb84028ac6dd0e32eb55a176a09b151f54488d2251a868af115ab33a9f5699f8b73e95b74737c08bec4611217b8b5c7c89d25473929ae8bdd361ce9bc2722d85fa8c58767567bd579283a7dda8577945cb3b19d47a8d3627f62382f0eb851544", 0xc0}, {&(0x7f0000000e40)="5567c19efe55b59fbb608228bf105b493960b8e8129b37d06a585dbf0b6c0566c537ddd46914c5822d4f86cafe1faa7faed290fb1d41347c455cb8551e019347f6f826c995966fa1c0fee43dc3d10adbb4e955283076bb2a794b70d635f7583dc9e3930fbcb4ca36689f147857af74c1b68ab8ce15e0de9f798d469ab36d494d8f3d1a4420498428a7604b54ac5fcd6230d554cdb6a12535a1421131222ce10cacd1a183907e399ac7d9dd8138912c30a9a9161c6bc0265942fb", 0xba}, {&(0x7f0000000f00)}, {&(0x7f0000000f40)}, {&(0x7f0000000f80)="8f141b28a9b60b0a6c3f211c1bbd912b57434f5636a8e1f76fd71994dfc3e02024d2198e7a38996b018a9987783f10e7df6cf272e4203ac1a56af17323e971bf979c51935ad3ad4385d93fc1747e3be08f3ae96e3997ac86f5c454f2c3aaa5bd74556e8dc602772d44c773a9ce1912ab51dc3976d1e2ba84390c7d2af93c87796dab9f644dc6b6ce439da7bbb6c43cd0db4a946ee09bd9c546b245d7f6c0dd2047fabe3ae92bab989f75234e2d552ed1108a633080a1793cd6039f42e705f4709cc6703a9d438c3f7f359908373287edae399ec852bee8780bd4119ca1c181aa13a1028545912acf7fa24510c0b37ababf41482b8365f531c40706f44918ecbf3f6d4957ef7c1cba2adc95a0e578428aba7677502bcc7c1efc10627d2710c1b73835c8a33fb70382f1f98e16e4b70c93c77f90a315050489cded0f9b113e1d1e19cac194e985bb50e0f9b37e967592d96fa8f704cef929463b3d18d578bcb6fb6b7c80fa90b42309027e96a86655458d7b48b63d298874a4b33e54cc204381cf02e45fe053793933ca044796ff74cabea164cf2254384ccb13c39562101e86dbce31003429401d0284570e8e105679c533e2318fa441896ba40c7a8a146432033a254fe55dd028443bf5ad1ff0ba96ef8ddefaed7ffafce15d81c8e1fe3058518244a93f8851a2263cdddeec518b16aada895c2cfe9002000576fa82d9a3468976740c7e9423796e88747bc8abd4d0bbd4204be9d17dc3b76d9725e32f239287aa04fa9ff78c17d1ca5cddc4adfc648f6eda5bfd4582c934a41ddb9bc3b659902345b82b6aeee285c25f1a3f44bb55398ad9f11bd7e52312458271b38015a121ed8bd0a0bad90396855d59339209e80d3fbad2b7a371ac93e01c12766c4775695f94d73175c2f4762f4cc5cc0b302b603cf55744018d3adf9dbb786b807034615bf2f729f5017cd1a4528409e14cfe1515b7a039ccd6c712c6d94ad139b514ee1ba170f8911c6fcd3317b648a4260f84e0739b20c717556150b820a75b7834049b2d4247b435c9407f053d7fa53b00349b17b389db6216e8d981b4d4ad2fab5ea498c34658aa28a17528c528d807745614d9a48d200d5f507127b663cd9f446d81455ae92c5ebc43ec07a05d15b61041c148cc4d5de00423a5dcf87f852fa77730715fa08f6f5248d6ea2d9b4f3d7019d16b713b905f1fa78cc8546457317b94a7d331e197f3a04eefda22562bc39f5c9865dcfc6d37f8ffa6e7da804454c12043075e126ea6f39d8c6f33f62e78da3de8f038ec36794bc2633ee7d70b284e452bfd8a40c9bddd1bd8513a0ee0134aa30952f7c5231f48b80ebd27fcc697486a9296b230eeefdfca915d82b0277e438f36d1df998005c0220c87e4d68c25f612683f54ee9a014b1f65984e1f1c2637d5686a5097800001dc0415684e9d2b16cf659b4bddcaf8659b40e710c52b26f4de41d6276887e116ccadf0b3d98d0b0bae7b63bf025e48529a451f46a71e638ed24b7c33d9e3293f1ac5b4e89f8d6e0793856a88559e0007410184c9490a9cd981008d9e5e30917057bfd16c073e96c7e78ddeea065e0acea81c0890ff3827ed50b4f3bc035e5aab0de515bd5279be4a4a609304d3888508c35c83ac877da8e330fb9e05a39438db98bb680bf6ac8708fd83a11ca2db19ff0d217d7e2c936062d81f1d196125edcf229d4904ba248134372fdaf3b19f26b5ce1567f0ba06aea58724644d55a19b82c0e6a4d4eef79de7a2240d03545c757cf06ed253f006b7863207c084557cd5e0e9dbdd03ce90508792c85f944699fcd2a62f881f499a9b412c8605d517b3910b2c748ab9497b3f141080b1ceb884f7af49e4643857ff9c8feb221784861ab3a9a25265c6a21f526729ff8ec4e70fac6abf1f02338eda8ea3a3aa39f363b8b5e9e0c2b5587678b6fb7e19c3d3f6095933e68084fa450fb3eddbc1326b0a14be5a3fd0d26c5d9e7d956f950fdce9611a9e97158672d3088aff0c932ce062b48da8ae9f540232b7242014a15b3f9513e780b282e9035a341da0da69f5ddad02fbc18cd675e1d55d0ef509ac50feb055c53bbefdc0a0307ec3decd9c0bd660e997265bb6efe8340ec8cfe88f8277bcfc95380f2f199b0266d2dad0935cfa39cea737df2f55a95e1855fcb23091004d125af0b93a15ece3e1daf491e5bf25b865e2b4e1635685e5e0e205d3c23936c307935b9d89f63be0c8bece4be25f4b4fbe4519bbd0c93ac57df5aff82b77051e8865d30f3ba185e2c85728d0944f2644e710896ed48750d1baf15d093ef516bd5c1d5129c8d37b849d6d943d55412b5bd81f26e1d6335e87501a62693f8034c9526658a05e16798ac12c4fe0ebc8e8c013a135634cfe26ff42101d85761b827f62bbcea932689e0dce91a621a140ba7027833e4083eff042f0fb052db953fb3cb7d0a3dd9466741afd4b5eaafc68545d0b00d321d3bb121aeec90e3e60a1de5fe5f25a82df627766ddf2f8ca8794260cf4d72ef4783b0f488a6fd05d72affed553cdb5595dad813dbf7b2e1bcf49f3263ae27d8e033ed010651612236bd871c4de1ab0c94853118c9385692a380f8fd75f8a5341415ee5327eaf61f358e5b3a7c53a35878d24b9417c0328b6b8afcc82f3684eaeec3e6f153350eaf1302995bf41bab6b8f7f4d1eb6dfc1de40f140dca4f6749c5b3821cf6c3b27e15ef24f9b05287680b450f8b5d23df058480c3074e7dfc09ab0625b999dd29564e6fb0b0f76d7d615465808c018ee5b4c7bf6a7f3a344c9c905f8bdf17c3ca0fbfe57537c3ca5b69bec57d34fff5ddd7c660245d0ffa121073af00c3139792baf4b9d952b578a998e9a7468e1ba4eed5a26b400493ec8ea0fad7e2942e8bfe069a26c62a39f37589b0dd7b9643652a493952505c01d114598bce3e83df4bb484da6ccefa48ec76a17a4fa46f4ed443e4ae2e42395a5c057667b931881f54626ef9adb0cc8b6c989a835bdc614b055880f44f531e824efd1a65dd3682d29679b55848b9fcdfdce42288c4d82251f027e1cfb055e1fba2f69b190f7dd9b2cd73d0df1d45d8145dab05d3bcee62e4b492fd60743a74b8f56b4238d480d40853d2d830fb85e28fb3500b444c8b0782f006f9eb9e95f59808f6eb36dcb65147f2ebeff3bdd527db5785756563da0f7c855807650011d00fe2f03c3ff2230484195746164794eeb07553b36e8a298a8540e672a6bda1996556ad0ce4e7ce46d12cc2734bbdedc0674fba38d36276ef63bf311fa7dbe03752bc31b50da0cebd863f6b58028c4d8c14d175f1eef14359802aaa5e8143c02b0649c097753561be5e17e28244500da11f4cb78856c9309866114d2df58ed3bcc0629a8c12be6b25ebbbd5b6f3a44e28714f045677125f74414dc59584a23bdf37c2597226c794e98768024a4da8211ac01552c0e46d20096c38379d08efac1c379fb1ec4631a121e1941685564528e139f32af3cf5c8dc1500c7b8990dfc807d6f802fff783bca13ad2daf7291434553652bfaee22aada1be4310cffe07cba07743a04b28e780d0d32f036df689fac123964afb824f7e8128641fdcc6da4ee36cac7efeb99444c368ae9635e1566d9906e2b701726574cfd4b7e08a32b53d27f4b3eb4a975f418eb32dcff1051d12a301ad26f07a8bd5ceb3641632b927ea5d8727e2e9a1eeb557f012e59f175a9676a3afe2a93fbbc47d634cec84ed8554a08dadedb160385d5e236417e853bcb80caf35eb4b6a8d54ae8b16050e0843004ffa85a99025b6953fbff6d1a001539c84ccad63d3c1ca37e2bdcb4cb0798fe17c76c58cba7915f63f5ecea6304ab8bb3889cf3934482392ed2639150ad4a963ab30360d90d006df5f58cac1d4d249dca8e4ba1a8bc3d0a50e9162b4aaa77ef52ff72dedd8be5f03606f3113efed43dfe0fe22487408174a6585652d63e230fdb2b68ed983d0022387d4fb3c50d84cbdde97bdb8c34b449bc7b36ea782d4774c05a2fdceedde28b6bcc1bfa6d34808dd197e7a2851ae726fbe130b3534f116ed2186f1e966e39d905ae70aaa2d794d169bd2dada5173ca793b97d7848c5cb9f4fbcd50bcc7910d0195a926c03842db45bcf048e5c113d628c11e5484bfc333f30ac9e1eaf9ec394bdbeef66f089b56cf15216f779881690f16696a5453e3c27ea2ce8c44d809238995faa04d9101863101c82d4ee283a9ad5c51acfb9cbe1e747c9a245b4bf3b3487ea9fcef08ae22d2d5fa348d85a3307a21ac1d5f46760d29146a3d2d405357ba2d7693ad0153c998b6454aedd246de696f98a6cf1cdf9a60167faf0f8fa5a9392bf99bea84a90b1236a5e182a8e05ec374935085cd30a15493d699bcb04607e5d6998e65d09608cc825861abb1188cca75ffd18fa5db13a9545c1fc551382e4242ee17792bbdecd710b7d1ed6bb5611eb9be07e77108c830824851d993e5b88de2e92e0d66e2ca53fade85522f2c06dcd54d8ab0f2ee80023a70dc937c205565dceeee4689dcd5d7f5b8efd16584c107fe3f0428282f86b3573c0358188637c000284f096bad7a382152b0368393cea0ede1e6243b175627beaeb6dfae1be108d1c069944f58772a24b18670c6d94762d494ae0af84caf72cd5ba4c4b23b396f3a177ebd60991292f5c1cd11ef0b8a3a77f8c344269134450f7bd10467e73d1ec83e3ed71ad59ad2eae6b8e457b338975f650fa6be2e0cb6426db37152afc0bd1b3e552457160c49384ef1258081ec1677384e390d4f8c38c3b0463a69111bec39a712c17ce9baf4a876a593cd698294c8a71b7b5b5cbb9f8d9f9155be6ed8e8f3b4fb57bfbec5a7c73f001525d7807f415091b0e1dd2ed0f5f7ad733057e3c29e95f35ef8fbcb9981b4982d41ee8f1479e72422379fcaf65ee6a156b502141cee09ea32a275462186321654cce2007257d8addb6625a17606720e77c79095634a13a11e67165c1217079377f38544a22726442858834c82f4059c7f5dff242350ca03b6a64e1cc5933cd23c461c4b4fd9a46cd1a12317b5618106a61a13941f3417455445acc2350e3dcab4881195996f7439db96384a166d0f4104d70afcb6415b541855e100e2b176fb3814822ae16a389d9b9a653f21b3757b3278d83b198c0ae54f8cd7e8427d0d9e1881487a8a84e0762fa0174ad1735785343977a2ae8d64919f24676ef2456f2139351c314c7c433ac8876012587d61fcb15c2dbd5719d0b66246eaa9b12856a35e8bbd2259c16f2498390ca520f5a079ea657031d102906050e02376dbae2fd40d0b1621cddaf6f05c3a6ba6c969d70ca9398470e25c86e613be31789c548bc43da4ce6d6ab0d4c4940ce7189682f39a109749ea2091156ccd052e5a413ae4d701041f06236255f32ce62c0273019795eac37edc4c7728aed77f1b5c390711b78a3ae8b482011b3c806b9cd481e4c41c79d0691a665ad80988330d626ec8f48008dd1e6dd04bef664c640554cd3e563bae744ef164f9e9f6fe35acf835e281876b3d0313b212504f0ce1c11df8be4f1105ffbe6643c8c3b790043be934b72c3cdde7710f02139d0b50ce311db060f8e074e9f6da4d8bd16792de94aa4aa76e867d324843348f6709c4b1d3226c626e900d6fa6a95b00d431a181f3004d979a344654e804fa791e0cbcad9bc3047b4084927be4ff1482d54db01a00126d096aed3181ba03b233ed36c7f1ed026d9402fef59587900bffa432bc90d880994a1b21dbff275d6408b638a46dd025b828dc3a8c04183bf52c4d8796a22c", 0x1000}, {&(0x7f0000001f80)="18eb61cdc4f13424240415fd219162ac15897f1bcf4cfe95a23aa396c8aeeb88783c10fe140c418d9f01620b808f57746474dd070242bd9b4fa50d9b80cae70a109382cabf9dca0965bb97214d6159b6e928a17ed22247ca57a595b8a3f72b35880399179557d5b7029e4ec94e525744f93113e8e428505e67b56032ce14cf275b30f5f713d84586286d01f71eb55dc023a0fe556d62d03f75b7969b9a15a07a00871155ea", 0xa5}], 0xa) ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0xaea2, 0x5) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000002100)={0x2000}) ioctl$KVM_SMI(r2, 0xaeb7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000002140)) ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f0000002180)) socket$xdp(0x2c, 0x3, 0x0) 2m55.782682696s ago: executing program 36 (id=3169): r0 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000200)={0x0, &(0x7f0000000000)=[@wrmsr={0x1e, 0x20, {0xae9, 0x4}}, @uexit={0x0, 0x18, 0x7f}, @rdmsr={0x32, 0x18, {0x1b}}, @code={0xa, 0x61, {"660f5b1d7d000000660f063e660f0137b99f080000b8c7750000ba000000000f30c481f851e7420fc7fb48b800580000000000000f23d00f21f8351000000b0f23f8c42261ae0a417400d295c19d0000"}}, @rdmsr={0x32, 0x18, {0x811}}, @code={0xa, 0x77, {"460fa3de66b821008ed066baf80cb8cc3a9d89ef66bafc0cb86c658d15efb92d080000b850000000ba000000000f30440f20c0350c000000440f22c0b805000000b99f0b00000f01d966430f63e5420f07b9800000c00f3235004000000f30b9520900000f32"}}, @wr_crn={0x46, 0x20, {0x2, 0xffff}}, @cpuid={0x14, 0x18, {0x4af0, 0xd403}}, @wrmsr={0x1e, 0x20, {0x490, 0xe}}, @uexit={0x0, 0x18, 0x10001}, @cpuid={0x14, 0x18, {0xb2b2, 0x3}}], 0x1c8}) ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f0000000240)) r1 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r0, 0x4048ae9b, &(0x7f00000002c0)={0x120000, 0x0, [0x7, 0x4, 0x1, 0x80, 0x4, 0x1, 0x2, 0x8]}) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000, 0x6, &(0x7f0000ffd000/0x2000)=nil) ioctl$KVM_DIRTY_TLB(r0, 0x4010aeaa, &(0x7f0000000340)={0x4e, 0x1c00000}) r2 = memfd_secret(0x80000) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f00000003c0)={'lo\x00', {0x2, 0x4e24, @local}}) ioctl$KVM_SET_SIGNAL_MASK(r2, 0x4004ae8b, &(0x7f0000000400)={0x7e, "b41e6fa0df0969041288b97efe7e2cf27798abaa6ad55b4f56de234853671172ab4f77357e9b216c4088a5e5ea5b59f9321d711f9095ee07df7b42d7360686ba53f7ec1384e23763079b0da87252c958e79bc1a12245ec456c89aebcd800139fb6b3194e3dfe5f98be0c071186e0525877e385b8207447e8cdc95e9aedbe"}) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f00000004c0)) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f0000000600)={'broute\x00', 0x0, 0x4, 0x9b, [0x8, 0xffffffffffffffff, 0x8001, 0xb, 0x53, 0x6b22], 0x2, &(0x7f0000000500)=[{}, {}], &(0x7f0000000540)=""/155}, &(0x7f0000000680)=0x78) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r2, 0x89f6, &(0x7f0000000740)={'sit0\x00', &(0x7f00000006c0)={@multicast1, 0x0, 0x0, 0x60, 0x0, [{@private}, {@multicast2}, {@private}, {@initdev}, {@private}, {@loopback}]}}) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) fcntl$setsig(r3, 0xa, 0x2d) ftruncate(r1, 0x3) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r2, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x34, 0x0, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4041}, 0x44090) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000880), 0x20000, 0x0) ioctl$SIOCGIFHWADDR(r4, 0x8927, &(0x7f00000008c0)={'ip6erspan0\x00'}) r5 = syz_create_resource$binfmt(&(0x7f0000000900)='./file0\x00') execveat$binfmt(r4, r5, &(0x7f0000000980)={[&(0x7f0000000940)='lo\x00']}, &(0x7f0000000a80)={[&(0x7f00000009c0)=':@:$${\xf7{\'\x00', &(0x7f0000000a00)='}\xd7\a!]:.\x00', &(0x7f0000000a40)='\'\x00']}, 0x400) fsync(r2) getsockopt$inet6_int(r2, 0x29, 0x33, &(0x7f0000000ac0), &(0x7f0000000b00)=0x4) writev(r3, &(0x7f0000002040)=[{&(0x7f0000000b40)="c92bd05d80197300ccd23ba4d2f5ae329b44455826a035a0e3ef870ff8ade6c83374d3bfdca86442a62a5c8dbe3d66776e62c46f7b9849dbb19a1bb8625d1f361b5f4dbc385c3d21ec9d14426cc8f8615a0a41d1e503792341304efbac108a767815f5d75bb7e8de962b134da789e819e504ec40d3950c7ebb56494afec8eef4526dd08bfeb88dc2e1c324c0f4e1c2ad90cfa20314bb9cc5715d", 0x9a}, {&(0x7f0000000c00)="6d293fd4c95ec9909547b04c5890d780335855ae82c83addd7dedc3d5252b4492f40aca61e503e5d8d3b04a084fdbbdf8223b7745bdae6ab6b174e02d16b16a52864dc27dae42083c369f096bf7ce47b9d0a0d6e6c8d89ea5cbb1869fda98f5d138cebe6997178ae9bdf61795c184df1aba8e7d09c440965299c3650bd58ffc3fa407dc3e678cd9beb1983f8f125739b94e267606b5dbc6d5bf1", 0x9a}, {&(0x7f0000000cc0)="d5e608673cc8b34c737407d0", 0xc}, {&(0x7f0000000d00)="8c34b2417e0b4fbdd9a6ddb08223184a70728a4888b9237c46d7b580ffd771fa19c662758105ebe52836f2d28ec32d01324d2f9fee57d41865ed7c7ba67bb56b119cc18a489273433ee5e4f75b59bfa413b2389ae69beee5f8af93f57d7ece95", 0x60}, {&(0x7f0000000d80)="7f643cd45f50d4bed34be31f5c888d6e7023e3dea6cee81ebeb7ad49ca2e58e785cd631de743162850dd97c922dabe8c86a0fe6e77400c8ee763350223c612f1a3225b0bf504260cde8454e9805aa1f989b7fd4fd849b2a65abe89868bccef61eb84028ac6dd0e32eb55a176a09b151f54488d2251a868af115ab33a9f5699f8b73e95b74737c08bec4611217b8b5c7c89d25473929ae8bdd361ce9bc2722d85fa8c58767567bd579283a7dda8577945cb3b19d47a8d3627f62382f0eb851544", 0xc0}, {&(0x7f0000000e40)="5567c19efe55b59fbb608228bf105b493960b8e8129b37d06a585dbf0b6c0566c537ddd46914c5822d4f86cafe1faa7faed290fb1d41347c455cb8551e019347f6f826c995966fa1c0fee43dc3d10adbb4e955283076bb2a794b70d635f7583dc9e3930fbcb4ca36689f147857af74c1b68ab8ce15e0de9f798d469ab36d494d8f3d1a4420498428a7604b54ac5fcd6230d554cdb6a12535a1421131222ce10cacd1a183907e399ac7d9dd8138912c30a9a9161c6bc0265942fb", 0xba}, {&(0x7f0000000f00)}, {&(0x7f0000000f40)}, {&(0x7f0000000f80)="8f141b28a9b60b0a6c3f211c1bbd912b57434f5636a8e1f76fd71994dfc3e02024d2198e7a38996b018a9987783f10e7df6cf272e4203ac1a56af17323e971bf979c51935ad3ad4385d93fc1747e3be08f3ae96e3997ac86f5c454f2c3aaa5bd74556e8dc602772d44c773a9ce1912ab51dc3976d1e2ba84390c7d2af93c87796dab9f644dc6b6ce439da7bbb6c43cd0db4a946ee09bd9c546b245d7f6c0dd2047fabe3ae92bab989f75234e2d552ed1108a633080a1793cd6039f42e705f4709cc6703a9d438c3f7f359908373287edae399ec852bee8780bd4119ca1c181aa13a1028545912acf7fa24510c0b37ababf41482b8365f531c40706f44918ecbf3f6d4957ef7c1cba2adc95a0e578428aba7677502bcc7c1efc10627d2710c1b73835c8a33fb70382f1f98e16e4b70c93c77f90a315050489cded0f9b113e1d1e19cac194e985bb50e0f9b37e967592d96fa8f704cef929463b3d18d578bcb6fb6b7c80fa90b42309027e96a86655458d7b48b63d298874a4b33e54cc204381cf02e45fe053793933ca044796ff74cabea164cf2254384ccb13c39562101e86dbce31003429401d0284570e8e105679c533e2318fa441896ba40c7a8a146432033a254fe55dd028443bf5ad1ff0ba96ef8ddefaed7ffafce15d81c8e1fe3058518244a93f8851a2263cdddeec518b16aada895c2cfe9002000576fa82d9a3468976740c7e9423796e88747bc8abd4d0bbd4204be9d17dc3b76d9725e32f239287aa04fa9ff78c17d1ca5cddc4adfc648f6eda5bfd4582c934a41ddb9bc3b659902345b82b6aeee285c25f1a3f44bb55398ad9f11bd7e52312458271b38015a121ed8bd0a0bad90396855d59339209e80d3fbad2b7a371ac93e01c12766c4775695f94d73175c2f4762f4cc5cc0b302b603cf55744018d3adf9dbb786b807034615bf2f729f5017cd1a4528409e14cfe1515b7a039ccd6c712c6d94ad139b514ee1ba170f8911c6fcd3317b648a4260f84e0739b20c717556150b820a75b7834049b2d4247b435c9407f053d7fa53b00349b17b389db6216e8d981b4d4ad2fab5ea498c34658aa28a17528c528d807745614d9a48d200d5f507127b663cd9f446d81455ae92c5ebc43ec07a05d15b61041c148cc4d5de00423a5dcf87f852fa77730715fa08f6f5248d6ea2d9b4f3d7019d16b713b905f1fa78cc8546457317b94a7d331e197f3a04eefda22562bc39f5c9865dcfc6d37f8ffa6e7da804454c12043075e126ea6f39d8c6f33f62e78da3de8f038ec36794bc2633ee7d70b284e452bfd8a40c9bddd1bd8513a0ee0134aa30952f7c5231f48b80ebd27fcc697486a9296b230eeefdfca915d82b0277e438f36d1df998005c0220c87e4d68c25f612683f54ee9a014b1f65984e1f1c2637d5686a5097800001dc0415684e9d2b16cf659b4bddcaf8659b40e710c52b26f4de41d6276887e116ccadf0b3d98d0b0bae7b63bf025e48529a451f46a71e638ed24b7c33d9e3293f1ac5b4e89f8d6e0793856a88559e0007410184c9490a9cd981008d9e5e30917057bfd16c073e96c7e78ddeea065e0acea81c0890ff3827ed50b4f3bc035e5aab0de515bd5279be4a4a609304d3888508c35c83ac877da8e330fb9e05a39438db98bb680bf6ac8708fd83a11ca2db19ff0d217d7e2c936062d81f1d196125edcf229d4904ba248134372fdaf3b19f26b5ce1567f0ba06aea58724644d55a19b82c0e6a4d4eef79de7a2240d03545c757cf06ed253f006b7863207c084557cd5e0e9dbdd03ce90508792c85f944699fcd2a62f881f499a9b412c8605d517b3910b2c748ab9497b3f141080b1ceb884f7af49e4643857ff9c8feb221784861ab3a9a25265c6a21f526729ff8ec4e70fac6abf1f02338eda8ea3a3aa39f363b8b5e9e0c2b5587678b6fb7e19c3d3f6095933e68084fa450fb3eddbc1326b0a14be5a3fd0d26c5d9e7d956f950fdce9611a9e97158672d3088aff0c932ce062b48da8ae9f540232b7242014a15b3f9513e780b282e9035a341da0da69f5ddad02fbc18cd675e1d55d0ef509ac50feb055c53bbefdc0a0307ec3decd9c0bd660e997265bb6efe8340ec8cfe88f8277bcfc95380f2f199b0266d2dad0935cfa39cea737df2f55a95e1855fcb23091004d125af0b93a15ece3e1daf491e5bf25b865e2b4e1635685e5e0e205d3c23936c307935b9d89f63be0c8bece4be25f4b4fbe4519bbd0c93ac57df5aff82b77051e8865d30f3ba185e2c85728d0944f2644e710896ed48750d1baf15d093ef516bd5c1d5129c8d37b849d6d943d55412b5bd81f26e1d6335e87501a62693f8034c9526658a05e16798ac12c4fe0ebc8e8c013a135634cfe26ff42101d85761b827f62bbcea932689e0dce91a621a140ba7027833e4083eff042f0fb052db953fb3cb7d0a3dd9466741afd4b5eaafc68545d0b00d321d3bb121aeec90e3e60a1de5fe5f25a82df627766ddf2f8ca8794260cf4d72ef4783b0f488a6fd05d72affed553cdb5595dad813dbf7b2e1bcf49f3263ae27d8e033ed010651612236bd871c4de1ab0c94853118c9385692a380f8fd75f8a5341415ee5327eaf61f358e5b3a7c53a35878d24b9417c0328b6b8afcc82f3684eaeec3e6f153350eaf1302995bf41bab6b8f7f4d1eb6dfc1de40f140dca4f6749c5b3821cf6c3b27e15ef24f9b05287680b450f8b5d23df058480c3074e7dfc09ab0625b999dd29564e6fb0b0f76d7d615465808c018ee5b4c7bf6a7f3a344c9c905f8bdf17c3ca0fbfe57537c3ca5b69bec57d34fff5ddd7c660245d0ffa121073af00c3139792baf4b9d952b578a998e9a7468e1ba4eed5a26b400493ec8ea0fad7e2942e8bfe069a26c62a39f37589b0dd7b9643652a493952505c01d114598bce3e83df4bb484da6ccefa48ec76a17a4fa46f4ed443e4ae2e42395a5c057667b931881f54626ef9adb0cc8b6c989a835bdc614b055880f44f531e824efd1a65dd3682d29679b55848b9fcdfdce42288c4d82251f027e1cfb055e1fba2f69b190f7dd9b2cd73d0df1d45d8145dab05d3bcee62e4b492fd60743a74b8f56b4238d480d40853d2d830fb85e28fb3500b444c8b0782f006f9eb9e95f59808f6eb36dcb65147f2ebeff3bdd527db5785756563da0f7c855807650011d00fe2f03c3ff2230484195746164794eeb07553b36e8a298a8540e672a6bda1996556ad0ce4e7ce46d12cc2734bbdedc0674fba38d36276ef63bf311fa7dbe03752bc31b50da0cebd863f6b58028c4d8c14d175f1eef14359802aaa5e8143c02b0649c097753561be5e17e28244500da11f4cb78856c9309866114d2df58ed3bcc0629a8c12be6b25ebbbd5b6f3a44e28714f045677125f74414dc59584a23bdf37c2597226c794e98768024a4da8211ac01552c0e46d20096c38379d08efac1c379fb1ec4631a121e1941685564528e139f32af3cf5c8dc1500c7b8990dfc807d6f802fff783bca13ad2daf7291434553652bfaee22aada1be4310cffe07cba07743a04b28e780d0d32f036df689fac123964afb824f7e8128641fdcc6da4ee36cac7efeb99444c368ae9635e1566d9906e2b701726574cfd4b7e08a32b53d27f4b3eb4a975f418eb32dcff1051d12a301ad26f07a8bd5ceb3641632b927ea5d8727e2e9a1eeb557f012e59f175a9676a3afe2a93fbbc47d634cec84ed8554a08dadedb160385d5e236417e853bcb80caf35eb4b6a8d54ae8b16050e0843004ffa85a99025b6953fbff6d1a001539c84ccad63d3c1ca37e2bdcb4cb0798fe17c76c58cba7915f63f5ecea6304ab8bb3889cf3934482392ed2639150ad4a963ab30360d90d006df5f58cac1d4d249dca8e4ba1a8bc3d0a50e9162b4aaa77ef52ff72dedd8be5f03606f3113efed43dfe0fe22487408174a6585652d63e230fdb2b68ed983d0022387d4fb3c50d84cbdde97bdb8c34b449bc7b36ea782d4774c05a2fdceedde28b6bcc1bfa6d34808dd197e7a2851ae726fbe130b3534f116ed2186f1e966e39d905ae70aaa2d794d169bd2dada5173ca793b97d7848c5cb9f4fbcd50bcc7910d0195a926c03842db45bcf048e5c113d628c11e5484bfc333f30ac9e1eaf9ec394bdbeef66f089b56cf15216f779881690f16696a5453e3c27ea2ce8c44d809238995faa04d9101863101c82d4ee283a9ad5c51acfb9cbe1e747c9a245b4bf3b3487ea9fcef08ae22d2d5fa348d85a3307a21ac1d5f46760d29146a3d2d405357ba2d7693ad0153c998b6454aedd246de696f98a6cf1cdf9a60167faf0f8fa5a9392bf99bea84a90b1236a5e182a8e05ec374935085cd30a15493d699bcb04607e5d6998e65d09608cc825861abb1188cca75ffd18fa5db13a9545c1fc551382e4242ee17792bbdecd710b7d1ed6bb5611eb9be07e77108c830824851d993e5b88de2e92e0d66e2ca53fade85522f2c06dcd54d8ab0f2ee80023a70dc937c205565dceeee4689dcd5d7f5b8efd16584c107fe3f0428282f86b3573c0358188637c000284f096bad7a382152b0368393cea0ede1e6243b175627beaeb6dfae1be108d1c069944f58772a24b18670c6d94762d494ae0af84caf72cd5ba4c4b23b396f3a177ebd60991292f5c1cd11ef0b8a3a77f8c344269134450f7bd10467e73d1ec83e3ed71ad59ad2eae6b8e457b338975f650fa6be2e0cb6426db37152afc0bd1b3e552457160c49384ef1258081ec1677384e390d4f8c38c3b0463a69111bec39a712c17ce9baf4a876a593cd698294c8a71b7b5b5cbb9f8d9f9155be6ed8e8f3b4fb57bfbec5a7c73f001525d7807f415091b0e1dd2ed0f5f7ad733057e3c29e95f35ef8fbcb9981b4982d41ee8f1479e72422379fcaf65ee6a156b502141cee09ea32a275462186321654cce2007257d8addb6625a17606720e77c79095634a13a11e67165c1217079377f38544a22726442858834c82f4059c7f5dff242350ca03b6a64e1cc5933cd23c461c4b4fd9a46cd1a12317b5618106a61a13941f3417455445acc2350e3dcab4881195996f7439db96384a166d0f4104d70afcb6415b541855e100e2b176fb3814822ae16a389d9b9a653f21b3757b3278d83b198c0ae54f8cd7e8427d0d9e1881487a8a84e0762fa0174ad1735785343977a2ae8d64919f24676ef2456f2139351c314c7c433ac8876012587d61fcb15c2dbd5719d0b66246eaa9b12856a35e8bbd2259c16f2498390ca520f5a079ea657031d102906050e02376dbae2fd40d0b1621cddaf6f05c3a6ba6c969d70ca9398470e25c86e613be31789c548bc43da4ce6d6ab0d4c4940ce7189682f39a109749ea2091156ccd052e5a413ae4d701041f06236255f32ce62c0273019795eac37edc4c7728aed77f1b5c390711b78a3ae8b482011b3c806b9cd481e4c41c79d0691a665ad80988330d626ec8f48008dd1e6dd04bef664c640554cd3e563bae744ef164f9e9f6fe35acf835e281876b3d0313b212504f0ce1c11df8be4f1105ffbe6643c8c3b790043be934b72c3cdde7710f02139d0b50ce311db060f8e074e9f6da4d8bd16792de94aa4aa76e867d324843348f6709c4b1d3226c626e900d6fa6a95b00d431a181f3004d979a344654e804fa791e0cbcad9bc3047b4084927be4ff1482d54db01a00126d096aed3181ba03b233ed36c7f1ed026d9402fef59587900bffa432bc90d880994a1b21dbff275d6408b638a46dd025b828dc3a8c04183bf52c4d8796a22c", 0x1000}, {&(0x7f0000001f80)="18eb61cdc4f13424240415fd219162ac15897f1bcf4cfe95a23aa396c8aeeb88783c10fe140c418d9f01620b808f57746474dd070242bd9b4fa50d9b80cae70a109382cabf9dca0965bb97214d6159b6e928a17ed22247ca57a595b8a3f72b35880399179557d5b7029e4ec94e525744f93113e8e428505e67b56032ce14cf275b30f5f713d84586286d01f71eb55dc023a0fe556d62d03f75b7969b9a15a07a00871155ea", 0xa5}], 0xa) ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0xaea2, 0x5) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r4, &(0x7f0000002100)={0x2000}) ioctl$KVM_SMI(r2, 0xaeb7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000002140)) ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f0000002180)) socket$xdp(0x2c, 0x3, 0x0) 2m44.597922192s ago: executing program 1 (id=3351): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) r1 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) write$binfmt_register(r1, &(0x7f0000000040)={0x3a, 'syz2', 0x3a, 'E', 0x3a, 0x9, 0x3a, './binderfs/binder1\x00', 0x3a, './binderfs/binder1\x00', 0x3a, './file0', 0x3a, [0x50, 0x16, 0x46]}, 0x50) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0xe}, @fda={0x66646185, 0x6, 0x0, 0x24}}, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000900)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 2m44.596485372s ago: executing program 1 (id=3353): fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000000c0)={0x0, 0x0}) gettid() (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) (async) ptrace$setopts(0x4200, r0, 0xbb9, 0x28) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000000)=0x10000, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x1, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_mreqn(r2, 0x0, 0x20, 0x0, &(0x7f0000000300)) (async) socket$key(0xf, 0x3, 0x2) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='exfat\x00', 0x200000, 0x0) 2m44.543536794s ago: executing program 1 (id=3355): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x109000) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) ioctl$EVIOCSMASK(r2, 0x40104593, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r4, 0x11, 0x65, &(0x7f0000000000)=0x7, 0x4) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x2, 0x0, 0x0, 0xa, 0x0, 0x70bd2c, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x18}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}]}, 0x50}, 0x1, 0x7}, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000006040), r6) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000006080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000006180)={0x0, 0x0, &(0x7f0000006140)={&(0x7f0000000000)={0x54, r7, 0x11, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r8}, @val={0xc, 0x99, {0xfffffffb, 0xfffffffc}}}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'pimreg\x00'}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_SOCKET_OWNER={0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x10) (async) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x5, 0x0, 0x0, 0x7fd00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r9, 0x40182103, &(0x7f0000000240)={0x0, 0x1, r9, 0x6}) (async) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000080)=0x50000) (async) r10 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r10, 0xa02000000000000, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3e8, 0x218, 0x0, 0x130, 0x300, 0x300, 0x300, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pimreg\x00', 'veth0_to_bridge\x00'}, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f67b23ffdfa27f907a03732da3acbc6518e62a77ca06f258762e88c0d9f9d2f413b94a105f4bdf01425ce81c5d000000000000000500ffffffff00"}}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00'}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0xeeee0000, 0x8, 0x9, 0xfb, 0xe4, 0x40, 0x7, 0x0, 0x2e, 0x19}, {0x5000, 0x10000, 0xe, 0x2, 0x40, 0x5, 0x7d, 0x4, 0x5, 0x3, 0x3}, {0xeeef0000, 0xeeee8000, 0xe, 0x5, 0x7, 0x7, 0x0, 0xf, 0x1, 0xa7, 0x5, 0x81}, {0x6000, 0xeeee0000, 0xa, 0x6, 0x4, 0x42, 0xb, 0xff, 0x8, 0x7, 0xf}, {0xeeee0000, 0x10000, 0xb, 0x3, 0x80, 0x7, 0xab, 0x7f, 0x7, 0x83, 0xf7, 0x83}, {0x1000, 0x80a0000, 0xc, 0x9, 0xb1, 0x8, 0x1, 0xa0, 0x80, 0xf, 0x1, 0x5}, {0x3000, 0x8000000, 0x4, 0x5, 0xb, 0x5, 0x7, 0x3, 0x5, 0x81, 0xff, 0x70}, {0x100000, 0x1000, 0xe, 0x5, 0xf, 0x6, 0x1, 0x34, 0x2, 0xc, 0xad, 0x9}, {0x100000, 0x30}, {0x10000, 0x7}, 0x80000031, 0x0, 0x8000000, 0x2024, 0x3, 0x0, 0x100000, [0x6800000000000000, 0x4, 0x5e, 0xff]}) 2m44.532946974s ago: executing program 1 (id=3358): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/dev_snmp6\x00') fstat(r1, &(0x7f0000000780)) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r3, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000380)={0x2, 0x4e22, @multicast2}, 0x10) setsockopt$sock_int(r4, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000000)=0x2, 0x4) bind$inet6(r5, &(0x7f0000000240)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x43}}}, 0x1c) listen(r4, 0x0) listen(r5, 0x0) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, 0x0, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)) sendmmsg(r6, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0xdd86}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r1, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB="08010000", @ANYRES16=0x0, @ANYBLOB="04002abd7000fddbdf2504000000300001800800030002000000080003000200000014000200766c616e31000000000000000000000008000100", @ANYRES32, @ANYBLOB="4400018008000100", @ANYRES32=0x0, @ANYBLOB="d19d5393c50e0215a85d947f52b7857f140002006261746164765f736c6176655f31000014000200766972745f776966693000000000000008000300a3020000", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="1400020070696d7265673100000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="500001801400020076657468315f766972745f7769666900140002006d6163766c616e3100000000000000000800030001000000140002007866726d30000000000000000000000008000100", @ANYRES32, @ANYBLOB], 0x108}, 0x1, 0x0, 0x0, 0x20000004}, 0x4801) setsockopt$inet_opts(r2, 0x0, 0x4, &(0x7f0000000080)="441f0803", 0x1f) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r0, 0x45809000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="ac000000000301"], 0xac}, 0x1, 0x0, 0x0, 0x4000}, 0x4000894) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005280)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001640)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x5}}], 0x18}}], 0x1, 0x4008800) syz_open_dev$loop(&(0x7f0000006200), 0xb3, 0x82403) ioctl$BLKRRPART(r0, 0x125f, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) sendmsg$NFT_BATCH(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000800)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x128, 0x0, 0xa, 0x201, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_TABLE_USERDATA={0x53, 0x6, "da0d6d1a4eca8480929535662ed63191404e94aa28014f8d7c7f0151b98cb4b1fe7e77b0b50dc936625a0118171c698c24a9ba66143f9fa3729dfe554ca8804458026c035637dfcf6190e1b3fbb0b5"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TABLE_USERDATA={0x84, 0x6, "5bd0b1a6195d593f459fd9e7c834f81f6062e8bcf382478171176e0e9f5404e5556617468038960b6d118bba3e436342dd49541826caf96d2d4335c122b0683a842e6a9e4e631a39b6f1d96a197b3d4c8cfacc96718e8c8661882d1486de661ae8a550bdc1de1b055e9e2932d5f3845d908cfc1c4a4cceedbbdd176325fe11c5"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0x5, 0x6, "df"}]}, @NFT_MSG_DELCHAIN={0x3c, 0x5, 0xa, 0x0, 0x0, 0x0, {0x3, 0x0, 0x3}, [@NFTA_CHAIN_HOOK={0x1c, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1846d7bf}, @NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1560d983}]}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELTABLE={0xd8, 0x2, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x3}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x3}, @NFTA_TABLE_USERDATA={0x23, 0x6, "d3d1254a0aa2bbb54071a29725cbf00426082cf63da050bd1ba05aed1e56ac"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x3}, @NFTA_TABLE_USERDATA={0x42, 0x6, "87dd46bf0c071d304179af61722563cc101967026d3a35aced64f61c182c63b14225586072c637a64e9cfe74a2a407101a895b7109a5d60d4db05bb78902"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x264}, 0x1, 0x0, 0x0, 0x44010}, 0x20004000) 2m44.462915355s ago: executing program 1 (id=3359): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder0\x00', 0x800, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r3 = openat$incfs(r2, &(0x7f00000001c0)='.log\x00', 0x0, 0x130) read$FUSE(r3, &(0x7f0000000880)={0x2020}, 0x2036) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f00000001c0)={0x1, 0x1, &(0x7f0000000040)=""/34, &(0x7f0000000100)=""/168, &(0x7f00000007c0)=""/4096, 0x5000}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r1, r0, 0x0) socket$inet(0x2, 0x402, 0xa) openat2(0xffffffffffffff9c, 0x0, 0x0, 0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000780)={0x10, 0x0, &(0x7f0000001b40)=[@clear_death={0x400c630f, 0x1}], 0x0, 0x0, 0x0}) 2m44.442551265s ago: executing program 1 (id=3360): r0 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) lseek(r0, 0x11, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = getpgrp(0x0) r3 = syz_pidfd_open(r2, 0x0) r4 = syz_clone(0x20002000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000055bed40020000000000000003010902380002000000060904c700010e0101000300d009050a000000000000090400000101be2600090500000000000000080b"], 0x0) kcmp$KCMP_EPOLL_TFD(r2, r4, 0x7, r3, &(0x7f0000000180)={0xffffffffffffffff, r3, 0xfffffffd}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) r5 = socket$inet6(0xa, 0x80002, 0x0) r6 = creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) r8 = openat$rtc(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH(r8, 0x7005, 0x0) readv(r8, &(0x7f0000000000)=[{&(0x7f00000012c0)=""/191, 0x4}], 0x3) mount$9p_fd(0x0, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000004500), 0x800, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r6}}) connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @mcast2, 0x5}, 0x1c) sendmmsg$inet6(r5, &(0x7f0000001b80)=[{{&(0x7f0000000a40)={0xa, 0x4e20, 0x8, @mcast2, 0x6}, 0x1c, 0x0}}], 0x1, 0x4001c40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0xc}, @flat=@handle={0x73682a85, 0x101}}, &(0x7f0000000080)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) lseek(r0, 0x11, 0x4) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) getpgrp(0x0) (async) syz_pidfd_open(r2, 0x0) (async) syz_clone(0x20002000, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_usb_connect(0x0, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000055bed40020000000000000003010902380002000000060904c700010e0101000300d009050a000000000000090400000101be2600090500000000000000080b"], 0x0) (async) kcmp$KCMP_EPOLL_TFD(r2, r4, 0x7, r3, &(0x7f0000000180)={0xffffffffffffffff, r3, 0xfffffffd}) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) (async) socket$inet6(0xa, 0x80002, 0x0) (async) creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) (async) pipe2$9p(&(0x7f00000001c0), 0x0) (async) openat$rtc(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$BTRFS_IOC_TREE_SEARCH(r8, 0x7005, 0x0) (async) readv(r8, &(0x7f0000000000)=[{&(0x7f00000012c0)=""/191, 0x4}], 0x3) (async) mount$9p_fd(0x0, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000004500), 0x800, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r6}}) (async) connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @mcast2, 0x5}, 0x1c) (async) sendmmsg$inet6(r5, &(0x7f0000001b80)=[{{&(0x7f0000000a40)={0xa, 0x4e20, 0x8, @mcast2, 0x6}, 0x1c, 0x0}}], 0x1, 0x4001c40) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0xc}, @flat=@handle={0x73682a85, 0x101}}, &(0x7f0000000080)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) (async) 2m29.054310873s ago: executing program 37 (id=3360): r0 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) lseek(r0, 0x11, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r2 = getpgrp(0x0) r3 = syz_pidfd_open(r2, 0x0) r4 = syz_clone(0x20002000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000055bed40020000000000000003010902380002000000060904c700010e0101000300d009050a000000000000090400000101be2600090500000000000000080b"], 0x0) kcmp$KCMP_EPOLL_TFD(r2, r4, 0x7, r3, &(0x7f0000000180)={0xffffffffffffffff, r3, 0xfffffffd}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) r5 = socket$inet6(0xa, 0x80002, 0x0) r6 = creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) r8 = openat$rtc(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH(r8, 0x7005, 0x0) readv(r8, &(0x7f0000000000)=[{&(0x7f00000012c0)=""/191, 0x4}], 0x3) mount$9p_fd(0x0, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000004500), 0x800, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r6}}) connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @mcast2, 0x5}, 0x1c) sendmmsg$inet6(r5, &(0x7f0000001b80)=[{{&(0x7f0000000a40)={0xa, 0x4e20, 0x8, @mcast2, 0x6}, 0x1c, 0x0}}], 0x1, 0x4001c40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0xc}, @flat=@handle={0x73682a85, 0x101}}, &(0x7f0000000080)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) lseek(r0, 0x11, 0x4) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) getpgrp(0x0) (async) syz_pidfd_open(r2, 0x0) (async) syz_clone(0x20002000, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_usb_connect(0x0, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000055bed40020000000000000003010902380002000000060904c700010e0101000300d009050a000000000000090400000101be2600090500000000000000080b"], 0x0) (async) kcmp$KCMP_EPOLL_TFD(r2, r4, 0x7, r3, &(0x7f0000000180)={0xffffffffffffffff, r3, 0xfffffffd}) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) (async) socket$inet6(0xa, 0x80002, 0x0) (async) creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) (async) pipe2$9p(&(0x7f00000001c0), 0x0) (async) openat$rtc(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$BTRFS_IOC_TREE_SEARCH(r8, 0x7005, 0x0) (async) readv(r8, &(0x7f0000000000)=[{&(0x7f00000012c0)=""/191, 0x4}], 0x3) (async) mount$9p_fd(0x0, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000004500), 0x800, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r7}, 0x2c, {'wfdno', 0x3d, r6}}) (async) connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @mcast2, 0x5}, 0x1c) (async) sendmmsg$inet6(r5, &(0x7f0000001b80)=[{{&(0x7f0000000a40)={0xa, 0x4e20, 0x8, @mcast2, 0x6}, 0x1c, 0x0}}], 0x1, 0x4001c40) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0xc}, @flat=@handle={0x73682a85, 0x101}}, &(0x7f0000000080)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) (async) 1m43.171878438s ago: executing program 9 (id=4391): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000580)='.\x00', &(0x7f0000000000), 0x880, &(0x7f00000000c0)={[{@lowerdir, 0x5c}]}) r1 = syz_open_procfs(0x0, &(0x7f0000000400)='net/ip6_tables_matches\x00') openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x2a, &(0x7f0000000300)=0x9, 0x4) pread64(r1, &(0x7f0000001b80)=""/4084, 0xff4, 0x7f) r3 = socket(0x11, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000005c0)={'gre0\x00', 0x0}) bind$packet(r3, &(0x7f0000000180)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @dev}, 0x14) bind$packet(r3, &(0x7f0000000000)={0x11, 0xf7, r5, 0x1, 0x4, 0x6, @local}, 0x14) read$FUSE(r1, &(0x7f0000002b80)={0x2020}, 0x2020) ioctl$EXT4_IOC_CLEAR_ES_CACHE(r0, 0x6628) 1m43.171159798s ago: executing program 9 (id=4393): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x50, 0x0, &(0x7f0000000100)=[@exit_looper, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/230, 0xe6, 0x1, 0x1e}, @flat=@weak_handle={0x77682a85, 0x1000}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000080)={0x0, 0x28, 0x40}}, 0x40}], 0x0, 0x0, 0x0}) 1m43.150444159s ago: executing program 9 (id=4394): socket$inet(0x2, 0x3, 0x3) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @empty}, 0x1c) (async) listen(r1, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff0000000002"], 0x7c}}, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000000)=0x1f, 0x4) (async) r3 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) (async) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_udp_int(r4, 0x11, 0xb, &(0x7f0000000000)=0x10000, 0x4) (async) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f0000000240)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x4e21, 0x0, @empty, 0x8}}}, 0x108) (async) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x190) (async) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async) syz_usb_connect(0x5, 0x164, &(0x7f0000000180)=ANY=[@ANYBLOB="120100007af28810d30bf4055b00000000010902"], 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1m41.916917782s ago: executing program 9 (id=4432): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in=@loopback, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4c22, 0xfffe, 0x4e23, 0x0, 0x2, 0x20, 0x80}, {0x0, 0x0, 0x2, 0x0, 0xffffffffffff235b, 0x0, 0x9, 0x1000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x4d5, 0x6c}, 0x2, @in6=@loopback, 0x0, 0x2, 0x3, 0x4, 0xffdffffc, 0x1000000}}, 0xe8) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00008feff0)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x4, 0x0, &(0x7f00008feff0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="020d0000100000002f3144e8edffffff03000600ff18000002004909000100000000000000001e0e080012000200010000d200000000000030006c540203009f7eae02000000adb20200000000f52c000000cdff00000001020014bb000001000000002300001300030005000020000002"], 0x80}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmmsg(r1, &(0x7f00000000c0), 0x2c8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) ppoll(&(0x7f0000000100)=[{r0, 0x870a}, {r2, 0xa21c}], 0x2, 0x0, 0x0, 0x45) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) mount$bind(&(0x7f0000000580)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x1b5008, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000540)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2145499, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) 1m41.915049872s ago: executing program 9 (id=4433): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x5e22, 0x0, @empty, 0x40000}, 0x1c) listen(r2, 0x0) r3 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x13, r3, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = eventfd(0x390) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f0000000000)={0x1000, 0x4, 0x0, r6, 0xf}) r7 = socket$netlink(0x10, 0x3, 0x4) writev(r7, &(0x7f00000000c0)=[{&(0x7f0000012380)="580000001500add427323b470c47b45602067fffffff81004e220700000000000000a8002000eaa57b00090080020efffeffe809020000ff0004f03a007357ac8ddc1fdd00000000000004ffffffe7ee0000000044c60000", 0x58}], 0x1) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f00000003c0)={@fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x29bdfb4895f82e9a, 0x1}, @flat=@binder={0x73622a85, 0x101, 0x1}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f00003e4000/0x2000)=nil, 0x2000, 0x2) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f00000003c0)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r8, @ANYBLOB="05", @ANYRES16=r8, @ANYRES64=r8], 0x0) r9 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000000)={0xfffffff8, 0x0, 0x7}, 0x10) write(r9, &(0x7f00000000c0)="240000001e005f0214fffffffffffff807000000b800000000000000080008000d000000", 0x24) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r9) socket(0x2a, 0x4, 0x10000) ioctl$EVIOCSCLOCKID(r8, 0x400445a0, &(0x7f0000000080)=0x7c77dc98) prctl$PR_SET_IO_FLUSHER(0x39, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f00000005c0)="2078b98d43d07572a4ac17e070f6e4ffd39036ed0af8f56f83f08868dc94aaa397e205bed98262b9477344a911603869d9f3f877f7aad1829f47273251843760bd7de0381b6c857784bb0ddc8246ff1e"}) 1m41.902791113s ago: executing program 9 (id=4434): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) (async) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001d0001160000f356fc1de90007"], 0x14}, 0x1, 0x0, 0x0, 0x80000}, 0x0) (async) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001d0001160000f356fc1de90007"], 0x14}, 0x1, 0x0, 0x0, 0x80000}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) (async) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) (async) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0x10408, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) (async) write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0x10408, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) sendto(r5, 0x0, 0x0, 0x200048d1, 0x0, 0x0) (async) sendto(r5, 0x0, 0x0, 0x200048d1, 0x0, 0x0) syz_fuse_handle_req(r3, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) dup2(r6, r3) creat(&(0x7f0000000300)='./file0\x00', 0x768943b6b926b3ed) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x1001, 0x2}) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x7fffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x64, 0x0, &(0x7f0000000080)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0x11}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x2}, @request_death={0x400c630e, 0x3}], 0x0, 0x0, 0x0}) 1m41.834936094s ago: executing program 38 (id=4434): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) (async) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001d0001160000f356fc1de90007"], 0x14}, 0x1, 0x0, 0x0, 0x80000}, 0x0) (async) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001d0001160000f356fc1de90007"], 0x14}, 0x1, 0x0, 0x0, 0x80000}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) (async) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) (async) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0x10408, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) (async) write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0x10408, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) sendto(r5, 0x0, 0x0, 0x200048d1, 0x0, 0x0) (async) sendto(r5, 0x0, 0x0, 0x200048d1, 0x0, 0x0) syz_fuse_handle_req(r3, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) dup2(r6, r3) creat(&(0x7f0000000300)='./file0\x00', 0x768943b6b926b3ed) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x1001, 0x2}) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x7fffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x64, 0x0, &(0x7f0000000080)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0x11}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}, @increfs={0x40046304, 0x2}, @request_death={0x400c630e, 0x3}], 0x0, 0x0, 0x0}) 1m29.467115373s ago: executing program 0 (id=4601): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0xc02, 0x0) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8923, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x404000, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'macsec0\x00'}) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r4, 0x89a2, &(0x7f0000000200)='bridge0\x00') r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) fcntl$addseals(0xffffffffffffffff, 0x409, 0x1f) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fstat(r5, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, &(0x7f0000000040)) setresuid(0x0, r7, 0x0) bind$bt_hci(r6, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000280)=@req={0xf6af, 0x800, 0x1, 0x100000}, 0x10) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r9, r10, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1f, 0x4c, 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r10, 0x4068aea3, &(0x7f0000000100)={0xc7, 0x0, 0x1}) ioctl$KVM_RUN(r10, 0xae80, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r11, &(0x7f00000002c0)=ANY=[@ANYBLOB="1500ff001100008f3a21953e734e4ec434e93bd4b53f08003950323030302e751199e10d72e79fc590657f"], 0x15) dup(r11) close_range(r8, r0, 0x0) r12 = ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) rt_sigaction(0x40000022, &(0x7f0000000080)={0x0, 0x80000000, 0x0, {[0x400fff]}}, 0x0, 0x8, &(0x7f0000000180)) fsync(r12) 1m29.455912493s ago: executing program 0 (id=4602): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder1\x00', 0x1002, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000010c0), 0x80, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, 0x0, 0x0) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x1b, &(0x7f0000000000)=0x1, 0x4) (async) listen(r3, 0xffd) (async) r4 = socket$vsock_stream(0x28, 0x1, 0x0) listen(r4, 0x0) (async) ioctl$FICLONERANGE(0xffffffffffffffff, 0x4020940d, &(0x7f0000000080)={{}, 0x1, 0x1, 0x2}) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000001200000008000800000000000800090000000100180001801400020076657468305f746f5f626f6e640000000800090000000000080006"], 0x4c}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) (async) ioctl$KVM_CAP_DISABLE_QUIRKS2(r2, 0x4068aea3, &(0x7f0000000000)={0xd5, 0x0, 0xbf}) (async) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) (async) r7 = syz_usb_connect$cdc_ncm(0x1, 0x77, &(0x7f00000001c0)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x65, 0x2, 0x1, 0x9, 0x90, 0x9, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x9, 0x24, 0x6, 0x0, 0x1, "d75da1e5"}, {0x5, 0x24, 0x0, 0x3}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x8, 0x8, 0x3}, {0x6, 0x24, 0x1a, 0xafd, 0x11}, [@obex={0x5, 0x24, 0x15, 0x4}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x0, 0x6f, 0xf7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x8, 0x8, 0x8, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x6, 0x9, 0x2}}}}}}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x300, 0x3, 0x8, 0x0, 0x8, 0x6}, 0x34, &(0x7f0000000280)={0x5, 0xf, 0x34, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0x7, 0x7, 0x9}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x1, 0x2, 0x7}, @ss_container_id={0x14, 0x10, 0x4, 0xfc, "98717a22569e6546b601025141e5f902"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xd, 0xf4, 0x2, 0x4}]}, 0x1, [{0xb6, &(0x7f00000002c0)=@string={0xb6, 0x3, "998b3a9abe0964a781fc3258f29bc29f1c3c021591c7f79d34ceb9f91a27fecfdbf07ebc45a4e5e303659663dedbc57f08779491db54a767501adc5df1488bff53c5b1104af961bf06a10182314b2c6cf34e0697ef01391c5fb667f7ca8f04d3966a91a198f691cc7b087d07db343507e91eb24bf9a5ae472f3155849017b8bf2c92ef1f6ede41a7301b1079e542b665d2e4cc701bb1dfff754c9b9ae3d4c4dba4761902518ee3947e0eadb3894319a3f00a687b"}}]}) syz_usb_control_io(r7, &(0x7f00000006c0)={0x2c, &(0x7f00000003c0)={0x0, 0x22, 0xdd, {0xdd, 0x9, "304400a0881c2a17a82e11a8022514ff5c91f3c13172c0ae1ab3aeb05c9d7da6846b4fbf730acef989e62ce329d526f3b3ea1511f3e804453702ea0d9ea7060d687afafa52bc661c0994f412b3eb59eca9691d8eb4f8ee35ea8a848c75c7e5dc39e73f8016ed86149f62d5d8ae9e534287060ae59e8f02532244a13f69ac53982b69e39ccc9469c4b018fddb2431e9a530d1f51e0632fe675414023129deab81f9f7f4bd584cb93352a7e7858dc9e0d382d762e2be441e3734b72b5ce9d7f2853d36fd7c91195f26754ba00efbf5bca7b3f32049e8f7f958b4d298"}}, &(0x7f00000004c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x414}}, &(0x7f0000000500)={0x0, 0xf, 0x10c, {0x5, 0xf, 0x10c, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x6, 0x6, 0x5}, @generic={0x56, 0x10, 0x4, "5dc5412225650ede3930d8ee148e4af7ca1cd2f68d4f333968be19280856e0b6dba09a8c1d73e6fb0c9aea2cc2b9e956a9badfa8502b4063e7a04ca134ce21bd15f5b502b457fa34fdd47ede2eb0eddbc205d5"}, @generic={0x91, 0x10, 0x2, "4c6969574129ead32cc8e82e7acd39832d5ac21f5799d3cc7bf5c2668938e7e7b2bf96cd922b73772205010654163d16992a4e2b4aa43876e33a4d4db2cd2876f8cec10671510547bba5a21f2dc6aeb67274b7022d986641d26dc6b7863df9459d20e3b63c2fbfedc42c9aec8e51dada8262eb25c910511f46ee1e66ba9422cb194226c5a7209e023bbbe2e80e84"}, @generic={0x12, 0x10, 0xb, "3b5dd5e95db8ea2ee813391b66de18"}, @ext_cap={0x7, 0x10, 0x2, 0x12, 0x7, 0x8, 0x7a8}]}}, &(0x7f0000000640)={0x20, 0x29, 0xf, {0xf, 0x29, 0xa, 0x10, 0x7f, 0x6, "6409ba4d", "5cda6012"}}, &(0x7f0000000680)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfd, 0x0, 0x5, 0x2, 0x2, 0xff53, 0x2}}}, &(0x7f0000000b40)={0x84, &(0x7f0000000700)={0x0, 0x14, 0x50, "537e3940435127e4a94c3ac3a8f36ea8ad7c9b2cd0ecf7f699b7a0c91b7e306e7c004e68fa7db634e2205c5724cfcfe4b66b408220652eb84b8afdc7cc2c97de8a5eaedd9b3c87141ad70546049515f5"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000800)={0x20, 0x0, 0x4, {0x5, 0x2}}, &(0x7f0000000840)={0x20, 0x0, 0x8, {0x160, 0x40, [0xf078]}}, &(0x7f0000000880)={0x40, 0x7, 0x2, 0x4}, &(0x7f00000008c0)={0x40, 0x9, 0x1, 0x2}, &(0x7f0000000900)={0x40, 0xb, 0x2, "ed2d"}, &(0x7f0000000940)={0x40, 0xf, 0x2, 0x4}, &(0x7f0000000980)={0x40, 0x13, 0x6, @link_local}, &(0x7f00000009c0)={0x40, 0x17, 0x6, @broadcast}, &(0x7f0000000a00)={0x40, 0x19, 0x2, "8ef8"}, &(0x7f0000000a40)={0x40, 0x1a, 0x2, 0x6}, &(0x7f0000000a80)={0x40, 0x1c, 0x1, 0x5}, &(0x7f0000000ac0)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000b00)={0x40, 0x21, 0x1, 0x4}}) (async) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) r8 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x5) setsockopt$inet6_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000000c0)={0x800}, 0x4) (async) close_range(r0, 0xffffffffffffffff, 0x0) 1m29.344289575s ago: executing program 0 (id=4603): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0xf507, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@flat=@binder={0x73622a85, 0x10a, 0x5}, @flat=@binder={0x73622a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x100a, 0x1003}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000001400)=[@request_death={0x400c630e, 0x1}], 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f0000000300)={0x14, &(0x7f00000001c0)={0x0, 0xc, 0xd5, {0xd5, 0xb, "0213c12e4873b06a3af8076f0ff8f9de90f40fe7cd4f53c02f601e495b1fbf8adb2ff5c1ff42cbcfca6aafeb2fcb4425d86d236426381ef392ac1255164dc7936fa4fec00d5c80ba69f9f24bcbbab3e4b0ee4889aac62173f570f5b6fd960c6da309f6241d9ba779753f7d60a88f8d59d0a85c3e67ff4bcbd7ba65197d975a78634eb923e142562d840f05d43db93738adf1c235a33f85c29a455c6ca28ecabec09ef3c406cfd9d271bf9e4eac2256cf6cc4d95cdb95ea72814eed845c48396525220040fb77944ee7c52a99b8350de8d91a1e"}}, &(0x7f00000002c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000005c0)={0x44, &(0x7f0000000340)={0x40, 0x14, 0x7a, "691aebf84f76c2fba101fc8774bca00db7a972a35212cfbc276d61c411ea96764fa67bb7894fff5043aba556922897a7a33c5409919bceb61aa1869407de1871a63c469a9bf9799c899a0fa93dcac630bf145c714e474b69332834dc296367282c347035d58b6e43c8ed929f0313ec91c62bb275f756d387c6e2"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0xfb}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x2}, &(0x7f0000000480)={0x20, 0x80, 0x1c, {0x0, 0x9, 0x7, 0x0, 0xc30d, 0x19, 0x7, 0x6, 0x279, 0x0, 0x0, 0x7ff}}, &(0x7f00000004c0)={0x20, 0x85, 0x4, 0x2}, &(0x7f0000000500)={0x20, 0x83, 0x2}, &(0x7f0000000540)={0x20, 0x87, 0x2}, &(0x7f0000000580)={0x20, 0x89, 0x2}}) 1m28.824569305s ago: executing program 0 (id=4606): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder1\x00', 0x1002, 0x0) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) close(0xffffffffffffffff) execve(0x0, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddd8) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f00000083c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000100)={0x50, 0x0, r2, {0x7, 0x1f, 0x0, 0x8000}}, 0x50) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000000104010200000000000900000a0000050a000200000000ff050000000500010001000000080003"], 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x4044844) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000000c0)={0x2710, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) sendmsg$netlink(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000110001"], 0x30}], 0x1}, 0x0) syz_fuse_handle_req(r1, &(0x7f00000041c0)="412e450a2a7b9586d1e6e9de257afc4fd60c8de430c0d6348b2cf1db8d070a539de9c1e91a178f9240dbcfe303566018f6c20c55d643a2ed46aaacf49ca491ee2f06184bdb548778a2c56e56f6b40b994419428bbbb9dfa5f9593511ca8ae1c088fb0ee5da72f505000000000000002c04754204f194ae6ceff4570d44496eeffe619998eafc7167d22e1c6aa73e89ad19224e35130a37cf68d5c41ccafe59b4b753a26e06c4306d31d78de6cede97c06e3ca2cc4af66b7548268efa91621ffca2655d2c8f1a9bb019b88fa729cb3d32f72c098c44898d42c42f39feb4faead93980726c236129acdf31c01f1cabb5ca3ec4e45eb5e6e59912792b4976e3f2b560c861d49b539d8e1870040a8cf190a8a767ec067a8048aac53336b44669d3d425843ae80681a7c02a5d5a3d90f355fd4a6ac277e75230d558f0df20cb323cc65e9b5a258cdd669c8a9534e4aff09a8fe89b124748c9e756c28789c2152a5142bc0bb205e339d43bb980b3f04a3c1a424a2a093966b20600a5410e0528fb35937c998eea19f01eaf2f39e16d85563a6737ddab3213ca1832f0afdf891e34a582f6a4ac81fda70ebc3fedac2fb3a492fdb40b91021e5d371d990064cd1f7c2c1a6472dedb505f9a4940057a3e57fd53aa3cd2eb914e073a19b6e925f8553e6875c093c7d19de25861fd9640f0eca4cda0467f12126daa2e0c6df7d4e4babe5a6e59e8391be7700790315b6b8a8aa74cd6d3f054aceaeda79430676b67fe25c9029e0894b413377fc4d8300d9f9338fadd07e4c80cac08113df8971a868458c47c06fff0c1c4bfd48ea583e9e76ef103d42c233b6de10b30612cdbeb6b60a6a4dbbe2da63cc2dd4fb93cac65af3c1279274f4af0e2c5b96e6068aa5b41f7548fb72b0c142351f64446db7425115b89132b5589ee642ebbde655adb2d7d1117456a6e4f2886879b42baf85e05d53e2aceea9c3830673bdc4d081675fe76b994651af9c3f16b7513834fce4654f84558a8308fa677d05bffcc893d5e02bf87c5ec520cd66ad58dc06f0c47d253cd36dfec82980fc8dbdc9e185fe4fbdda2c2517ec9abfbb4841252e650b6bf56fdeca9a4ee3c311de3c6859ec14cc00e95323c57c02fa894d83ea17944f3112fc19a7e11335d7951ec6dd5b4f06fb9b637313a230341ea5da6a7a959e707d0cd5fca60a6649c8df8d6c17e9a49d230e5775df14e4b43aa3420bd0b8814ec7360ab1910e69fab8932f7646d7998bdc2e8ec354c52da21ed83fb7582cb9d37bb95f144974f72c7b0ae7b42945768fa8ec0dd6daba72d05809670506ef1054282201b00906c8af64e3e13a10f180688c96549b2d3d6b04403fd571e7b132891dd4b7cf37aec25ca1e9190c17aaefbc31e059915c12c232fb7097e9fa6f35fbb265c7102db62e2264590c583ea90f1aee3f166af81430d9084eb0c760ebbb16049c9fd1fee6ce33c8ac205e3ac9c275531feadfa4054e0c027c26beb009f54aa72b864d39bb11753f77931bb960276db33021c65671e57b3708bbf979be222e8439d71f58ca87cec7a054517af398a42735b580717377a54f139e2c46813cbb03d98e49c26f4ed54d75e48573cd06145f913f4e313eeee837496dfff75aa722fd8486c45f9c959da12ae48ba4a10712120a203e2476c7b96031d8f8773f68344e6fa21831287655aabbd594e9f272eb1a7315d2d79b8bcd5e63004cd106f80b1e40a5d9e428a01bc58264f4d63c2ee9db6efa70607a642aeb883bf4b9fe009d7f09c16b05a2c9b73573e9019e161ebbdc1fc9b9cd0c5fe1b57adcba2d0f3a767ad59aafa159b3dd181f0601ff95e8af8b5410e56c81ffb8ab35b1e04af35dabf69f08572e69260b72bfd502c5a0de627fd3fee44bf1d4a261bd356056c5739398e3ff161beec1240a089625daffbc61dc5e660c274565477a0ff1797fefff04a98704802ab0674ab72d400686229608cbfd2ca20f4e62495e8b09de9d180c47375bbad72f4474b67d56104b4b466192be60f7aa668fd0a4338b856f114311842ee806d6488ab09098ed9de0e21bcc8b42a5d5713d15eca108fcc7a65d6b414a112524a6e1418644508dd957147a92d4399d13faaf01cacef40549cd11900f9aa32a8333f55796ef25d33c554a308da9797cd0ac25888311b0ac88eff0be7a36ddedcfc2b095abb4d5a6a4edbbad67b70cdf60c7ed0c5e040ced90edb3322ef684332358942ede9191b431c99b3abf8f9c50206479f0ac118c0a99df61fb9c90d846f41caa6a2448fb7e15640965e051c2af4ee72a5cc7c962bacff7019615c10e6c3054e2e5792df3aa6e2c33425552148466a88568cc79b6edebf0107b7d3d24423a665d20c3a1c0f1a6b34eb475bf875912115914cfabcf394f8a096d64e5dc95705079f748b9d4688859c0200fa43719e4722ed6c064c0efa7e07beb2a26fd724b63537fa0eb506365d5c029cd8dce7dd0a1cb9d9058c061739734af6be9e880fe7e28a211a4c368a7babd1107110ecbb384b274cc092b9511c4abde2ddd863162e2739984a9f3c0a76e3c530a27d5e385f4a3b87607b2a944e09d28239661d27719e22c0a657ea383c30859ca29cdb8fbc79bc83e995dcb361743a7e195650c37e570b768a0a1f0b118fa5be9b3c838326343ec5b376d5ee040ee29dfd868cccf9cfa4591151f519cd6e2ae1453a58aa92f90ee5be11ceb8511ab743f399be0a190eeddfd112336866831c3255ef6520d88b2581ea3767f3df01a38d9b4656f2a89c5df41443291a795da45c8a846015cd041bea0dfbe648348b10ae73ce43d9017182792cd9172eee642c549a530cc1f537f9aa70ca63792ba4a86a713ae09b917136e5bf1506ad7f367d8d2f77f47a2318facd109bba9b1327b5db9e4aeffbdcf414db761eeacc227a15cd72aa52c8ede33bdbab9de9aa1e8f470a388013d07f08777e2131bbd4856ab5c1c38d03ef407197ccf24e8b2a8db69e78f9d6623033c453e2e54fce65fb785467064a146c4bf218068b5e3efdafaf93a98253becaef226cd79468ff1bbe0c9d43877f5cbb5844fd8957f15d3ef208aac11816585cdccf039c36b429d3d7fb634054fd0f09c8abea3746a6b7379142abde26d998ac7e39b94746c60c09f86ddbd7497849d1ef839730672449f35a3c3253666e9fc053ac1c518e44e0b84555be507f7c00fa9e4864b4bf40ac3d93f12001eb780a779e655d0633803268c094ae161a0efd652003d6ac47f9a6c28d866b56233f371627b01e0fe9361dca611a28841968d4e12cb73d49ce08fe25de4a90b2d34607202b20e71f5e1eed38e17d0a2748f548cf61735f4c9cead1cb93b11929d906d65fc60f88e6919b7b5a1014e6d408bce9c8cc832eecf9147708fe451891717d2ed99dee70773feaa97985102abd3dd05c904c28898afe060621db6564887bc4afe158fbe1d819136a1ac1dc9d8674798a93daf5255460b50c34496205834c668db4c764e76ebb6cdaf5fc44b881cc2ae87b4a7cc045143f96b1620abfd0f116e673b335beefdafa1e58d9194e010cb78956044646da5ba853ce981667f2b8e5001c2df437c9d597ccd2be7d2887f5cb7aad0539abb3f9db1c8f5cd4d7d831946ba1c1aa8737c114fec1ac9a82519f57cb48c49b7f62e9eaa89f448df33fb307cd0036c70b490ac340f7d04e14f32bfeebb08a9d5bc7bbef8f231ea09311d4c82cc55c90eb53c6c003cc98a34dd3c4ec2d8b3a655a78e16e908f368733d0a02b36fe963e2d80b5e6f7b2e3aae3013c900c76e4d56e8348bef221f8a642e692c23b12520fb68c793e789eeeceb4efb2097a4d5952d144094cd7be6edc933d257f6230e962d70ba42e1b07ad9eca0ccd60d3d9a6e06b73ccf96a8aa490ed3bd58bf4d79db65355ae145b54be004e464f4dd23fb8b1bf15e13838116083da67186513652608e37c8f847b2bcafb57bcefc7efc8c8182c7d708cce5d14695b4e618e77f8e7be81f27a05e415fd37ac21507a665b2558daee5c0b0859fedfede8c03f181ef5e0ec0da6caa3edf402dd73bcb4026c489a7cca8ab700d3e9f050006c36768a16e8a48e48ed5750b8cdb7ad1fd12d4cc8333d324d6c83905303fa7013fc02553b587544affe38f1a95e0c4c39740d63b6d387fc89b30bd5fd745cb64844b13897ccf5cca135f7d39e03ce8adcda919d86b25b52764b0a0c4f07f88df68868415de13863df84a7e8d355b09cf90e482eb4174fd01f1b371a4dc52f3c89fc3a70c71657aa5d7573ef9acf4d2b0b321c41ff2640515bb43637ba2288ca0bff2e2a3a998ad8294c52f9edfe0a4ee0a3f8ed5b4b5c43319bb9c58dd07ea3237d7bb62cb086e7ea4a81cba2cdeb28794a09c275a704963110b64720bd089e3737ee1a91e348b5e97b63e1724de1fa9f49961d653bbb47b6fa993b035cf59659bcd0306180645162568abf51127845cbe6e37cc3c19b9d69657db4258fa5e8428a73eff6506bff474c2e302ad5559ac8de44c6f0baba5e2e579e7d7f9d9ebf540674432ac11d92bfc9abdc24126888b533f43bd6f293b0bc315915743114a35308a0ee2e710522137918a2b09ddbbc7a2313a2a6b85a1ad26f14dd70072651c8300ddf6de29704b716ce1bc431c66ccc96731f46359a9f6850976c96dcb5e0ee47446f50b6b3ba90d45224066e123ad3854d877c0cdd9325000ac0d6813c30cd43d3e150335601724ca3666458dc4c04f6562296982353e155d5255c9008c0b46d21a678c8fcb3aa8d6574476e0458eb0a76a6cb50f929ed218cc4654cb4f95fb3afbc2548b74acc312563375a19e55d488599488dfed4dd31b39f29ad61dad343dfca3b45b316a34e7a7bebd2b0f562a9e69848d13fc80a4fa52d0f17bd15d9e1fd39a7dcc86128d14493805d105a745673bddea68ca74ac09d95cc7412d5be2cbd0a247a81dc9e148111e22cdf3375805469226ca3538f960a6ba6aa0eeeb87c784ffb1bfc09180a61be3c7c535fc6d593c3b3f4de21b8c3eccc9021e80fb07dce0aeb3b023bd55f24356f646791ba80e5ca21ac092a069ae0a22cfefc08c23cc7aa69b570bd17cce9de15871d363f167288f99f04761caa67f12c949466493f661d39ee4280c955446ff5a9bb14f2d1ae21cdb91a5868e0c52097cf380f571935b140562922763f1b79c3709b949c57a00b08828ce9e685f6b234b5fe3c62d9feb249ce75e81f5efd556c14d5da24dc0554723fdbe52659969a39f470e82c50c4777c908628436e31177af1125d5f70ff627462247e5bc20c47ef75f369174586d43d42f7eefdd47fefa745badebca2a881ccc018ea411cc8a7a0881422bee8704bb98e6bea9fbec63441fb45d7ccfd436909b57a2b60b788e15bda3ca7663b19bd84d0879deb639f10def9a99d42a4b9a4fd7fecbf6d2e7598678307ba9a5b6f143c27cf1ca41e3c904007bb762cd5df6e63c4cf422c2ba959e53bd8e5664cf5df6a91a4bc8cebc52b22f30060fcbc5ead53d38eabd160c1da4cab8aa95c3640ffd78074aa2cbb05cb8ea90a0c95a4a1b2be1ee94f238000f1faffa069d87039f13f5f84ff368aec5a0b10020232b9fc954a6c22573ef48459e574d48a4845837e1d6ef386738ccedd093d4d5bf3a3f790c875ba7449d03397642feb71100f2c25ab2cadf0b0802544a2095a51b19cdece623b17d420b173a99c081f8e229b6de3c680d6bb39bb98b479517d77cca581b81cf856753a44ebd64cff111fb8ca37ea45d217a3fca44a083e6c35b0fed9f8f7631178d15e88f86c85f1ce68c900afdd1f7e5b8bd4ef3f58c447b77d3befc49180df7a5eb2ae8ae33b4ef573f3a425da8a60cde84d8eeae6d6399b9fbbfa0fa8d448b25c7f79b7554d0b02b0decbc74ae8560f630af596313fb33d442a410061ace0aa7a440d5e31ca8bb2cc495c4f0b672edb011b0c5f16781836df7f4af8329143d5a1a99d7b18ef9f774c4199d635848cedebac82637a03a189c65bf667503737c75b6639ac65ad424ca475285437e6f19830b36549f607ffc387c8b11a34a838159376a6335afaa045bd2bb04e279dd72436331d07dfbd72e2436b27f0df23a266fd15cf56d1a9e93aaac8901cfe49a3219ae36c5c65c75e5c708fb82cac4d6a50726509ec3a7d32d54cf584ae353a5bff759fc677a0b240cf8a0a72817c9d37699ca89c96e0e0d96a7665ac3a7d1febca1a1d79e2cbde8025c271360e2f90048b2d9fd56f45c013e001dad4b7785be69dc01f8a954ef7a84455986fc5c9d5167d91808efdb4476ed79f99563d887cfd4e99809d9e388501dea228cbb3cf3770082dc566455251fd9c2c742963c33500618c6ec99e0bef007408a0462a081237be4c6e5db0258d4be5fc9cf63fd1ace1f4166c053b0fb84fe24917da1255cf40bbb1b45644f6a7699cf802a35a932c374b1d62013e6afca3787627469994c02f622ab877ed5491fc2a89eea60e4e1628da89e3ad600ff6442e4ebf20e47304176b6a1703c094b3cf6d7fbbddd8d8fa5a00f28b4d8f43d88487e9d4531071512f2027198714a8d1cef126775547fc74f2a35840510f325e50361be76557767560055e084f2ecaefa0dd8ca8215301a7a887d2eaddaeb1f5c3dfdbd2cc1ba5f02d4426b98c0f861c5f724405758f442560ea6cd1d953456cc4aac6642ad61c03dbaffc2364d8ec2ef9f483c70355139d1fbd9617ab3c7eedf0b8963c1cfdab769180db43c416a90d9fdf3fd0eb2f81187642b4e2a09d6462d27527fdfda31f7b262501749dcfc6c184983f9923424131d05cc811cacf5c2c87e8e6f135349e68cde0e8997bf1dde248e5124d5dca2681abdbe58d327a8edd585821f03fdd4515728f1336495ba25c9bba56a3f706d60c35cbd0b40d0ac0583a981f9af08510ed8ed0a726e5472f8995af3837fbf1e89587633d2ef944868a153919165778e963710872af12faf96c0919c638e5affa97104471ba6e178d27602f96b9546ebe52190d91be245be08742b96389080676a566d3229e593e4f56a76ae4c58113c6adc1088703b1b92dafe32a5600e14ac1e71df829dfef425911f16a2b91f693599ecabf93065c6c4f5fefca8d4ed095599113529f65d9120d5252f577af95b404979508c343df54e4d239720e7d3a861f1dcabfa69e12d655c8a026c10a4df279b139fd222e561d205ac9b45c1054f8699eca594fb23886e0de565186597766dd5e40f74a423d5708dac254f4172f1089270988fb18715813f13ee4d131b64dd517c7e77f27f804b229f5339ac2f483b14739ac33a9645044d3010bd77ed18fb117f7b11bb51c4ed683b59e28bf25a58f123dfbeb1f0f21f03d9b57d8e61d59b311037a5b757b03ca5c95e0eb73922c6918530c99de4d6733640f2b8d13bebce31d4f5e27aab201101e48cde23a0d7e87b9511949d812e3187ee5ff11bc5858c022ed7b00790eba32f9ef7e134ce5f73a01269ca971b40e62133eca9d596a768686d6390b2c74602f6dc597faec3ed9d9658102d99c9624c1a97d00d63853578afaccc7e30a77fe054ebc23eec45f608f996fd015cd6bd50a111360f0790eff6ffb1ea59d13c8e29480bd96217188f97e53a1f5d9eae0a2badb4fea52f2bb4f8cb04d0afd99e7371a978a7d7ef473f77ea6738ff84af655313a12db24cff692ec7e282245ae9a42338db814593448f7115df3dc3f4e2faa2c2fdbd68f679d6aba01a15031347bb17d8bf8f1fad0ecf365e9dcd32e69803c5c05f4b47adbf8a21af7e9fb327f267df1c914486389a9820edf0a03bde6ef388c255761e402b2f7e1f9c1c3c95bd30c502197ab37f76b52f0d0675f366e919be19329853767bba34a540fb75bcdcc9596a4cda254a660e11bed5af9d8646ac4b7d6d7aa5d7c0005879b6d08058a56c3d3a4d3d401b883153fa7f2f6a6d34dd010f6b9e7b4e457b9ff5a5802d7723abb35f9dca0afc10fd534e7753445b7268d90145b6438b93fc475f44d5d678d79da6c5770f3a9106f3cffbabe4b88cbe7eda9b8a495be4f6717b0fbee6fec78c86031b6d878d47e357b2089de3e6dd19a265552553d1f7da53884ef84d0eebe782791c48a9c68a28d8ea3bb70c922b01dc20b2cd05cfb276e326651398f766f5faaea54a41da597cf6b50f3d5ebc634185b99069126b8d935c6bc42c47f2109de42091ef4ade3d87cc44aeb78709255501e64f34ac2d4b2725cf7777315f8ca9424bc9d61a896a93500faa6cf5a5aee1fb888e17b47a38a667be2ffa3bae46afa88bfd8b5b6e1186d6e41b9a4e490591043372c23f36fb48d80caff74cc349adc92bb25f701738c809ccf74c47afa193795ee67bc58ea7fd85542fa7e70218490fff212163401cfde016df2f42496bae403d5391e53fe200f758bbcdead0fe72c77861889b9632a257229c35bdfe8fa78375b4f5c768b9c60cafbde1f00aff6ca1879f6472f28001f5f13d4d9d6c3a90e04d8df09873550daa8262d39efbe96a79c697fbcc9a7f27c9f6d782d5d5f6d024b291376e9cc40d902f809072e1f0f2c2ab88ce3d074e88461f5971853e7be749943ab6e25e25e8afa5042dd73407f49b50841c7782c54eece62ec2beef1f16caf1ca5989427bd2726ca0fee33e303702e9892e4382e92c3f3a03a6188f39762db81819c7e12b424be8fd964dcdbfbac00139e8c5a6200506f13f484ac34ef3d26e7cadd53cf402117419c1618205bfa5382486094bd55448f2b1aa4dbec2289189b601b1bbf5792b2a641c6f5dd19cf24abc72fc5264cf11f6b44a4929267a02cd1de1b602b9de65a6c06640aa0f76109baa90d66eeb17295b1711365b7d6835a2dd55b7fe868c59453613240643c847a5b48d27897a58dda63e579c1bba58350550e147b190f0a2c9a5ce719d627ce3302028b4b6801bbfa8cd74874ffba35817c0eca034d19210950796807125fe6065dcd47d7c870ed2db5c00cff235e4154e2d89ec2a09a87551f9b7ca25d519b5603c0c33d2cf72878199ffab567fc5e093529b89d1163587f3564ba8291d2d96cf9762e7f568e786ea90849f6312c1a10f45d61600cd45c48e6870a7d76c913f9c4497374fc04401cbd11f7710740148234fe8f041f24d0278fcfd48846e6aa49f05016fc332dc5d46b4a26574fed5c0751cebb9f7ab4cdbc1ee011d82d6ef95c52c9df8eedac3ab5cf30805f23d88d4f707601f8e6c606b58f2fe234e948d6756d430a5c4ec76a33874886c8fb484059b47a9bd198a61a1896419288a9e81d0969dec778a53e8233f0f63bd0134e5f29825e7817e7c8ccb7d9acd8f86ac9d3af78c43df3036d7934dd294f2bb12063bee52c547d27a218145befb0ca96cbfaabd39fa245b51c39f4cd4cf8db105f9dc46a7aaa8f7d06fa208120ce1ac49326179618fa2c8596c44e174eb7a141056b1d17689c10dee089c8b0867b8a757ae12251bbd68db5fba2be341275fb6ee379309f5cde9b31242b0b2bac44da74776fac141936bd96e3177161f057c820a8c22cca8cce29b158eb55aed0260253fbee70a6dd281d9fca23e0b0a38d46c76a95e1262f1cafcf0fc37b52e649a1ba1e2c0f97d10bbf4d2b5632cf340bce56736071d5885ec9b4e17910744d3e63e2ca6deb21e43fc21e89c6865d3ad424ef4a14efe8843ff3168c99ee395400dcc8755719d290c567c95a5e7d28ec1190ceee240084d444265cc801cd960f69b368359bbf06b8a4ec23b47c7bf9d4b16c701a1c4fb9e81abb75bf49d450b566ce03de939fc6f5c51291380086f8c995cdd4fa15a325601c4846a69f15c77f55c900270bc9ea5f406480cb0e3e89bc869fe8b7cec4fbef7e76283d50c25ab1b4d34d093a7df062990a925a9c44aa2661abd7d381a4d6cdb64821ef624dd51b72e99af914bca2f80c25b82ac6945df7c7582e6d0ce2cd073e35f1fc120a68ba210410db64592a9aa319b30f2b818c495750e1cea0610e27d52be31e52e501a3bd51b501bc51c2ec8592f679b6e55b9aa58d513fd2bebadc83ba76eb45e5676f130193e9a666b8c8132c9f5141681fbab324b555c5c890d488ac2dd00feead0a20fbd8a46391438e3193edc6fb89161cd864fca98f4f39a2893c933dcd13bc8c5d5a548d24862e8161c0fad7f33aca8c86791d620815fe3f0daddb5defd933d0c10097a7a98e67625420b6c0db7c3e17ab07ea64e6f0f53fdc670799e06a2e3a871d6be363a2639e35339361311e0f528cc433eacea4f79bf217108c7b1d657840253ffdea18bdd1f93cdee63e7a9b8dbcb4ee06162b253e09ea0641f2771bd9823dd210905e9ea495f43194bb471cdeb690e8890b03b50835d53dde1b572dd123ccc8507bb57a45e46c0efb8fb3d5596bddf9782d86dd911636eae2cf64b5829cf8893faf789be3fa22859accf688f5b5da6c29cacc96d477e23b63cc934f685b6e42e1655c9a9b94d6d78402de22b8d9776e3915391aa258e57467d770d65480ba2f6a94b0337965a8c659c42b4e90b14da4697d0c0a6d74774c94c52d8ecb694eec747bdaa6c3a6d60739db18c6446090eebba72e62ab88b0e8b88e728ba8cb133d8524eda89a2bff1c8414da3edfa6f83788331c8a7e5a8af2dd3682d4752190a3c689949abdad8350111373e7fb46151f54a10f79d91940e37efb05f9f157bddcfacf018b65a38ab614807c34a2786af4a1d48c4d1c1abd31815715f9d1b103992207fc664f12c82fd923c57d8e7cfb9f4af55182318d055c704865cf484206d60e34cf7fe9b6ce60b1772c5c7cdacb6695227d80da18ec1f98a434b1aaf9c6b6d082f5663aed2bf267e559dca6b93d3ce34273846fc677f529690482df0a8f782b8ad7269f344f5f2b4d320a7ce2d2fa02284f8db634dc930c3e2b9a629245364acf35d41e9a14c88efde4e742ef1ea4b43d0caf2e70d4a617278823e6403934524debbd933e7676e441a48f630dc8bcccd55d9032d6bf3dea97d1669c39fb865b0e619eeb3f5461e517000f5aee3ef2abdb87d3a76b88e140eb4644a9fbddbdc9e20972cdfacf00bffa3a1ca5f84122c2ebc54067cdaa23967eaeb7bbbfe44e5843382b834fae1f62a066688595e4ee67c7ff9858672355abf7893ebeb4bcf88a62b2237c6e6cec9aebe3f28bfc310ced3a590e88d4bd0f53289206deb9addbf6f3c02115ce4980dadfc112683ae250c2d438fd9c0f2a090dbf122a0072828db798bdb868dcd47384dd3f5eeebc0307a5b268683cd51f312e8f02b5a7746b11a97ac43287d9b9765f03c720503cfe6e0117660a4c00d67895224c4d42b032000a10d7a743054758a8f54941fd5eaf72498b678d1579b3de4e5518f90f1e3d32517d09d7f5da9d180215e66218e9dd64036819cf12638ce82712a6cc79a9ddb36e86814b797d72c2bc58b18ba439e99965f745b4fb7de2878e3186e3e7b835c746b0935f6c67e92e3770bd8d5eb4f66d8175ceb7850e418c55e574db891639aa77fc62bc45dcb734681ede8484d4d4109a9adb8c3d00", 0x2000, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x20, 0x0, 0xfffffffffffffffc, {0x0, 0xe}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f0000000100)="9ea1d0081f", 0x5) recvmmsg(r5, &(0x7f00000008c0), 0x10, 0x0, 0x0) close(r4) r6 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x24c01, 0x0) dup3(r6, r1, 0x80000) ppoll(&(0x7f00000001c0)=[{r1}], 0x1, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(r7, 0x0) 1m28.656955228s ago: executing program 0 (id=4607): getgroups(0x2, &(0x7f0000005e00)=[0x0, 0x0]) setregid(r0, r0) r1 = open_tree(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x8800) preadv(r1, &(0x7f0000000700)=[{0x0}], 0x1, 0x8, 0x101) (async) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20002, 0x0) (async) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000000000000002"]) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r3, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x5}) r4 = eventfd2(0x0, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000000)={r4}) (async) ioctl$KVM_SET_GSI_ROUTING(r3, 0x4008ae6a, &(0x7f0000000100)=ANY=[]) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) write$eventfd(r4, &(0x7f00000000c0)=0x33482a86, 0x8) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="397e3fdcdf2ab9332b1077cce6180f7af2401c5b976ea57603cebd3acd072011c78a320329863caf794f9ce4e6c30be8c9b5370edbc81f75cd128395fbb55ca277dfa21fbcee2312d90865f9db2ce881e629cf2e8148eda09d", @ANYRESOCT, @ANYRES16=r6], 0x0) close_range(r5, 0xffffffffffffffff, 0x0) r7 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) (async) fsmount(r7, 0x1, 0x8a) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201a3fc000000101c1b750a4000010202d7a4f63115666e5201f404215424040004010301f44af114119200e0943c0203092101007f01224b000000"], 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000180)='tmpfs\x00', 0x2800408, 0x0) (async) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_readv(r8, &(0x7f00000023c0)=[{0x0}], 0x1, &(0x7f0000000100)=[{0x0}], 0x1, 0x0) r9 = syz_open_procfs(r8, &(0x7f0000000240)='net/anycast6\x00') read$FUSE(r9, &(0x7f0000002780)={0x2020}, 0x2020) ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa07, &(0x7f0000000000)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x1}) 1m28.637397728s ago: executing program 0 (id=4608): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_debug_messages', 0x103002, 0x107) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000002c80)={0x30}, 0x30) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000f478ef8ed"]) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0xffffffffffffffff, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c4, 0x1004, 0xffffffffffffffff, 0x0, 0x0, 0x2, 0xffffffffffffffff, 0x2000000000000000, 0x80000004000000, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1m28.58900869s ago: executing program 39 (id=4608): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_debug_messages', 0x103002, 0x107) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000002c80)={0x30}, 0x30) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000f478ef8ed"]) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0xffffffffffffffff, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c4, 0x1004, 0xffffffffffffffff, 0x0, 0x0, 0x2, 0xffffffffffffffff, 0x2000000000000000, 0x80000004000000, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 42.811714713s ago: executing program 6 (id=5124): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280), 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendto$inet6(r0, &(0x7f00000003c0)="a6e2976b", 0x4, 0x24008800, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r2) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x8001, @none}, 0xe) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000980)={0x30, r3, 0x1, 0x3, 0x100000, {{}, {}, {0x14, 0x19, {0x0, 0x1, 0x1}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4008000}, 0x9084) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0), r2) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000600)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000200)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000880)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="00012dbd7000fddbdf2507000000080001007200000008000300fd3cd21c616317d9e9667f9d63b27ebcbd15054e3df8d1aba707a2a6e9418feab7bfa2987e4c660e30dd21278bdb599c24c9c68a3ee7ce744a97eaafeba1052c2dbe99db33ae22cd9fd18b26714eed1cc87b727192a4f5f896ae22dfb083da35237bc0c6b2fe35a5a317d6258e68e98179107e1b579a2a4b526e3401506d3d4b3bdc1b20cafe69ea4ae64bfd911e075ba16e74695b96c180dc95ac28f7c5c0aa34ce0c01104da027c7fb", @ANYRES32=r6, @ANYBLOB="14000400776c616e3000000000000000000000000400cc000400cc00080005000b000000"], 0x48}, 0x1, 0x0, 0x0, 0x4010}, 0x20) getpeername$netlink(r1, &(0x7f00000002c0), &(0x7f0000000500)=0xc) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000380)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000001380)=""/4080, 0xff0, 0x1, 0x0}, &(0x7f0000000340)=0x40) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) r8 = gettid() r9 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffffb]}, 0x8, 0x0) readv(r9, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/247, 0xf7}], 0x1) rt_sigqueueinfo(r8, 0x21, &(0x7f0000000180)={0x30, 0x40000020, 0xfffffffb}) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r11, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r11, 0x890b, &(0x7f0000000240)={@mcast2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @dev={0xfe, 0x80, '\x00', 0x36}, 0x1, 0x6, 0x0, 0x100, 0x4, 0x86020086, r12}) ioctl$sock_inet6_SIOCADDRT(r10, 0x890b, &(0x7f0000000800)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private2, @private0, 0x1, 0x6, 0x0, 0x100, 0x6, 0x180107, r12}) newfstatat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$nl_xfrm(r7, &(0x7f00000000c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="cc0000001b0000012c020000fbdbdf25fe800000fe800000c0a6714edc18afde000000344e2280004e22fffe020020a0ad000000e2a81a41bf79567151626a9b69500d4bcd15cbb20e261d35861eecf3f2ec15394bfdf2a5d891145d87af9e79eb734efc2b84eeefe5bdf33ce566a064dba049a6ea7b5146d6fa6679ee0acb478fd9d3971175dbb540843056ebd855113bf13da6fa408bf8a91d7489765978ede57ccbe586bdbdf84788c16ec610f230e39e48d4f33d902577dfe0565daa43ff5478de08b1ab58e2c49a3f4a6ee9e08256f2e4faab9cb2b5ab4d4830cb5f85647785cf5095f34e01a4ce42add455a8ad5d4234278965000000000000", @ANYRES32=r12, @ANYRES32=r13, @ANYBLOB="070000000000000000000000000000000b00000000000000020000000000000003000000000000008b140000000000000b00000000000000010000000000000000000000010000000f00000000000000ff0b00000000000083ffffffffffffff09000000bb6b6e00010007020000000002000000000000000c0015005c07350080000000"], 0xcc}, 0x1, 0x0, 0x0, 0x14}, 0x4) r14 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) readv(r14, &(0x7f0000000300)=[{0x0}, {0x0}, {&(0x7f0000002400)=""/4096, 0x1000}], 0x3) 42.772719334s ago: executing program 6 (id=5125): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x138b, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0xe}, @fda={0x66646185, 0x6, 0x0, 0x24}}, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000900)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x138b, 0x3}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0xe}, @fda={0x66646185, 0x6, 0x0, 0x24}}, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000900)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) 42.721525345s ago: executing program 6 (id=5126): openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x300, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)=0x2) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8001, 0x3, 0xf, 0x8, 0x80, 0x2, 0x3, 0x7f, 0x2000000a, 0x20000000, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0x1002, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x0, 0x7, 0x3c1b, 0x2, 0x24, 0x9, 0x1, 0x0, 0xffffffff, 0x8e660, 0x4, 0x7, 0x3, 0x1000008, 0x4c74, 0x80000000, 0x242, 0x6, 0xc, 0x0, 0x8071, 0x7, 0x6, 0xffffffff, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0xa8000000, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x5, 0x8000012d, 0x8004, 0x5, 0xfffffff3, 0x129432e2, 0xc8, 0xf9, 0xe, 0x2bf, 0x1, 0x9, 0xfffffffc, 0x4, 0x10001, 0x0, 0x5, 0x2e, 0xe, 0x4, 0x78, 0xea4, 0xfff, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x7cb, 0x5f31, 0x1000d, 0x4e0, 0x2, 0x4, 0xb, 0x3, 0x9, 0x4, 0xd, 0xe1, 0x47, 0x8000, 0x1, 0xfe000000, 0xfffe, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x3, 0xfffffff8, 0x3], [0x5, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x7, 0x5, 0x8, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x2, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0xc, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x3, 0x10800003, 0x200, 0x83, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x2000005, 0x6, 0xac8, 0xbe, 0x4002, 0x3, 0x7ff, 0x12b, 0x5, 0x1, 0xa, 0x0, 0x9, 0x1c, 0x120000, 0x3, 0x1, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x9, 0x5, 0x938, 0x6, 0x6, 0x12, 0xb9, 0xce7, 0x1ff, 0x2, 0xfffffffb, 0x5, 0x3, 0x101, 0x10000, 0x9, 0x7fff, 0xffff, 0xa620, 0x1, 0x78b, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0x1, 0xfffff000, 0x5, 0x8000003, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x101, 0xa1f, 0xf44, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0x1ff, 0xfffffffb]}, 0x45c) socket$nl_netfilter(0x10, 0x3, 0xc) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f00000001c0)={0x1d, r2}, 0x10) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) bind$can_raw(r3, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000040)=[{{0x2}, {0x1, 0x0, 0x1}}, {{0x0, 0x1, 0x1}, {0x3, 0x1, 0x0, 0x1}}, {{0x4, 0x1}, {0x4, 0x1, 0x0, 0x1}}, {{0x2, 0x0, 0x1, 0x1}, {0x4, 0x1, 0x1, 0x1}}, {{0x3, 0x1, 0x1}, {0x4, 0x1, 0x0, 0x1}}, {{0x3, 0x1}, {0x2, 0x1, 0x1}}, {{0x4}, {0x1, 0x0, 0x0, 0x1}}], 0x38) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e0000000000000008000f0001000000", 0x24) 42.581060718s ago: executing program 6 (id=5127): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) unshare(0x22020600) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, &(0x7f0000000280)) read$FUSE(r0, &(0x7f00000005c0)={0x2020}, 0x2020) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) (async) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) (async) mount$bind(&(0x7f0000000040)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) (async) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) (async) unshare(0x22020600) (async) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') (async) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) (async) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, &(0x7f0000000280)) (async) read$FUSE(r0, &(0x7f00000005c0)={0x2020}, 0x2020) (async) 42.580111088s ago: executing program 6 (id=5128): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x4) r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x44000) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x149400, 0x0) r2 = ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0xb) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100), 0x400000, 0x0) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x8031, 0xffffffffffffffff, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x5) fchdir(r6) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000140)=0x11) socket$inet_udp(0x2, 0x2, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r7 = epoll_create1(0x0) close_range(r7, r7, 0x2) 42.46030786s ago: executing program 6 (id=5133): r0 = socket(0x1d, 0xa, 0x2) sendmmsg$inet(r0, &(0x7f0000001540)=[{{&(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10, &(0x7f0000001040)=[{&(0x7f0000000040)="d510359d61379e920f24a834d0f6aeebb00e6d6cdd1a15b0ddc66189baa7a56d8006d159384e6494db08df0df1d4080a61ca9639af9cf9300dff8ced40bdddbd480ed0cef3fedfd38c8819255bea53585fd3031d9ff29eea60c67689a43724aa0ce58ddfbe3dcf7c3aadd126fb9b6ef0df55c50f41cb4034f1613dbe5bef2c6cca48bcfcea25e235c19982c48987a401c6b04f4151fd41977f865ded6d575b9864146d6bd8caa6ae132a1651089d0e3ad79509f106c026752f6a0c23c3f53f830210a0e951878e1c6bf1d0d71ee765824cc37f40c624992271defb0b67fb13a110ef90a638bd419f6cdacdebde9b3b1ab50f7d1f1c0b0d537978c44c7d775ab49478bf9dc6d33e67d15f49e33b8868441abf7d1a47446e5a444243b3e2887905a967f30c9267b65ea296ef32cf5f0463c9148e4e7a5c430a8a7d4cab52ff8fc4f30cb5931b69e28c0d06dc2432982f7a1f8dd6c37245f9602f6524cb7e44fcf806bd70cede5000dad501d0dc612231951926b0d6c4513e67f63b37f42467688e367fc7672ce0300be8c169d64115c508655c758e3ac577ae87fe830c5245af0f38f7bcb1edd870cb39d5adcd4d431c74e85f236fac9ae5687aef7cad4458f732bb778852a67cf0e793a53bf62ab6ac1f59137a2df52f93257ee488a668beb72bd1ebfdd6ceaad9f086ccc9e65928953a2ee25e8cc06ad2e10a7374d6b281415fcecdc6b8a3b4396e6c40f52a8870a4422616d643fa3aa1cde36e109af8b9425aaf0c12f6a34366a6580a853795e306d74c50d67ddc915004dbf31134b41032f34875fcfc03754f8841a373040167e3e8530fba718d3bd1d8eca0ea65ba4145048a552a38fb11d80984d79af5c12c2fad06732a4de8f400dda0378a8a83068fb19bea80e82429e6196fd64928c82d72ca59cdb8760326103d0a74afa9931fd30e16362b698d19990436a123def6a69d0fe23c145ba38bc2d192b05e510472ee295a763ee1ac7c1620154c157848b248d7888187ca1de6b1e148d16397e557227668160f6552d86454be01a8112d0cc07edb212d4ed410415977e4b9363db5c1f94f9b4d36566619e60c21c47d74c1bb19f5d7bfcd78c92969d87963b820c7f3a753c6ff28cb89570dbfb4452f815d3b8f1d2f4dd81b3d66d8855315ec33a98516c7ddf60f3a1d31bcdea8def0d0f02be802c694190810c9c90106eff17b5b1b786013ad8045cba3a338368426ee22855fc4086f717c696b1c4bc88a7c7e3a32d814fa80bcb49f53a273906959ea886a58c52a38fa4567337096bc819c2758f265d70e61d3e0e6b21e43e798e142c399f39bedf99eae877ac8695b6ca123f29fa3cc530af3aba36698d2628dc073360707500a4c0333eae30d5c4d403adfb1407f564fe8b3ab4ef19aa3b1a7a5adab6088d3dda54a2bca87ec53420dfb56dd1cf97597d21a2744dc7b2f24b2077a5a29a958720bfad13cce93d588ce08d56bf477907e2a654a69b1bd0e146f8e6fcce74dbacdf3f5575eaed6f1475baeee39880c7b1a061b82f52deda44e396f14c8e4b3f92569b67a0dff3b2f537f91711250f9b5c87e38cd427f350af6307761209e418e3757a7bbe799871148d07cdf317d356cd6fe12b5e310c326d0ff206084127e29eb775c4d05a32e9685c41e6a1d7bb3cec2273b7094f075130ac083030b4045749180ee0fb1be9fbf2e4d532287c72448c625f5af8690fea004512ece52a0a617f7a0f3e7ac8006d05ded11c703e7a3f1d1f3702c190452e3a5750868517b994c0ec5ecdabb8cfc0e525b3bc481ba77befe463363c4cebe8d762103a1f4ecff368af375a6ea166e2c8e76b6796884841f9754b776e75de4dfeb0017bb1d427cf81848484bfb4bf98f72ab55e691434f63ca3246cdbcb36cd79a5888baaeb7642da869da2cc44ea5d15d857724d5c2344f465cc01c93f30b5df4d0f3532c2b45d17496f702f7ac57af6eaf513f55c7f1078d60223012f4583b567851da1ac09b65b9af19501cbb95163cbd33cae59bd95c1ffbb17a7ec282d67475950e96057d7963db304c3a5ef17b03fc3cde1f83a1592112c6bab354f6d543543b76a8e78b2db738a15e1aa3dcc72b81cf69002bb5a097b355923b4ff49639b7d899325cadcd2acc38d860899a0f65419d615ab752a8aee2a6d28cdad0e4a7349dfe5e745564b89cf5badd8d3719fa1844f64198b852407d9f180c83e8d1ba4ee9ec8070d58e6c9b87a25af4b9311f26e0c8fb9d99cbe0ccf3963d95eeab36175901461a162d09155d1054a807afe595af65d7a82cfcffc3901f08407dc98364ffd24e7f1ba75a402dfdeb27c9932bfda65e47a3bcc4fbd9e060b3b5ba6c1efc1e1e26a282befb83b881dee9e69f9604668b63273cb66bd5320f7e095fe450abd1fbae9994ffc5d675be79baf1d55506e6a75e8fba46f79ba872cb7068e7ac7b5d5c7d6111d8b0c9cdad533a653fa5c0346df4de53622ccaed846eddc9acc74be1537b7e54a017f4015a3569e57a5b5721f514e52b70f5663ccdc8d59da5cfe845a8a1a02ce3299cf157912b9afe31fa5625c683bc1b89ad4c7c4bdc2d3c6a29e69797e7afb0f234654b99135345bfcb16edd42462a681ddc7a0a6add85fa7288e324395eaa791cda6af223aa4410772dcdabbbed815743c7822de12367dd0e937a351d6deb6ef75697b35776d0b3f3add6856d29fb2fb12b7155ad006b59443b8c4a1c39cd50c4325dcabac442c1874e3b06176064df1415074354bc180f81fbf1442c754e51f4501f75d23dbbd69c7d0a7bde3e9da5c86f208b28418e6a6485913d3a4602fdcef9da01e231fd796fdbab2246e699f38d3fae0a2ac75bcb7f79b4e2e8f430d11451b094004f4056afa15c7ef55da749bc96e801cb73f5aeff166b7fa915e8e4b25b2762bba51a0a10cc7652b42f94ef5f056a5ac8700de536c71ff0c52b074532b0c661f27a458bd3a92e7c24c87476448c6a09b8ea98dfc9764484a82f28c72bab5282a41bc3da14489e9e9963e988a379f328af21e4c75a4713a4e102290b269f756af152c319614e0783c0a281f348f8d76fe1e48275a29275ed92b610b4d83b5110a140126dc740bb4613a8f7da100da62729a587b4471752aca77a30f624f51a51d3cfaa616a88596bc6fc354a8b0640a37dbec5f2169991f27d88a441b8984de2f7c1844e44ca7a0b790685c09bd505055d9903dd3b51ce155a72d6422f154d8c9894b0cc11d82fe766a45aee2445499139fe844b13cf5c4618354a04a1088e73b0e8d9560d699c547b5d75629f4987ee694a2fd1bff6944c63d1ba917c39eaadf12c7a69e88da65dd5fb4dc3f41b07a44e9d46ba49f8e0e6617ec9e3b65a3fb0a800805e41e8c782d75f2e7f2ae877efdc7e68b25e7ed2b89157a68347c8f305e24f14f47ccca37bd0b2cac3efee64233dc52975a7dac7760ebbb1b539adb2789516307f27017fb823bd1e3e815245bbee274a84f6aa74e4a4be2204a47affc9c17dc5fed204b31e8a38d174cdb712fb854baca904e4cd76c9a26b3c9112b9a81a5e72c99ffd1f0f1c68b8657d39fdeae3631ac879c1049645365759f2e9afcfd9a06a8b2b7657e575bf41fa5736589248a09442b8032c4c5cb4f65f3e43bb2bcee5d510b81e3b3a74b5eb1273d193a6b53f533ddbaea6c69a7e4b445c794b7a2056b39fbd6b28eb32fdc547c11a3415655cf7e9d3ad708f4206cc6225a4bf07f38ee3e66ba667d63418b8868a9e5bfb349dbf8f64bd6870a8b033d0da525b3384e688798ed4c186e82636f588b213bb85f0245bcb8ccd6896e7f80d84a64066ad7350fd1ed646ec4e7321f63193b76b533df609f57b8617e74c7449d9e3d4e9c7a2015edd95490e589e36d57ea7a39efbb6351045f5b9a420a343f8144322045e58550df71c788e295ba5a42578829b8c9cc4155c15daa1b53d2d8090ce4a9f3b05d0d2192517183f3d006757a910c9655154a1a28e12ff5fa6b576ef71983c61e3120ecb017ee34891ff71558ee728ea94d7ebaa5a00b8c3290793aab1b49b68497d97f855ba1fcd204ed719517ea9132433fee17b80735e094ff45d1ea6ccaa261909c20384d733acf4f0a77f45e90677d9f7a5c7ec800b8e1d699f09020ce40de3cce8f101d3ce2e12c32a5240c47da4c838601311356892b7b33f735004e7f05a1cd961da9363e4abfc288c5a9ef3f43d9ae5ffbca86b1866d84061545f7bd38c37f2ccfe6d6715cbaf3251c3b16830646fcda05dda65ff218e9e71ad95de10aaa1ece9619a56eb7723d678766fd977ce0ce8be827739db00df51d7f117b1cd1bfb26cbddfe5ed37bbee2e67a38c6759ad78c8e19cbc66141b4e24762d2472b5036a6559c9d38212b733df26d1d880e9c16e398784895a3ce90941f26f1775d5e77d8c9592d117b8e74dd98ac97fe8311e7690cebff56147a41c0b92158497dbf6f653950f622aff3a72ab5b0ff6d4e68c11cee4fe18c29fc233452ab04dedb889215e0f26135e690813b32afc74c474bcf6b8fc7ac4219627f3c65dc612b313475a388fe44332dda88dd6388b551dfea3dba49e12caa3046d1a0d7944e1de7eaa9314dc5e0b1139ee166ac6c88fd2b52f0f55b3da72d9af696018d8558a7e0a9f3349f3735f09ce4ba30a22d2386026c662eaa4208725ef8fbda16df13d33a64dcd32faad0ea6bc1326309434445a7c70166bce3b54ad32d4592c7d041eac7d4686cc59c625a0d36c05c95e66e887c4b962c6009bd407c193fb65006cb65ed0c93235c16a1943b57f41916baa39e4b72ba8db36b1e6a4f0c2f331837d7addf552b1c80152b3c568bd1ead18286b9ae1f51ed8838b0acd816e318b2e212d27f4d33d28bd198838bab51b22b8b8599a6c732ec16a9c59a3d8a4b42efce1800b9df442515af84cc80f08bd0bb1eef956f2025e1240c5c5d731237a7742022eb7ad9ac314f2124c99f20fe40e6c0aab5e7df90612dddd17ede8d3dea78b95096e0e84be1f72efbc5306e10f84252030d60291a1645c49fc8b850142d80b71523d01f45c8094db5ed2e4b118824b5d31810c55adc8fd805e9414411a3b768bf27d1efc9de652a4acb06825fa7667938725f27a218ba9ff2517b8bc531fa2bc47f332e387f9dfa50a8b79fffa83cbfd03323e9e551b5c3507c951aa9dc0a3e7c70aa36a9865bb1c9f1d5fdef05bd510e5d38a6e1b9264beb9c8e1b6e194db3c9b209d4c5b77a1560e1c85b44d575d07a117e9630cc5ac4773c421c4f60e91d02e2f82eaffc4543cb3128b257e3ef87cc9b12a148411114f5a946c2b134f213586d54ce955f421a2efc511a4ced58639d61443be69a8120ad4eb5c26540ebfb9f864e79f581639f03c81f6fb8608a3ff597e2a043dbb993710527bfaa86d4b38d3441d5cca31499f7bda3312d87a64618e51e0dc99fb925f7e623fffbf91c72c3baf2ba06a8a27099298832aabe004055da8ac2e5150c0c47d5b1ac83ed2cbf21292c526c314ff0909f4635bc775f2da1c6eb995cd2c1966caf91a36a168740931aa800cd14fc86bdbc4dd77db31f5e842447bb9d566a10fcad1f1b80b6e60f4bc6219113b75598a5e8c34e68040fbc4c45fda00125b13755dd0af811a4dc3136572e01b99cd2fc58b2844635661b9cab4e55b2bc536763ae0a3d47e5702bc725abf04dbdc8664c515c2518ad92c788ccf68ca6bc1d97f2c707033422ffdf7b461cbe880e727c19a428fa078480dc7195465d71660c2b292941425aa2983e9240bf6726d5697b4e5ff1f5b", 0x1000}], 0x1, &(0x7f0000001080)=[@ip_tos_int={{0x14}}, @ip_ttl={{0x14, 0x0, 0x2, 0x65d99598}}, @ip_ttl={{0x14, 0x0, 0x2, 0x3}}], 0x48}}, {{&(0x7f0000001100)={0x2, 0x4e24, @multicast2}, 0x10, &(0x7f0000001200)=[{&(0x7f0000001140)="a932b347683ff77a6c61d237760d736b2c6b4dc3407d17833c294d63f2fbc91424668b205dfc948ef6a534d3e645171d63161562077739afab33b9ecc5a68b3dff2ed5cfd02700ef05f8b351bce765604018a0270a4dc033f7eb2e7301e81aafdd3a9de4747ea21649870622fc43b7f64261f9f2001d01d7cfaa04e64bc746a3113637f502368fdcd2e124f94880d55850f390805316573f82c5da2d12a145e42d206e41441d8df679331fb46813ad6db425e3632f8d48f525", 0xb9}], 0x1, &(0x7f0000001240)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x2}}, @ip_retopts={{0x64, 0x0, 0x7, {[@generic={0x0, 0x10, "9686daddf548d64fd7dab5fe66a4"}, @end, @cipso={0x86, 0x3f, 0x1, [{0x1, 0x4, 'Kn'}, {0x5, 0x12, "9c7090ade5d58851cc83105453a75cfa"}, {0x2, 0x11, "97c633cce594d773580149ec38a4c0"}, {0x0, 0x12, "8b9e706a26e6fa51d0937ee496989bc6"}]}, @noop]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x7}}, @ip_retopts={{0x40, 0x0, 0x7, {[@cipso={0x86, 0xa, 0x1, [{0x7, 0x4, "86da"}]}, @rr={0x7, 0x1b, 0x55, [@broadcast, @multicast2, @remote, @remote, @empty, @empty]}, @ssrr={0x89, 0xb, 0x40, [@loopback, @local]}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}], 0xf0}}, {{&(0x7f0000001340)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000001480)=[{&(0x7f0000001380)="18b2718b108e1258cb171c0e701279f07c71c7afe3850061defa6d54ae1319e18ac45012255a32901ee749f88d333a21ce045ff66895c7cba3aac2dcf9731b792c72876dc781f6d98d5ef87740cf5ea0690aad66c7c2755afa5ca4c8a9f83fa592dba301150e51efde09799e91a6a5945a72da11e87de32efdd1cbf7249b00b35e4ae5467175efbc1d5609cb81c97ac5b51f8fdde27d0d9ed9716bcee0d3fae539f9af89b9c4fb7fccb9e6989f76549a42c6fe0cc702daccfa712bcb833ef2de2a8c8663defa8ee43787d5762ae99d2c4eb1829ceb881f86bcf74c9dbc9661f3a4b9ffea91b0213cd0de2be4ece84fc5ca86bc7ddc54a9dd030ce604", 0xfc}], 0x1, &(0x7f00000014c0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x101}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xfffff800}}, @ip_ttl={{0x14, 0x0, 0x2, 0x100}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x12}}], 0x78}}], 0x3, 0x10) ioctl$AUTOFS_IOC_SETTIMEOUT(r0, 0x80049367, &(0x7f0000001600)=0x120000) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000001640), 0x280, 0x0) ioctl$RFKILL_IOC_MAX_SIZE(r1, 0x2, &(0x7f0000001680)=0x80000000) sendmsg$nl_generic(r0, &(0x7f0000001780)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001740)={&(0x7f0000001700)={0x20, 0x42, 0x200, 0x70bd28, 0x25dfdbff, {0x1a}, [@nested={0xc, 0x11f, 0x0, 0x1, [@typed={0x8, 0x5a, 0x0, 0x0, @pid=0xffffffffffffffff}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c004}, 0x44010) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000017c0)={[0x8, 0x9, 0x7fffffff, 0x3, 0x4, 0x0, 0x0, 0x2, 0x0, 0x5f, 0x6, 0x8, 0xed, 0x3bf, 0xed0d, 0x8], 0x0, 0x190880}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001880), 0x200902, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000018c0)=0x18) write$rfkill(r1, &(0x7f0000001900)={0x4, 0x1, 0x1}, 0x8) setns(r1, 0x7a000080) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000001940)=0x5, 0x4) fadvise64(r3, 0x8, 0xb, 0x2) r4 = accept4$vsock_stream(r0, &(0x7f0000001980)={0x28, 0x0, 0x1, @host}, 0x10, 0x80000) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(r4, 0x8983, &(0x7f00000019c0)) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000001c00)={&(0x7f0000001a00)={0x10, 0x0, 0x0, 0x82f68e2231c85b57}, 0xc, &(0x7f0000001bc0)={&(0x7f0000001a40)={0x144, 0x23, 0x20, 0x70bd28, 0x25dfdbfc, {0x1}, [@nested={0x12d, 0xfe, 0x0, 0x1, [@typed={0x47, 0x30, 0x0, 0x0, @binary="95c9bd95221dd3ea2c192dbf26294f390e02a4c9ee463bfb8d15935108a542b2bfc68071a7bc33dd6806cbb68835b09f564477d12ec63f1aa9d71d052cd3c8559a8d61"}, @generic="9183543bd19f810e35899709a106e474eb95453a2104d30b44babdcd28f2113a54db2ff66aa4f4f61ca5c0f8dd0445e86e3110194509e3336e19da061076bb3867bff71de976843d4131d8474ef1673a8891f35ee7aa0540368c3639be362b98bb9dc439000539879022a1736dd9b60caa6ed9b64400ed1368d6b02973b6b9d661b96340e04de630e0d578e6e6ba1360594012b72e910cbbbc2004a4c479703d6c0631a37651a97297bb1beb321738baabd58a66747b1a39779fd483dbca7ae11c4fab0acd3fecc41b3907425be8130486ee3af139c3986f2b67aef41b5b837165"]}]}, 0x144}, 0x1, 0x0, 0x0, 0x40}, 0x50) r5 = signalfd(r3, &(0x7f0000001c40)={[0x8]}, 0x8) read$rfkill(r5, &(0x7f0000001c80), 0x8) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r5, 0x8983, &(0x7f0000001cc0)={0x8, 'xfrm0\x00', {'ip6tnl0\x00'}, 0x9}) r6 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000001d80)={0x0, &(0x7f0000001d00)=[@uexit={0x0, 0x18, 0x64}, @wr_crn={0x46, 0x20, {0x4, 0x5}}, @cpuid={0x14, 0x18, {0x0, 0x7}}, @wrmsr={0x1e, 0x20, {0x490, 0x55d3f15f}}], 0x70}) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r6, 0x4068aea3, &(0x7f0000001e00)={0xa3, 0x0, &(0x7f0000001dc0)}) getrandom(&(0x7f0000001e80)=""/152, 0x98, 0x2) ioctl$TIOCCBRK(r3, 0x5428) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f80), r0) sendmsg$NL80211_CMD_SET_PMK(r5, &(0x7f0000002080)={&(0x7f0000001f40)={0x10, 0x0, 0x0, 0xb55bb8950b3dddf9}, 0xc, &(0x7f0000002040)={&(0x7f0000001fc0)={0x5c, r7, 0x800, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "44dff25d80d26e3c80a828179e72dfc8"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "9dfaa982e3783791e4573b3f210c2481"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "9144e30ed57d6761401856dbded1bf8b"}]}, 0x5c}, 0x1, 0x0, 0x0, 0x2000001}, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000002100), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_GET(r5, &(0x7f00000022c0)={&(0x7f00000020c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000002280)={&(0x7f0000002140)={0x124, r8, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x40, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3840}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3}]}, @TIPC_NLA_LINK={0x6c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x583}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9c4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_BEARER={0x4c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa5f9}]}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x800}, 0x4000001) 42.431273311s ago: executing program 40 (id=5133): r0 = socket(0x1d, 0xa, 0x2) sendmmsg$inet(r0, &(0x7f0000001540)=[{{&(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10, &(0x7f0000001040)=[{&(0x7f0000000040)="d510359d61379e920f24a834d0f6aeebb00e6d6cdd1a15b0ddc66189baa7a56d8006d159384e6494db08df0df1d4080a61ca9639af9cf9300dff8ced40bdddbd480ed0cef3fedfd38c8819255bea53585fd3031d9ff29eea60c67689a43724aa0ce58ddfbe3dcf7c3aadd126fb9b6ef0df55c50f41cb4034f1613dbe5bef2c6cca48bcfcea25e235c19982c48987a401c6b04f4151fd41977f865ded6d575b9864146d6bd8caa6ae132a1651089d0e3ad79509f106c026752f6a0c23c3f53f830210a0e951878e1c6bf1d0d71ee765824cc37f40c624992271defb0b67fb13a110ef90a638bd419f6cdacdebde9b3b1ab50f7d1f1c0b0d537978c44c7d775ab49478bf9dc6d33e67d15f49e33b8868441abf7d1a47446e5a444243b3e2887905a967f30c9267b65ea296ef32cf5f0463c9148e4e7a5c430a8a7d4cab52ff8fc4f30cb5931b69e28c0d06dc2432982f7a1f8dd6c37245f9602f6524cb7e44fcf806bd70cede5000dad501d0dc612231951926b0d6c4513e67f63b37f42467688e367fc7672ce0300be8c169d64115c508655c758e3ac577ae87fe830c5245af0f38f7bcb1edd870cb39d5adcd4d431c74e85f236fac9ae5687aef7cad4458f732bb778852a67cf0e793a53bf62ab6ac1f59137a2df52f93257ee488a668beb72bd1ebfdd6ceaad9f086ccc9e65928953a2ee25e8cc06ad2e10a7374d6b281415fcecdc6b8a3b4396e6c40f52a8870a4422616d643fa3aa1cde36e109af8b9425aaf0c12f6a34366a6580a853795e306d74c50d67ddc915004dbf31134b41032f34875fcfc03754f8841a373040167e3e8530fba718d3bd1d8eca0ea65ba4145048a552a38fb11d80984d79af5c12c2fad06732a4de8f400dda0378a8a83068fb19bea80e82429e6196fd64928c82d72ca59cdb8760326103d0a74afa9931fd30e16362b698d19990436a123def6a69d0fe23c145ba38bc2d192b05e510472ee295a763ee1ac7c1620154c157848b248d7888187ca1de6b1e148d16397e557227668160f6552d86454be01a8112d0cc07edb212d4ed410415977e4b9363db5c1f94f9b4d36566619e60c21c47d74c1bb19f5d7bfcd78c92969d87963b820c7f3a753c6ff28cb89570dbfb4452f815d3b8f1d2f4dd81b3d66d8855315ec33a98516c7ddf60f3a1d31bcdea8def0d0f02be802c694190810c9c90106eff17b5b1b786013ad8045cba3a338368426ee22855fc4086f717c696b1c4bc88a7c7e3a32d814fa80bcb49f53a273906959ea886a58c52a38fa4567337096bc819c2758f265d70e61d3e0e6b21e43e798e142c399f39bedf99eae877ac8695b6ca123f29fa3cc530af3aba36698d2628dc073360707500a4c0333eae30d5c4d403adfb1407f564fe8b3ab4ef19aa3b1a7a5adab6088d3dda54a2bca87ec53420dfb56dd1cf97597d21a2744dc7b2f24b2077a5a29a958720bfad13cce93d588ce08d56bf477907e2a654a69b1bd0e146f8e6fcce74dbacdf3f5575eaed6f1475baeee39880c7b1a061b82f52deda44e396f14c8e4b3f92569b67a0dff3b2f537f91711250f9b5c87e38cd427f350af6307761209e418e3757a7bbe799871148d07cdf317d356cd6fe12b5e310c326d0ff206084127e29eb775c4d05a32e9685c41e6a1d7bb3cec2273b7094f075130ac083030b4045749180ee0fb1be9fbf2e4d532287c72448c625f5af8690fea004512ece52a0a617f7a0f3e7ac8006d05ded11c703e7a3f1d1f3702c190452e3a5750868517b994c0ec5ecdabb8cfc0e525b3bc481ba77befe463363c4cebe8d762103a1f4ecff368af375a6ea166e2c8e76b6796884841f9754b776e75de4dfeb0017bb1d427cf81848484bfb4bf98f72ab55e691434f63ca3246cdbcb36cd79a5888baaeb7642da869da2cc44ea5d15d857724d5c2344f465cc01c93f30b5df4d0f3532c2b45d17496f702f7ac57af6eaf513f55c7f1078d60223012f4583b567851da1ac09b65b9af19501cbb95163cbd33cae59bd95c1ffbb17a7ec282d67475950e96057d7963db304c3a5ef17b03fc3cde1f83a1592112c6bab354f6d543543b76a8e78b2db738a15e1aa3dcc72b81cf69002bb5a097b355923b4ff49639b7d899325cadcd2acc38d860899a0f65419d615ab752a8aee2a6d28cdad0e4a7349dfe5e745564b89cf5badd8d3719fa1844f64198b852407d9f180c83e8d1ba4ee9ec8070d58e6c9b87a25af4b9311f26e0c8fb9d99cbe0ccf3963d95eeab36175901461a162d09155d1054a807afe595af65d7a82cfcffc3901f08407dc98364ffd24e7f1ba75a402dfdeb27c9932bfda65e47a3bcc4fbd9e060b3b5ba6c1efc1e1e26a282befb83b881dee9e69f9604668b63273cb66bd5320f7e095fe450abd1fbae9994ffc5d675be79baf1d55506e6a75e8fba46f79ba872cb7068e7ac7b5d5c7d6111d8b0c9cdad533a653fa5c0346df4de53622ccaed846eddc9acc74be1537b7e54a017f4015a3569e57a5b5721f514e52b70f5663ccdc8d59da5cfe845a8a1a02ce3299cf157912b9afe31fa5625c683bc1b89ad4c7c4bdc2d3c6a29e69797e7afb0f234654b99135345bfcb16edd42462a681ddc7a0a6add85fa7288e324395eaa791cda6af223aa4410772dcdabbbed815743c7822de12367dd0e937a351d6deb6ef75697b35776d0b3f3add6856d29fb2fb12b7155ad006b59443b8c4a1c39cd50c4325dcabac442c1874e3b06176064df1415074354bc180f81fbf1442c754e51f4501f75d23dbbd69c7d0a7bde3e9da5c86f208b28418e6a6485913d3a4602fdcef9da01e231fd796fdbab2246e699f38d3fae0a2ac75bcb7f79b4e2e8f430d11451b094004f4056afa15c7ef55da749bc96e801cb73f5aeff166b7fa915e8e4b25b2762bba51a0a10cc7652b42f94ef5f056a5ac8700de536c71ff0c52b074532b0c661f27a458bd3a92e7c24c87476448c6a09b8ea98dfc9764484a82f28c72bab5282a41bc3da14489e9e9963e988a379f328af21e4c75a4713a4e102290b269f756af152c319614e0783c0a281f348f8d76fe1e48275a29275ed92b610b4d83b5110a140126dc740bb4613a8f7da100da62729a587b4471752aca77a30f624f51a51d3cfaa616a88596bc6fc354a8b0640a37dbec5f2169991f27d88a441b8984de2f7c1844e44ca7a0b790685c09bd505055d9903dd3b51ce155a72d6422f154d8c9894b0cc11d82fe766a45aee2445499139fe844b13cf5c4618354a04a1088e73b0e8d9560d699c547b5d75629f4987ee694a2fd1bff6944c63d1ba917c39eaadf12c7a69e88da65dd5fb4dc3f41b07a44e9d46ba49f8e0e6617ec9e3b65a3fb0a800805e41e8c782d75f2e7f2ae877efdc7e68b25e7ed2b89157a68347c8f305e24f14f47ccca37bd0b2cac3efee64233dc52975a7dac7760ebbb1b539adb2789516307f27017fb823bd1e3e815245bbee274a84f6aa74e4a4be2204a47affc9c17dc5fed204b31e8a38d174cdb712fb854baca904e4cd76c9a26b3c9112b9a81a5e72c99ffd1f0f1c68b8657d39fdeae3631ac879c1049645365759f2e9afcfd9a06a8b2b7657e575bf41fa5736589248a09442b8032c4c5cb4f65f3e43bb2bcee5d510b81e3b3a74b5eb1273d193a6b53f533ddbaea6c69a7e4b445c794b7a2056b39fbd6b28eb32fdc547c11a3415655cf7e9d3ad708f4206cc6225a4bf07f38ee3e66ba667d63418b8868a9e5bfb349dbf8f64bd6870a8b033d0da525b3384e688798ed4c186e82636f588b213bb85f0245bcb8ccd6896e7f80d84a64066ad7350fd1ed646ec4e7321f63193b76b533df609f57b8617e74c7449d9e3d4e9c7a2015edd95490e589e36d57ea7a39efbb6351045f5b9a420a343f8144322045e58550df71c788e295ba5a42578829b8c9cc4155c15daa1b53d2d8090ce4a9f3b05d0d2192517183f3d006757a910c9655154a1a28e12ff5fa6b576ef71983c61e3120ecb017ee34891ff71558ee728ea94d7ebaa5a00b8c3290793aab1b49b68497d97f855ba1fcd204ed719517ea9132433fee17b80735e094ff45d1ea6ccaa261909c20384d733acf4f0a77f45e90677d9f7a5c7ec800b8e1d699f09020ce40de3cce8f101d3ce2e12c32a5240c47da4c838601311356892b7b33f735004e7f05a1cd961da9363e4abfc288c5a9ef3f43d9ae5ffbca86b1866d84061545f7bd38c37f2ccfe6d6715cbaf3251c3b16830646fcda05dda65ff218e9e71ad95de10aaa1ece9619a56eb7723d678766fd977ce0ce8be827739db00df51d7f117b1cd1bfb26cbddfe5ed37bbee2e67a38c6759ad78c8e19cbc66141b4e24762d2472b5036a6559c9d38212b733df26d1d880e9c16e398784895a3ce90941f26f1775d5e77d8c9592d117b8e74dd98ac97fe8311e7690cebff56147a41c0b92158497dbf6f653950f622aff3a72ab5b0ff6d4e68c11cee4fe18c29fc233452ab04dedb889215e0f26135e690813b32afc74c474bcf6b8fc7ac4219627f3c65dc612b313475a388fe44332dda88dd6388b551dfea3dba49e12caa3046d1a0d7944e1de7eaa9314dc5e0b1139ee166ac6c88fd2b52f0f55b3da72d9af696018d8558a7e0a9f3349f3735f09ce4ba30a22d2386026c662eaa4208725ef8fbda16df13d33a64dcd32faad0ea6bc1326309434445a7c70166bce3b54ad32d4592c7d041eac7d4686cc59c625a0d36c05c95e66e887c4b962c6009bd407c193fb65006cb65ed0c93235c16a1943b57f41916baa39e4b72ba8db36b1e6a4f0c2f331837d7addf552b1c80152b3c568bd1ead18286b9ae1f51ed8838b0acd816e318b2e212d27f4d33d28bd198838bab51b22b8b8599a6c732ec16a9c59a3d8a4b42efce1800b9df442515af84cc80f08bd0bb1eef956f2025e1240c5c5d731237a7742022eb7ad9ac314f2124c99f20fe40e6c0aab5e7df90612dddd17ede8d3dea78b95096e0e84be1f72efbc5306e10f84252030d60291a1645c49fc8b850142d80b71523d01f45c8094db5ed2e4b118824b5d31810c55adc8fd805e9414411a3b768bf27d1efc9de652a4acb06825fa7667938725f27a218ba9ff2517b8bc531fa2bc47f332e387f9dfa50a8b79fffa83cbfd03323e9e551b5c3507c951aa9dc0a3e7c70aa36a9865bb1c9f1d5fdef05bd510e5d38a6e1b9264beb9c8e1b6e194db3c9b209d4c5b77a1560e1c85b44d575d07a117e9630cc5ac4773c421c4f60e91d02e2f82eaffc4543cb3128b257e3ef87cc9b12a148411114f5a946c2b134f213586d54ce955f421a2efc511a4ced58639d61443be69a8120ad4eb5c26540ebfb9f864e79f581639f03c81f6fb8608a3ff597e2a043dbb993710527bfaa86d4b38d3441d5cca31499f7bda3312d87a64618e51e0dc99fb925f7e623fffbf91c72c3baf2ba06a8a27099298832aabe004055da8ac2e5150c0c47d5b1ac83ed2cbf21292c526c314ff0909f4635bc775f2da1c6eb995cd2c1966caf91a36a168740931aa800cd14fc86bdbc4dd77db31f5e842447bb9d566a10fcad1f1b80b6e60f4bc6219113b75598a5e8c34e68040fbc4c45fda00125b13755dd0af811a4dc3136572e01b99cd2fc58b2844635661b9cab4e55b2bc536763ae0a3d47e5702bc725abf04dbdc8664c515c2518ad92c788ccf68ca6bc1d97f2c707033422ffdf7b461cbe880e727c19a428fa078480dc7195465d71660c2b292941425aa2983e9240bf6726d5697b4e5ff1f5b", 0x1000}], 0x1, &(0x7f0000001080)=[@ip_tos_int={{0x14}}, @ip_ttl={{0x14, 0x0, 0x2, 0x65d99598}}, @ip_ttl={{0x14, 0x0, 0x2, 0x3}}], 0x48}}, {{&(0x7f0000001100)={0x2, 0x4e24, @multicast2}, 0x10, &(0x7f0000001200)=[{&(0x7f0000001140)="a932b347683ff77a6c61d237760d736b2c6b4dc3407d17833c294d63f2fbc91424668b205dfc948ef6a534d3e645171d63161562077739afab33b9ecc5a68b3dff2ed5cfd02700ef05f8b351bce765604018a0270a4dc033f7eb2e7301e81aafdd3a9de4747ea21649870622fc43b7f64261f9f2001d01d7cfaa04e64bc746a3113637f502368fdcd2e124f94880d55850f390805316573f82c5da2d12a145e42d206e41441d8df679331fb46813ad6db425e3632f8d48f525", 0xb9}], 0x1, &(0x7f0000001240)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x2}}, @ip_retopts={{0x64, 0x0, 0x7, {[@generic={0x0, 0x10, "9686daddf548d64fd7dab5fe66a4"}, @end, @cipso={0x86, 0x3f, 0x1, [{0x1, 0x4, 'Kn'}, {0x5, 0x12, "9c7090ade5d58851cc83105453a75cfa"}, {0x2, 0x11, "97c633cce594d773580149ec38a4c0"}, {0x0, 0x12, "8b9e706a26e6fa51d0937ee496989bc6"}]}, @noop]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x7}}, @ip_retopts={{0x40, 0x0, 0x7, {[@cipso={0x86, 0xa, 0x1, [{0x7, 0x4, "86da"}]}, @rr={0x7, 0x1b, 0x55, [@broadcast, @multicast2, @remote, @remote, @empty, @empty]}, @ssrr={0x89, 0xb, 0x40, [@loopback, @local]}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x2}}], 0xf0}}, {{&(0x7f0000001340)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000001480)=[{&(0x7f0000001380)="18b2718b108e1258cb171c0e701279f07c71c7afe3850061defa6d54ae1319e18ac45012255a32901ee749f88d333a21ce045ff66895c7cba3aac2dcf9731b792c72876dc781f6d98d5ef87740cf5ea0690aad66c7c2755afa5ca4c8a9f83fa592dba301150e51efde09799e91a6a5945a72da11e87de32efdd1cbf7249b00b35e4ae5467175efbc1d5609cb81c97ac5b51f8fdde27d0d9ed9716bcee0d3fae539f9af89b9c4fb7fccb9e6989f76549a42c6fe0cc702daccfa712bcb833ef2de2a8c8663defa8ee43787d5762ae99d2c4eb1829ceb881f86bcf74c9dbc9661f3a4b9ffea91b0213cd0de2be4ece84fc5ca86bc7ddc54a9dd030ce604", 0xfc}], 0x1, &(0x7f00000014c0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x101}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xfffff800}}, @ip_ttl={{0x14, 0x0, 0x2, 0x100}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x12}}], 0x78}}], 0x3, 0x10) ioctl$AUTOFS_IOC_SETTIMEOUT(r0, 0x80049367, &(0x7f0000001600)=0x120000) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000001640), 0x280, 0x0) ioctl$RFKILL_IOC_MAX_SIZE(r1, 0x2, &(0x7f0000001680)=0x80000000) sendmsg$nl_generic(r0, &(0x7f0000001780)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001740)={&(0x7f0000001700)={0x20, 0x42, 0x200, 0x70bd28, 0x25dfdbff, {0x1a}, [@nested={0xc, 0x11f, 0x0, 0x1, [@typed={0x8, 0x5a, 0x0, 0x0, @pid=0xffffffffffffffff}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c004}, 0x44010) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000017c0)={[0x8, 0x9, 0x7fffffff, 0x3, 0x4, 0x0, 0x0, 0x2, 0x0, 0x5f, 0x6, 0x8, 0xed, 0x3bf, 0xed0d, 0x8], 0x0, 0x190880}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001880), 0x200902, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000018c0)=0x18) write$rfkill(r1, &(0x7f0000001900)={0x4, 0x1, 0x1}, 0x8) setns(r1, 0x7a000080) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000001940)=0x5, 0x4) fadvise64(r3, 0x8, 0xb, 0x2) r4 = accept4$vsock_stream(r0, &(0x7f0000001980)={0x28, 0x0, 0x1, @host}, 0x10, 0x80000) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(r4, 0x8983, &(0x7f00000019c0)) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000001c00)={&(0x7f0000001a00)={0x10, 0x0, 0x0, 0x82f68e2231c85b57}, 0xc, &(0x7f0000001bc0)={&(0x7f0000001a40)={0x144, 0x23, 0x20, 0x70bd28, 0x25dfdbfc, {0x1}, [@nested={0x12d, 0xfe, 0x0, 0x1, [@typed={0x47, 0x30, 0x0, 0x0, @binary="95c9bd95221dd3ea2c192dbf26294f390e02a4c9ee463bfb8d15935108a542b2bfc68071a7bc33dd6806cbb68835b09f564477d12ec63f1aa9d71d052cd3c8559a8d61"}, @generic="9183543bd19f810e35899709a106e474eb95453a2104d30b44babdcd28f2113a54db2ff66aa4f4f61ca5c0f8dd0445e86e3110194509e3336e19da061076bb3867bff71de976843d4131d8474ef1673a8891f35ee7aa0540368c3639be362b98bb9dc439000539879022a1736dd9b60caa6ed9b64400ed1368d6b02973b6b9d661b96340e04de630e0d578e6e6ba1360594012b72e910cbbbc2004a4c479703d6c0631a37651a97297bb1beb321738baabd58a66747b1a39779fd483dbca7ae11c4fab0acd3fecc41b3907425be8130486ee3af139c3986f2b67aef41b5b837165"]}]}, 0x144}, 0x1, 0x0, 0x0, 0x40}, 0x50) r5 = signalfd(r3, &(0x7f0000001c40)={[0x8]}, 0x8) read$rfkill(r5, &(0x7f0000001c80), 0x8) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r5, 0x8983, &(0x7f0000001cc0)={0x8, 'xfrm0\x00', {'ip6tnl0\x00'}, 0x9}) r6 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000001d80)={0x0, &(0x7f0000001d00)=[@uexit={0x0, 0x18, 0x64}, @wr_crn={0x46, 0x20, {0x4, 0x5}}, @cpuid={0x14, 0x18, {0x0, 0x7}}, @wrmsr={0x1e, 0x20, {0x490, 0x55d3f15f}}], 0x70}) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r6, 0x4068aea3, &(0x7f0000001e00)={0xa3, 0x0, &(0x7f0000001dc0)}) getrandom(&(0x7f0000001e80)=""/152, 0x98, 0x2) ioctl$TIOCCBRK(r3, 0x5428) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f80), r0) sendmsg$NL80211_CMD_SET_PMK(r5, &(0x7f0000002080)={&(0x7f0000001f40)={0x10, 0x0, 0x0, 0xb55bb8950b3dddf9}, 0xc, &(0x7f0000002040)={&(0x7f0000001fc0)={0x5c, r7, 0x800, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "44dff25d80d26e3c80a828179e72dfc8"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "9dfaa982e3783791e4573b3f210c2481"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "9144e30ed57d6761401856dbded1bf8b"}]}, 0x5c}, 0x1, 0x0, 0x0, 0x2000001}, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000002100), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_GET(r5, &(0x7f00000022c0)={&(0x7f00000020c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000002280)={&(0x7f0000002140)={0x124, r8, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x40, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3840}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3}]}, @TIPC_NLA_LINK={0x6c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x583}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9c4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_BEARER={0x4c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa5f9}]}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x800}, 0x4000001) 11.792418592s ago: executing program 2 (id=5448): r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0), 0x121000, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x3d, 0x0, &(0x7f00000000c0)) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x6000, 0x0) r2 = open(&(0x7f00000003c0)='./file2\x00', 0x81, 0x0) ioctl$BTRFS_IOC_DEFRAG(r2, 0x1274, 0x3) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, 0x8, 0x6, 0x801, 0x0, 0x0, {0x1, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44000}, 0x4000040) prlimit64(0x0, 0xe, 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$uinput_user_dev(r4, &(0x7f0000000240)={'syz0\x00', {0x508, 0x7, 0x87, 0x1}, 0x47, [0x5f11bec3, 0x3, 0x5, 0x40, 0x0, 0x3, 0x0, 0x7d, 0x80013, 0x5, 0x0, 0x6, 0x0, 0x0, 0x4000000, 0x2, 0x1a4, 0xfffff605, 0x3, 0x0, 0x4, 0x7ff, 0xe2b, 0x7, 0x681c1eb5, 0x11e, 0x0, 0x2, 0x0, 0xe9, 0x0, 0xffff, 0xfffffffd, 0x4, 0x1, 0x3, 0x0, 0x1, 0x5de82a4e, 0x0, 0x0, 0x9, 0x4, 0xfffffffe, 0x1, 0x0, 0x8000, 0x7, 0x0, 0xe0, 0x3fd, 0x5, 0xfffffff7, 0x0, 0xf685, 0x0, 0x1ab9, 0x6, 0x2, 0x0, 0x9, 0x1c15d73a, 0x2], [0x0, 0x0, 0x0, 0x5, 0x4, 0x1, 0x8, 0x5, 0x3, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x5, 0x0, 0x61c5fb46, 0x10000, 0x0, 0x35, 0x10001, 0x75, 0x0, 0x4, 0x0, 0xd, 0x80000000, 0x0, 0xfffff303, 0x9, 0x0, 0x9, 0x2, 0xff, 0x2, 0xa, 0x3, 0x0, 0x7, 0xfffffffb, 0xffffff00, 0x0, 0x10, 0x0, 0x0, 0x0, 0x1, 0xffff, 0x9, 0x441238c7, 0x0, 0x3, 0x0, 0xfffffff9, 0x2, 0x7fffffff, 0x6, 0x9], [0x20, 0xc50, 0x3, 0x9f5, 0x0, 0xa02, 0x1c75, 0xf51, 0xdb, 0x40, 0x0, 0x21, 0x24000, 0x0, 0x6, 0x0, 0x0, 0x0, 0x205, 0x5, 0xfffffffd, 0xc, 0x200000, 0x200, 0xcc0, 0x3fd, 0x6, 0x6, 0x0, 0x0, 0xffffff7f, 0x80, 0x921, 0x2f, 0x0, 0x0, 0xfffffffd, 0x0, 0x15960318, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x5, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0xfffffffe, 0x4, 0x0, 0x6574, 0x7, 0x0, 0xcd55, 0xfb], [0x0, 0x6, 0x0, 0x2, 0x1, 0xffffffff, 0x5, 0x200, 0x0, 0xd63, 0x6, 0x0, 0x0, 0x0, 0xfffffffa, 0xfa3, 0x3ff, 0x8, 0x2, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x194e, 0x0, 0xe793, 0x4ad, 0x8, 0x0, 0x80000001, 0x3, 0x0, 0x400, 0x101, 0x0, 0x1, 0x0, 0x40, 0x8000010, 0x0, 0x5, 0x0, 0x0, 0x7fff, 0x6, 0x10800, 0x5, 0xd, 0x0, 0x40000000, 0x0, 0x4, 0x6, 0x4, 0x0, 0xfff, 0xb2, 0xa, 0xb]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x12, r4, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f0000000080), &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000140)="ded5fc", 0x3, r5) r6 = syz_open_procfs(0x0, &(0x7f0000000300)='net/anycast6\x00') read$FUSE(r6, &(0x7f0000000640)={0x2020}, 0x2020) keyctl$read(0xb, r5, &(0x7f00000000c0)=""/40, 0x1001) syz_usb_connect(0x0, 0x24, &(0x7f0000000180)={{0x12, 0x1, 0xd0, 0x61, 0x52, 0x64, 0x10, 0x403, 0x6010, 0xffab, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x6, 0x54, 0x40, 0xc3, [{{0x9, 0x4, 0x3f, 0x8, 0x0, 0x84, 0x72, 0x59, 0x7}}]}}]}}, 0x0) keyctl$KEYCTL_MOVE(0x1e, r5, r5, r5, 0x1) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder1\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000000)={0x73622a85, 0x1381, 0x3}) 8.719722952s ago: executing program 2 (id=5477): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x109001) (async) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x109001) ioctl$SNDRV_TIMER_IOCTL_CREATE(r1, 0xc02054a5, &(0x7f0000000040)={0x5, r0, 'id0\x00'}) syz_usb_connect(0x0, 0x24, &(0x7f0000000580)={{0x12, 0x1, 0x250, 0xf1, 0xa, 0x80, 0x8, 0x45a, 0x5210, 0x101, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x6, 0xbd, 0x20, 0xf, [{{0x9, 0x4, 0xf8, 0x8, 0x0, 0x7a, 0xf5, 0x4c, 0x5}}]}}]}}, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0}) 7.385191097s ago: executing program 2 (id=5483): r0 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0xffffffffffffffff) fcntl$setsig(r1, 0xa, 0x12) ppoll(&(0x7f0000000100)=[{r2}], 0x1, 0x0, 0x0, 0x0) dup2(r1, r2) fcntl$setown(r2, 0x8, r0) tkill(r0, 0x13) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) 7.25709287s ago: executing program 2 (id=5484): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000500)=@x86={0xfb, 0x5, 0x25, 0x0, 0xd99e, 0x7, 0xff, 0xa, 0x0, 0x6, 0x9, 0x81, 0x0, 0x65, 0xa, 0x80, 0x2, 0x7, 0x8, '\x00', 0x40}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f00000022c0)={{0x0, 0x0, 0x80, {0x100000, 0xffff1000, 0x1}}, "151315256c5e796d0db90b027d0e17e629c3fb95d808b11fc48062052ad26e5b1f577d3a78c7cd99f28fefdb63d448004221356b8ad9b525936a7feae81f433c7329904fe2115dc5861e4caa9ca6787ddfdf613d4ce0b12f029bbbf6e748a5feb6377c83280fb91f93fe51d11bb02c06a7b108751d0f69bc69cf2e2e1b91cab6db0e6288ac7c1eb4b4b0098ff8ec94d1dce204fe156dd543cd2a4f25861eb92f0cfbc1af595a97c807c1b18db5daadbe5e271846e1ae508c35891be6fa930225d6354f50a84af4502b68c1dd119ebe4cf3cf664c3e17b21fc1bc183334b6bc09123a18963ee7fa8c047acfbb5af1a110b604697e00db233dee336697dee581e9da1f5e1d23359c100e38c6b751dd9903dcdf77060a1e8c4696a7b312f75339abe5b09439d0ea55afe25b001222012450d731ef3b6a8850f178fbf88370fc1da58aa2b9f16a248966c40a42282698aa0ef4bdac81dc808ea0690042ef64a119d6e54051b43110442a24351abb2d6e4ad582b39f6215264a3a05c8e55ba6397a75ffb605c89922feea31ea8f2ccc6130231144806ee7dcac5f0dfb77ca588c0623d100de6ac866d86d50c2c6f5e9df231bdd3cb0f3297e351913bbe75d2c0a8b7bac80226823f1d37318b7bf4328915d66bb858ba37aaa8c24330e660282acac9b539dfe65f8a57e92840eaa767b0628117071ec38d515a09851da0adf6c648222621d406a969785af490e3244a61cdd2a572b3619a95066a5e4096c9bea6e3c57fb77794c9942c4d43d612358201cded6eedace65ac307c60f9555a3f66f08679d7ff6ec72edc74948e64fe9f5c1e20518475e55eee323e2b7533a4573b3cbe176d6d2aba3ae7820cae81e76cb25f37f2df965f153494156ffc92913913aba8c29d504c91f10502ad0f4ec8287ddba5054eb5dc9933180ce60974260355cce8c4996e09068d34874806857956a9bac95304822fe005845dc0b6f5c17c2c66634c2a975c44f27b5051ca40c18e0e347fa88a163d8b385220ef04e26e9a528b1a09e3da39405483398410c8df42e486abc20829e0cc8f48ca04b03e3eb7723cb5816c073af3fa87a25573ff99680784aa64d0b3a976f3b27d7f424c34097a997a8784a77cdf649da1920ea6e67d3aa8bb2f2662c3b7634c6185905594570fdc26f11007710c4da7bc80dbc811b430407d6ea2511962c8f4fbdc85dd08fa70e39209948b434d643ceaf534d5409af7e47335d8c72e18b36293dfc0ec0a1ca274cf30008943f7cbfca4b33a37fc80f48d8cb71a41f77aa907d139259a812fa808a646bdbc7fd1f14b9d4d9b00dadc8246f0e5861cd4f0494874ddf8c391ae93553661f14aae81f6d0b1efea773be500caf9726a3cb65519af9c68c888a97f5e90dfd7ae363d51da940fa93434122b4e6349211c00e34680879238ceeaaa7cc2e793a93368b61bc776332796965892be1cfb647230a1b6105a5cc572920057e4f31bcd68c7259637018f5d9ad700360c104bf789f0c2d4a074a8692ae6430ecd24c7bb5de1dee5933bcc105e38ae9762fd3f4722ed3f0e5be5a87d18b32a625abfab140628006371fa38a2f963076026a7fc3b59fb302757d0d7d564712c3b1170300d779c9b6b79d6bbb4fc9fc2f9f771d97c607cea3c4d253c0aa3c1b1d37f6254ba938ed685dea7a72d5845eb05a58d679579fce8f40495a3d98a5918484aad006acd0828837131b5273d2fb57145f36b6bf506b9ab14870ac59a9239d8364c5bea786deac5a3e2d819446d8ef7343b2912f0ba1d47c6019764751cf8ac9a576ad655a349e9cbf9de3bf3983eaefff2c7982d90296c1188f3608df9e3822a1b60ede0c2816bf6d2e96bfaf23a8b6e217f541f88b72a79a59ce2e8b4e1e41046509f7bc275d29d80b68cefd6a94c38aef1570327e58f24d2f23e4d14b95a9f9df039cfc443b20ef54eaf02c317fa1603359ec683a843afa603b23b73eb8c08a38661d9fb8d3ecd3e4e117d1fa0539ed428945ad8212bc10e2ecb902390d300687d26231dfdc5055fda6d12a4ff2f14fcd0f70cadf09f79da842c0b60405be83796fb20bc4a4c30ef8bd7aecaf30f2dbee2d8f2fb21dce605107513484b58e515236cf539fe85a8b93a44fc97122d66c204762c6fe793cc751cfdb3c59d3600db81e7cf6f8c0e93634e336550f97bf28a3df0f22a94923140d7d6fe8447d1033554b9e3db121f3dc377ddd7c9dfe34d238dcb2a96189b1b923ab1f4a371991b4df92d8b5dda91be884ed016fbe02f4759676ca05e08f65a2fb985779a526c33cb5724c0b942ad0658f989d5a5a778779a016269717b540d6bbbc141021bfced32d09d66ec1adf443f039e8a3caaf79d539b10519bcf2eb376a778f8c12e6e786590857539beb5678e1f8d037fbaf3d040b09f14622c59abaddcf2203c0759efbf11d6200d10619ab27c7e9012c16702e573f0f750e4a11c08c5ef48da0605805dcc5a748d679ab3a1b90c15d54243c9bf9184e8df754caae4c4de06ad6b9290ba7d980403f5c63a73a374439eca42c46770fbe4b76390a436ada08c7e984328f2b50af91bae05c4e7671406b4f58cc46fa14abf9d8726a64788127011a2152fa90e0538145bbc7ef3ab7e1f829ba6d44460e9e8a8a4a09255edc4ed0fa87b86b230bd10e947d4f0386aac1eb648515ffb6484b4e9265435f9b88782b828d193d888e125ebdc7126f6d6b5b37c8d891e6d86f0261d169384e021ec536b20ba3eedf316d2c76e6dae6903964ea10d661c69bd94ad5bc8e28759cd6ca1bdda5a90c0797f6458153a4ff95cdeb638371d5d245ed75ac850c0089e65b7f27b9fc90a89464deb858fb2df6a1a420ee92da4daa8f2263296b929a9e26c4a30a5a843ab47e6b4a2e6a57bab8451d68205dd7f8f61b28a45f5a36fa0bfa0aed583f9b37a5b6391b72e0394802f0deaa4808dc5010bcaa8061af7940bd45c7b5d510cdaa1e8db9683be222fe0e18c84a9833f08d8341f3a7520a828319af05f43bdb99b82562b2f5874b73704e1885215e68a9a06c3a323e8a47c791465884c87b3b44760c7086317add79050619b75f420a3b2783d86f80461a8ca592516a8d6179a114d00aed51cd3b138e8349a6814a55a9374dbbec89c67ef7b31a10e4031738d7d4ef008cf3a81e2a212483551f59223e2f0dfad23a50aba9ee1d135254f2ec2c5c475a895000b3deff49c733c1da59998e9bbb3422886e312033d57a50a6a2e675ff14b20b7c86f70caea9878835ce7fb17ce405028887772138a5fcc3fa037d29756573d22183d30c196eafc98ed4c5ae29ccf209c451f55c5aa850d23cd653f356eb5ab35c5e171519f94d69a326dc476f90bcd13a4c093321415d0c355cc233e6be7e29cd40f33fd0dff7e03f35110e7bc055b6d41bb15d1ae29b28cbcce9c3f96aa40617cdc151d26f14dbb28fd74e4e7edafab9fc048a2f277cb1e0226dcc7d4f905ebb0dfc84df5cceaed360082baf1a1412a09989e4790b0211a45636a7dbcafae0107130d3179f36d3c96f7416674443ec9f308655a3b19c9297d7448cecd51d41a7cc06d1b6e5a5392d61ee8e2db082c7621f8905a1456b12a10bc6c60572861ac2b1d32b410a3730ec8fedbc228d3d37a8435102da4452939fcdc4b532d098f4a85672dab4aa7bcf19e77929be7165fdc87d42fab6060f585df3a37df714eae8bb6882e3ff34f5fb615f497d5ef975f8da20f1117fae2401d80e710aa1c74b652657b43980f94a43175df1119e1da87a23c83e4b7f7c07ad96684093eeb50868b7a2c5f965e732bbd5764d4b7362bb614bdf839672a01933597bf81320617cd9138236acbe1fa4fff3d3d9cfd6ffc2ba0dc0f228506914e41196659f77129a623b35cad84d12ab6e4bd684b0ff936c37510704472b9c57a20f0dd58086fd85beca08459c7f6b00deacd30ec8555c55635c24719933117316a2ce76ce891b024002759e0c5f47d6b5784a431471e20c4c99ca64ed4c251d5e79c454dcbcbf70e545d27485863f63abc5ddfcd2b01509a99042348ffe070f6eab3633c07447d166b1976c8cb1e9d7d9b1f7723f392b476346fc98b6b97995acae57d5388210f4f28fc12d9fcb073659c047bfedfeb6d9d3fc9d78fcdf7dcd44569487768701ffca4df6d447ba2f4596726c166a50d0ceccbaad0f1091c6c97f823969a426de2617bf62f49d8fb009bc6a35c357b3dd42a7251cb557fe1b1bda5cc617b07e45198ffaf100d308585944193294e16fccd96e7dec92d5bae84b773b25aa7e2ba39974052258e6a640681a31e64c23ff61e84faace9264b3ec1cf0f10aaf7c07f5ab106148b940f5f1c05686bafa25e8ad3da2e98c6a171751698b0baef21edf6cc21ccdda9d8c7c72f8d6bdfdeacc11009c0025dc38183722c1fb830a5ae9a7dd56a2b5a723eb7593302cd099b46171070f33863a9d0dd22cfc78e578bd87b1cf461a251a17e9c0f0aa722c9c13f7b5cf58ad35e0c407e41daad627850cf2be87ab722a6f782d974b4cd72bcfbe45f7ecffb84780e18a4db987a38a25ea0d7f4bc97a354d810e4597c23adecba6c89d9cc6f038a084743bb3c1e1badb40751f0f42690ee9564651386e33385dd7a5ce26cf3d58393c804f0ff5ffbc59c673966835911133d5f8bcfd9420ed78712de0d704e55388b8cb96bf83c1962a097c956c4afbc1e17b508468ec10d4caca866bdaafa8e1637109ba0ad5d1ecec5a7148730f68e8a464a729c2cfa551806ff1b24ba42323d211c918d41507e4937e71b9a6bf66186b68a78337f16ede81d2b0360d30b2d72740670cf8a9e2fb57684d8c735711a92446fc55b8d274b3388d3f69be0bdfe49a07540eee4f24468168d0b736b49e8faa665a3747c000000007cd07c9814bc46eff7634a6b9f80d6f90328dc953a14fa41d93742593399b0c651338c6af0066ce044a77db446082a40438e9928f56b166404f7b720d92297ac93f2be8d34f0687d625b41e7cb4c7bfd46ea7cdf10d343c70f6af84a6785bc2b427545534f04e2054709000000000000007fc06eeb4585816488b907bee075981bd59d81370187749697ba04348d6ec8b48cb856aaaa9e2367952034eff0481cdba4ea1e18d558b7a1f9f7539fadb0c0e9b955bcfb9457cb8c81980ee46fe30b77dd3a1e66a24bad02c939038f2798dfdeab5d12da1fb80783658cd5f20adf57d50eaba2630ae033b6e4dbf33de13b5576cac3bdad9aa721673d707c50d12215d89d14346da7ac7c29d7d09434c7b0f0e0f9a6e6c46e2f85a750964c38a81b1c101499cfcd9ebecb1ffb0709e88b2588426d28ee0d42a8ea7c53b225d70fc96abca08323fc537857e346d16483527366d87c6c76afdbe8eb57d7100e5a8848605cc5ba776388e15c6cea0272820ae35d033631ddf7a3dcf2e9a1f81b13bf2012fba34c3072764dcdc51fc5d7226c947ce90bcac3122596ebdaaa1d9d37ba6be92596f8ac2c2d3d672858957f2fb58db05642273b2f2b12b84371d23a627735c29ef629a4123320e485f87ad428470f7bd4cea2eadb85b900b54958fb10dcd440469b5558a0f156c8a22313eaf4c1d0866b5c3fa131ed502ba65210d64956e83a709b8505efeabcc4b3f57ec1fa9a09093072090a95f35d36f45d57e6821de4dbf441cdb11337e235f577db357ced1f9ff4d7490aea60e32d917a892e551b13f87ede4ee5ec56e21e2b6b37a4693f2656752f0bcd0cf7f9ddfa57c2686ec698ef3754158032f5cadf4e00", "8e30814b88385af58b5dcabb93ae43360c33d1349190a122e36383209967553f233d0063a094cc419b89db51c47c409efaba18286ea899feb37aa2f9471b92e9e9b3b7b1d4a175087f6ff44cd120a2fd04ebe1d0259c96769612305a343cd7a59f07e9ff415f6515e998b4846d3eff38b59ddf2b50724fd9ec62fa5097704d8c887fa488ccfef200023f14be5ec35703db3cdeab2a4d7b577789a5f2249da5b084f916d1f3c557809a47b548464b046330dda580e66b916fade0a15f002e60e60e1afcc2050054a7d0cb3e659a824cce3f5b45f4aea079ad14ca9399116d6dc61091708ac2429cfb8094784a5b9ce788768b54fef389637874b87422b5cbebf72f1eb779e9dd3ad9ef617b7230e5ed7c58aa4d9260210828944a29e9b79bb82cc131bb13a2b97faf648b4e00744b8d2c4feda8bc0424b8c99414e0be9896e0c4f06e20f1a4db1f49d99c65fad15729ec72311413768f18d89161cb6137d4932507e849e50656798d191b041afb2c57eb64c019e4a28e8fd88b36657aa3321622a54a1ac9371a3561ff834ed4fab50d8546f368c91fc5aa1e2d40a63c16f44287b869ec34ee5188ab838941e963f7d70727b9bbb5c81d696ab3ba2c3a41c0202cab3f587a4e89556cf567e156a9582970c2e25a425edcaaf4992794e189ae6c408f0fe2b151ee42aa9b65f639eb2244b61df9cbe12547488be53c592b3fda5de2227f958570fd94f96cd1ef69800cb26d1413faabbbb68e4e11d19670ea0b1a696a77494169a92cf2887777ba6340c90e47d52a3af2f09f6b0647aa796babf0f76c75441deb0ff1c5c08ef1db155bff4e8a895d5745b95b513fa47bb49b1507b81df47d9c4cd184a4365b1c5e0f7b0ba058d91dda76a8785cf19c3c9e82516b7b296424ba796fcf2b6167882af6e3d111dcbe728972d019e9dca27c95ef8d9ff739fea53d6b94ce2a8d228d785db8f14773993912d185c7c7bdb4e475253a9c770f11b9fd152e335302683f997941f9d6ca8a6aa9ec9e6341ceefb779c7f6e5b2f0676b274150dcad34ade5f3a5e0b1487d6ebb0cfecc46b93440571ad791d2c8b034cbbfa77dc8e2d39b859f77433e8ec0c8007bf0026c42da0d31f098e0f2c01d76880cfd0f5e5f1a4f3731f236d95ac5af6cf8e1e35641bc1c118927d107da9fb85fed7c8eec1fff7e92051653346683c17338a74f87657d35b1a7a601522e6d4202473580934bb3ba17ab9989915f626a86ddbe54f919ee5f45d3f9c7a7cdd114ecbf93f557dde83f9db0e90f7dbb68d12128de3138643f422521c0d7a7c27ffdaf17649119f285419c4eed197911294d111bdb836d608b5883c54df1def92fbc7f40694a13e1e3c1cee0a27d26013729f55b8ba506be8a67e2e2cc90649e20e453a1c4220062c41dc3b22ed47c2ca658318aedec6e0aeddbeafce7e76869b16aa3aa5e8777c943752aba12ae99fa826cea93dd10e77b9dffd6c7609870e9ce19434f05466e62a9bb64db48c251b5a2e254345da803f787ae31c0df5f776969a761bde6238ef2a6b355fcac6c8824d36a998535c519d25c59aad2df743657e61846e4353b48f4376d9e31b3586e674267eebdfdc4cea41c4a2a01b7b3f3fcd7acacf087eb468290661aa914c3d5efa2fc4edfb032605d2592b9095cda07ea30acee0c37cff6f9f3311d3a7cc026324bdd55f4d1c0e3589700f53763f4d19705a7ea5eec5128a3bca8b69340589137d24c96f5e9e2a7047e205f50310ef84f665ce36fcb5bd068251291d9c69da2405c926dc572dd0bdd0541b2b33fcdccb62a4b969c1ebb16fb2d7b5348b5d82fdb03ea7c7430264f357d27eb50f5af26a90b3b69ffc21064e9e3dc995008596e3a7339c230ed68873d5161342bd12e74411d0e0a9585395538a56da1d6a190a7f4d825b45f8a2cddc233fecd2c8e7e3438589e2a4002fda7ed6ee2f922161d02f61fe69437e7a17d2302695d3612a618f77819e8eccd5c23e8f4547b1d38910db8ac44a48ed3de2c039ea1ef427a1b9e75a702e9cb6d9c5260dcb898cf5c91408aaba4e4955cbf35742fa4d8c33bcfef93744e248ac2280b9713aeac8fc0f55434018b84a9b2e66a1703017cb05be725634bbf0c29ea40c090441bd14960afc961208784c1a004c010aa4b3452b16e5f213e0ba9d2578cd0911ea18fa0ccb9def5033c6762208c1ca253b140a13993d15f97822be6be430732f64c078dcd1bb05ed20197f5a4c9cfee50c6bf65e16cf88f1ec7db8752eecb4c5a151363004e5b1a9a4f98f782f34443138f6988be09fa585e7bd012e702f620385db9e0db2779b7a442320751e97845ec44a959ba8606d00f6335997e550427df6744a6f9635cbbd9cd4e4594d154ab9626155b7daffb77600d028bb262d0d3b6f49e9bae034072e041871f90876faeba868a784393e827a2f2881ad1a5b46de1cdd58c1caa3631fb630c224e430928e13eb06342b3f12ce0ae7b0c94f968fb7d1daa907431d6c85f9a9ebc5c4b9ee522fd242e236799f90e0f94bb9197feb341c885923ae4679114d8f2959e50e49cee9a54b4482fd84a0a4480f9cacaa4ac2d7814c865488553569c399bc66b17bab67063517532f501e1a0860283ad55218c8d4d655ecbd08d0dc85331cc04856630ebb7b399ef72be67d71e61eee4fe43dbef00383637734723aeaf8f02d184f30e42f518b6d35c228595b2b329c17a09d293230206935588149216d56da57ac9e363d37fea09fa1838fcb6ec24a4d39c146d8cb88f2503d284202d1ae33c99110a828a1c3874dd90b3a8a1954589080d362a70bb4fc8b6d63f04e73235a1af4ae34fd97f722bfd7c5d5be8f4506c9d70853c4febc0fd069d6d5f25ac12a67eca49660b59aeac7a9ebbcd81bf64f2459df3a5f17bc70c2d571a8cc17f016b16f9231d75df9ed1f8163ea499e8e9d2526f21974d3a1e5f33d9c7bba0681f2d1663b857625588f58ca1259ffde864288c9f3e7811671185dc40353351f561a4eb61cb5ee4d936efea721dad940c10c208c1ce930b43cf3b4323ff0811b1334e7c806ec1ae4340692ebf4fb07ccb4060a341e55ae612ce52ee6a9c779365308840c962dbe5c7c42d1d8981c1bbc0e67d034e6d26548faeaf5e618b64fc55949be0dc4312d474957d61223a0c63289c16996b43d0a8c5c076a71d1be5fd4b8ff07b7c9829e3aad31dc22392b9d998efc7ccaa7210eeb2bc94b4fa3b090e29ec8586bf5268f692c95c660129331015a88b9437260d76962f34eefa2da6a86cb633677905456bb8e8c7b336c6a1e64dd915b200eb2e2b46a319dd5084572fd13fe88db00275b4aef36e188ac653c365825e369c34fa09a865c5c7a4c6e64629960ca37e6146f11fbe9e81ff4b1042325df45ff65c22475473a7864e687f02db7cd7faaaf8838a148bc6bc845c884c4236571a59f6ef555df0dca505c268edf9cc01da6ccf32bf45dd9fe0fb32efa86069b5ef70b4198e7eb636ec8461a022a9a5e4c1df3d6d5f8ac621f7810f3af3fe26198eef1e382a8a47f1a0e7b7ecc08de917206cff66d3ae5915febbb032bb6bf109ba5fdf6ca8ceb3cd36fb2048a5fd3cc364e017ffc87ed7bf66381b6923f16585969141dc852f07a6ed19aacac9569eb099cb6196c9c65ee50a2dff15d9dd0e667d4ac8dec4dee3e5431092ae9636b97786373d3b19ec44aab64ab0aa044278bdb3d6160dcf625a6e0dd45748132857c7fc2a412575d0b4921ce13187664795ac05c79cd72590f1b6b4c0a3e4f82c04b064818ea95d66b4a6814e0908e82209923bb3015bd8130a1867e2245971b16bc3f759d2075666e2cd1ddb39145d4e9eb862a6cbb30cf535c811fda9c7fcb9227277bd04c05d5ebafa5aeb8d725156f821652fa1ecb09ff3f4e147328c05345ec99f1af306f7112e6b1482d22d0b6c46c95805c6e579a10047809a324397ebf431d21c3ac5336cfbd057b8bcdb098c7b4011d1076c8e762e3521f29d18beb88c4661d9a315501aad69c828260ef3656d371cdc9b0a5c893c05032613fd6069ce89e21673ac8998fba609d6ca6b4786fe8521f9482cedd581f8a5f253bed3f0c8fe7d053f0da098bfc0703607675dbbb4ebff2337b8bba505a28d4a88d9f41d7afc250a0c078f0d57a4ec7a628a31d142b7b050afbaf0007f91f706a539da270a96423d29b50acc8223a22e35e8bff410a15f2c53dbb0bc2baa72e3c17f3df35a4237c4ecbdd3ca93b6c85c0decf959ad8269d3df4b15d0064148c26b8f4ece2ef2cb5eb32b003c66b0793dcf7fcf3c8c792396094863e7eed471d7ebbf27d86d21352738862b5740e042b28adba300a1e3a18736c943eaa2e855b958df85ae713c1f4f3e66f6549825b7312d9116e4d11b358012ce9f980c4d508015e69cdc7c8da31b436fb8b59e3bc1b358ce68527289e9c2831c7a3c6532a1291f6f698349626539f810aac595e831c05b77af38755e90bfe2c43da83fadda1a01d0befb6c4eb761ba007e1a8b0fd08d5f62b70283f847ede9d1e673f301807e29f9c0eb48c8eeee8bc9a735ab36dba7b0a97c52e5bd6d594bf818643b8f654f488ca36b28c7d39f6009d39b114dc48148766b410618fe091203f77d3db1c976878f52cb53b2586069a6cdba8b3f0a54cd929e9741303aff83d2f59d60af46b40bb0aaeb480ec590cfc701db447c601f52deec7a8694c67318a0a5479327fee4fcd4e22caa357dd0d66cc13bef06ea49796deabd33c575ae7035288609e0ce0320d022ae2052e2a5d5936a01bd10b902000000f7efb95c8344a52487b688760dbdea5d0528fbe4c45b346ca68687d9fbb7dacfd9192f3c7ed73833d432dfea1108d50029f4362b33882b536b178abb208e36e38ac0cb868c650fbb9a7269e119fc717fe9707fbf706ac1371a799f282d50282f65839a445162c3ad67eb91d725abc5fe61d305c502bb3003590d6eb108dc93157c5f4542cfc56b15db2b1fa4686ec3d9f673d85ab6ba62b3b26e3e315b6e8e358ba67bbcefa3a6cf83c458c12df7fbc886563540db5eaf26d14e1ddbf026ee722a293c6907c794b3beae0f1017e7afecd874e04248dcec80f15c632d402dbf3f727a7863709b351fec3b2c6c9ac3b73c698c6f51eed1073f71e9f1cea375f7bbe2d5f9c003dbfdcbf02c14519a40d160cf9bf05a3f25ccdbedcba02b5f6376433d8ad76d20e4aa72d39cdb1fffb3e80760effe0157b4574a0274cbeb386188eae7c5d0b3b8d7a46fc224cc28f7e1428eb2f2123e0f752892d714afce143e35105f1184a615bc10a2e121a572a493d08500c6c6cf1fcf7114b91cea03d827fac1d86af2773462c83b17b255e6c19e13401eecedd2b65e2123a5a9ee7d59a3e96737153edf08f8607a5dfdf1c89b29935125f07211976cf14da7ff01f07eb46c247dca599af2fcdcc9119b2fc50b7391588e53f1f2f172ea544cd469bda326dab5cf7f8b9324d3d9cd1769efab2c46813a2d614f7e9ac66fd5c1c7a4a0202fa6da531fe304f19a8a8fcbdcd9106c8d33a4782c4ce764616373e0cb136f15ca85283346a2ed7308a7448da5e562d98625996c9da63a2665ac728ddddd54e243cf0b0884360b3aa876894c41a62cd3ddc947cdd5397e6c4f9682b59ab049608bbd8bff192bb9eb37b92555434a40cf9e3aeceb2eea9ed6513be7da15f6d8518ea4d85a01f0bb064a03fa3f0c00"}) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) unshare(0x22020600) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), 0xffffffffffffffff) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r6, &(0x7f0000000080)="4d01000000000000002f00e50414090b00920000", 0x14, 0x81, &(0x7f0000000340)={0x11, 0x0, r7, 0x1, 0xe, 0x6, @multicast}, 0x14) sendmsg$ETHTOOL_MSG_WOL_SET(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010028bd7000fddbdf250aed6b001800018014000200"], 0x2c}}, 0x240408c0) read$FUSE(r3, &(0x7f00000005c0)={0x2020}, 0x2020) 7.195728681s ago: executing program 2 (id=5485): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) ioctl$sock_bt_hci(r0, 0x400448cb, &(0x7f0000000140)) 6.978904065s ago: executing program 2 (id=5486): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x20) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r3, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x3}) r4 = eventfd2(0x0, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000100)={r4, 0xfffffff9, 0x1, r4}) close_range(r1, 0xffffffffffffffff, 0x0) 6.929006796s ago: executing program 41 (id=5486): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x20) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x275a, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r3, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x3}) r4 = eventfd2(0x0, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000100)={r4, 0xfffffff9, 0x1, r4}) close_range(r1, 0xffffffffffffffff, 0x0) 2.908716204s ago: executing program 8 (id=5520): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8923, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000080)=0x474c, 0x4) ioctl$SIOCGSTAMP(r2, 0x8906, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000000), 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2000000000000036) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000240)="0f01c866b80500000066b9006000000f01c13e2e660f38414b0c67f30fa7e80f98b49e390f320f01df66b9800000c00f326635001000000f3036672fb8c6008ed0", 0x41}], 0x1, 0x6c, 0x0, 0x0) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r4, 0x4068aea3, &(0x7f0000000100)={0xc7, 0x0, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x4) ioctl$KVM_SET_DEVICE_ATTR_vm(r5, 0x4018aee1, &(0x7f0000000300)=@attr_other={0x0, 0x0, 0x1, &(0x7f00000002c0)=0xffff}) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000200040010000800014004000000", 0x58}], 0x1) ioprio_set$uid(0x3, 0x0, 0x0) ioprio_get$pid(0x2, 0x0) r7 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0xffffffffffffffff}) connect$inet(r8, &(0x7f0000000380)={0x2, 0x4e23, @empty}, 0x10) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x450402, 0x0) ioctl$TUNSETCARRIER(r9, 0x400454e2, &(0x7f00000001c0)=0x1) close_range(r0, 0xffffffffffffffff, 0x0) 2.855031635s ago: executing program 8 (id=5521): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x3}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CAP_X2APIC_API(r4, 0x4068aea3, &(0x7f0000000080)={0x81, 0x0, 0x3}) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x2f) ioctl$KVM_SIGNAL_MSI(r5, 0x4020aea5, &(0x7f0000000040)={0x100000, 0xeeee8000, 0x4, 0x1, 0xfffc}) r6 = eventfd2(0x0, 0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r6}) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000100)={r6, 0xfffffff9, 0x1, r6}) close_range(r0, 0xffffffffffffffff, 0x0) 2.688472188s ago: executing program 8 (id=5522): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x101540, 0x0) r1 = signalfd(r0, &(0x7f0000000040)={[0x1]}, 0x8) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x1, 0x101, 0x0, 0x0, {0x5, 0x0, 0x4}, [@CTA_LABELS={0x14, 0x16, 0x1, 0x0, [0x9, 0x68dc, 0x65b, 0x1000]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x20040000) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x3) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@empty}}, &(0x7f00000002c0)=0xe8) fstat(r0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000380)=@acquire={0x188, 0x17, 0x800, 0x70bd28, 0x25dfdbfc, {{@in=@empty, 0x4d4, 0xff}, @in6=@dev={0xfe, 0x80, '\x00', 0x34}, {@in=@multicast2, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4e21, 0x0, 0x4e22, 0x0, 0xa, 0xa0, 0x0, 0x1d, 0x0, r2}, {{@in=@remote, @in6=@private1, 0x4e21, 0x8000, 0x4e21, 0x3, 0x2, 0x80, 0xa0, 0x5, 0x0, r3}, {0x80, 0x7fff, 0x0, 0xffffffff, 0x8, 0x8000000000000000, 0x9, 0x8}, {0xffffffffffffffff, 0x0, 0xfffffffffffffffe, 0x4}, 0xff, 0x6e6bb9}, 0x8, 0xc, 0x9, 0x70bd25}, [@replay_esn_val={0x34, 0x17, {0x6, 0x70bd26, 0x70bd29, 0x70bd2b, 0x70bd2a, 0x8, [0x8, 0x6, 0xce6, 0x8, 0xff, 0x5]}}, @user_kmaddress={0x2c, 0x13, {@in=@loopback, @in=@private=0xa010101, 0x0, 0x2}}]}, 0x188}, 0x1, 0x0, 0x0, 0x10}, 0x200000c1) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f00000022c0)='\x00\x00\x03\x01\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x02\x00g\x00\x00\x00\x80\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-\xac\x99\xb8\xd2\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc4\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0HdO\xb9\xa2\x1d\x13\x8fCha\xb3\x95wl},\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80Z\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9\x13f=\xbd\x03\xe8\xbex:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13\xba\x00|g]7\xdc\xe9=\"\xe4\x90[\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146\'Z\x83H\xabF\x18<\x86h\x01=\x03\\\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&@\x00\x00\x00rT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\xd7c\t(\xf2\x93\x8d\\\x91\xef\xab(Jck\xdf\xa3 \x16\x9bH=\x01\x7f\x02\x1dF3\x7f\xd15\xa8\xd2\x94\xa7\xe9\xbd\xdc\x16\xe1Z\x9c\xe3\xeb9\x8f\xfdC\x0e\xd3]\xb5\xfdB\\\xd2\xfe\xf6H\x8ai}kDM\xbd\xfcJ{T{@i/\xb7x\xc5z\xfds\x85\xef\x1f\xf0t\xf5\xaf\xb21F\x01\xe0\x86\xde\x88\xb8\x8f \xfc\xcd\xba\xea\x16\xc1J\xb7\xe3\x04m\x0e\xaf\xd6\x88\xd6XX\xba\x8a\xdb\xeda\x83.H\xe3\x86\x03\t\xcb\xdc\x80\xee\x0ec\x12\x8a\x92\x11\xb6\xcc#\x10\xec\xfd\xbb\xd3\\\xc8\x88\x04,\'\x14\xbf\x84\x16\xb3\x8f,6\xc6D\xae\xa1\xf9\xe7@\xac\xaa\x104\x8b\x8eQ8\x11\xa7|\x87\xe2\xccrj%\xc4r&\r\a\xa7\xda\xf5\'V\x89\xe6\xa4\x05\xde\xf5\xaa@\xec\xe2\xf6\xb5x\xa1w\n\xda\xf2\xd67\xc6%\x0f[sF\xb6\xaeS>\xe9^\xd4\xf03\xe9.\xc4\xd5\xe0\r\xa1Q\xa8\xf2\xa2`zs\'k\xd4pV\xab&%\xf8\x8a\x80\x9d\"\xf3\xcc\xd2i\xc8\xd8\xc6\xbeD\xda\x86?\xf9\x13\xe5L`R\xe8Vq\xa3\nD\x9f\xe4M\xe6\xab\xdd!=%\x06z$\x99\';O\xfc\xf0u\x83\v\x83\a8\xfe<\x9e\xa8\xfe\xca`D\x91\x81!QT$\x05T\x85\xd6\xe9!\xb9wfL\x12\xa8\xb0\xb0\x86\xc2\xa1\xf7\x05i\xf5\xf0\r\xe7h\xdaD\xcb\xd4\x87\x84\xe5\xc7r;.\xf0\xed\x17\x83Nn\xb7\x0f!u}J)\xa1\xa1\x16\xc5`Z,\xa3\xcf\xfdy\aH\x06\x14l\x92x\xdbB=\xcc\xcdfpi\xe5\x04=HQ\xeaE-v\x02\x0eY\x8e\xbf\xec\x16\xc4G\xea\x8bS\x8e\xd5f\xdcj\xe1\x86\xf9s\x90\xe5\xf9\x89\xc0\xf3\xcd;r4j]\x9b\xdf\xf5\xe9\x82\xe1\xdb\x11\xb3\b\xa2Y\xdb\\\xc1H\xc3\xcf\xb1W\xe9(\xee\x18\xca\xda\xf5p,\x16\xbc\x17\xfe\xd8\n\xe1\xa1&=+)\xf9Vd\x11\xf6hX\xbe\x85O=\xe2\x9f~I\xa1\"\xa9\xd9\x19\xa2\\\xb8>f\xe2Jh+u\x90\x13\x94\x12\xc8X\xd7\xb4\xf1JS0FN\xa0\xda\xb6ez`\x9a\xea\xcf^\xa5\x17{\v\xe8n\xe9 \xc0/D\t\x7f\xd8\xad\xf2e\xff\x8b\x16p\x0f\xe4\x1a/\xe1\x96\xd2\xae\x94\x0e5\xb0b+\xac\x14\xaa\xb0\xb7\xa5.\x15\x8a\xca\xb5~=D-\x90\xc1\xbf\x05\xb9\xd5\x86\xeb\xd2#\xda\xc132\'\xfc!%\x94\x1f\xbfL)\xc2c\xa8\xef\x152\x8d\xef\xde\xbe\xab\xf5g\x80\x02G>\xf5\x04a-\xff\x06X+\xc1\xd3\xb1\xcdn\x15p\xdf\xd8.\x89\x95{\xb6+:`\x9c\xcf2\x01\x1d1\xf7\xe6\x7f\x1f\xf5\xb0\xb9\t2\x14\x81\x99\xb8@7y\xb4\xce\xf1]\a\x03y\xc5F\xfa\xae\xd1O\x7f7\xa7\xc1\xb2.~B\xe8@G\xd1\xd9R~\x1b\xf7\xa8\x86\xa7\xc1\b\x9ej\x01\xf4\xb7\xd2\x0e\xc2\x15S\x19\xd7\xd4\xe6\xaf!\xf8_\x8aEOp@>4\xd7\xcf\x11\xe0;\x99}QmE\xdd\xa69)Q\x9e\xb9\'\x97\x9b\xe7\xa4?Ed\x9c\x7fE\xba5\x90\xc07\x96S\x9d\xe1\x84\xfa\x1a\xd6\x9a\x15\xd1o \xc0\xd28\x01\xa7\x99\x85q\xbd\x80\x00\x00\x00\x00\x00\x00\x00H\x0f\xbbT\xd5\xb3\xf4\xcd<\x8a\x01\x19\xd0|B\f0\xf8i\xd3\x1bJke\t\x8b7Q\x1dQ&\x96H\x05\xec\x80\xf0\xab\x8f\x94{\x9d+\xefs\x1c\xfck\xf7q\x10\xf6\x16\xbc\xe7\x93\x0f\x7f\xcd\xa7b\xbe\x88\xcc\xb6^\x93\xa9P\xf3\xa3\xe4Az=\xe0+Q\x9e\xb5\x11\xb3\xc1\xa8P0+\xc9\xa1\xdbU~J$\xa4\x03\x11\x1aa~\x9du\x8f\x8d\xbcI\x85k\xa0\xae\xf6\xa0\x94r\xfb\xe3\xaa\xd4\xf0\x99\x06\xe1i\x1f\xfa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\\\xb2/R\xedI2e5\x88(\xc0+^\xe7G\x17\x03^\xd7g\xb9n\x8c2\xb3\x12\x91\x86b\t\xd0R\x01\xda$Y\x85\x02&\x95FC\xc8\xd9') openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x101540, 0x0) (async) signalfd(r0, &(0x7f0000000040)={[0x1]}, 0x8) (async) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, 0x0, 0x1, 0x101, 0x0, 0x0, {0x5, 0x0, 0x4}, [@CTA_LABELS={0x14, 0x16, 0x1, 0x0, [0x9, 0x68dc, 0x65b, 0x1000]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x20040000) (async) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x3) (async) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@remote}}, {{@in=@local}, 0x0, @in=@empty}}, &(0x7f00000002c0)=0xe8) (async) fstat(r0, &(0x7f0000000300)) (async) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000380)=@acquire={0x188, 0x17, 0x800, 0x70bd28, 0x25dfdbfc, {{@in=@empty, 0x4d4, 0xff}, @in6=@dev={0xfe, 0x80, '\x00', 0x34}, {@in=@multicast2, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4e21, 0x0, 0x4e22, 0x0, 0xa, 0xa0, 0x0, 0x1d, 0x0, r2}, {{@in=@remote, @in6=@private1, 0x4e21, 0x8000, 0x4e21, 0x3, 0x2, 0x80, 0xa0, 0x5, 0x0, r3}, {0x80, 0x7fff, 0x0, 0xffffffff, 0x8, 0x8000000000000000, 0x9, 0x8}, {0xffffffffffffffff, 0x0, 0xfffffffffffffffe, 0x4}, 0xff, 0x6e6bb9}, 0x8, 0xc, 0x9, 0x70bd25}, [@replay_esn_val={0x34, 0x17, {0x6, 0x70bd26, 0x70bd29, 0x70bd2b, 0x70bd2a, 0x8, [0x8, 0x6, 0xce6, 0x8, 0xff, 0x5]}}, @user_kmaddress={0x2c, 0x13, {@in=@loopback, @in=@private=0xa010101, 0x0, 0x2}}]}, 0x188}, 0x1, 0x0, 0x0, 0x10}, 0x200000c1) (async) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) (async) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, &(0x7f00000022c0)='\x00\x00\x03\x01\x00\x00\x00\x1f\x00x\x92\x12\xac\x06^\xbewV\xf3\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x02\x00g\x00\x00\x00\x80\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-\xac\x99\xb8\xd2\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc4\'\xd0\x9e}\x89\xff\x8c\xec^\x84\x19\x9f\x80\xad\xf8\xbf\xa2\xa0\x99\xc2\x16=\xcc\xb0\x1b^:4\xeb\xd37\xe3-\'\x02\x16\xf5\xe6\x93\x02E\n\xe8\x00\x00\x8c\xed\x11\xf7\xf2J\xf6\x90A@\x01\x13\xc7`g\xcb\xd7\xdb\x1e\xb2\xc9\xfd\xf7\xa9\x96\xf8/0HdO\xb9\xa2\x1d\x13\x8fCha\xb3\x95wl},\xc6\x1a\xf3\xa8\x0e\xba\xecOv$\xc8\"\a\xd7T\xfb\xfc\xfauT\xf8\x9e\x86\xef.\xf6<\xbfB\xe7\x80Z\a\t+x_B=\xe7\xa5\x89\xfb\xa2\xc6\x97\xeb\xdecY{\x0e\xc2\x00\x00\x00\x00\x00\x00\x00\a\xf4\x88\x06\xe3\xcb\xc8\xe0\xcc\vE\x18\"\x87\xa0\xa9\x13f=\xbd\x03\xe8\xbex:\xceY\xf0\xa2\xe0\x9d\x8c\x8e\x11\xb7\x98\xa5\xda$\x94D\xb4\xf2>\x01\x00+\xfa\xa9 \xe1\x13\xba\x00|g]7\xdc\xe9=\"\xe4\x90[\xc7{\x84\xb9\xc0B\xe1\t\x00\xbaQj\x81\xc8\xf8\x146\'Z\x83H\xabF\x18<\x86h\x01=\x03\\\xc4\t\x8e/\x12\a\xdf\xe7zU\x1d\x15\x0e\xc1?\xeau\xb4\x84\x1b\xdaR-\xf4\xe9\x1f\xcd\x05\x0fz_\x8d,^\xde\xfd\xd1\xbed\xed\xa1\xf5\xc6(p\xb4;\x0e\x18\xf7/A\xfd\x92\xd0}ur\xaag\xdb&@\x00\x00\x00rT\xd8\x88~\x13\xc22t\xf6\xf4Fs\xc1\x05\xfa\x99\x15\x87\x14\x13$\t\xa8?\xee\x94W\x8e\xe1\xcc\xc3U\x84\xc6]:\x9a|W\xec\x84\x18\bb\xd7c\t(\xf2\x93\x8d\\\x91\xef\xab(Jck\xdf\xa3 \x16\x9bH=\x01\x7f\x02\x1dF3\x7f\xd15\xa8\xd2\x94\xa7\xe9\xbd\xdc\x16\xe1Z\x9c\xe3\xeb9\x8f\xfdC\x0e\xd3]\xb5\xfdB\\\xd2\xfe\xf6H\x8ai}kDM\xbd\xfcJ{T{@i/\xb7x\xc5z\xfds\x85\xef\x1f\xf0t\xf5\xaf\xb21F\x01\xe0\x86\xde\x88\xb8\x8f \xfc\xcd\xba\xea\x16\xc1J\xb7\xe3\x04m\x0e\xaf\xd6\x88\xd6XX\xba\x8a\xdb\xeda\x83.H\xe3\x86\x03\t\xcb\xdc\x80\xee\x0ec\x12\x8a\x92\x11\xb6\xcc#\x10\xec\xfd\xbb\xd3\\\xc8\x88\x04,\'\x14\xbf\x84\x16\xb3\x8f,6\xc6D\xae\xa1\xf9\xe7@\xac\xaa\x104\x8b\x8eQ8\x11\xa7|\x87\xe2\xccrj%\xc4r&\r\a\xa7\xda\xf5\'V\x89\xe6\xa4\x05\xde\xf5\xaa@\xec\xe2\xf6\xb5x\xa1w\n\xda\xf2\xd67\xc6%\x0f[sF\xb6\xaeS>\xe9^\xd4\xf03\xe9.\xc4\xd5\xe0\r\xa1Q\xa8\xf2\xa2`zs\'k\xd4pV\xab&%\xf8\x8a\x80\x9d\"\xf3\xcc\xd2i\xc8\xd8\xc6\xbeD\xda\x86?\xf9\x13\xe5L`R\xe8Vq\xa3\nD\x9f\xe4M\xe6\xab\xdd!=%\x06z$\x99\';O\xfc\xf0u\x83\v\x83\a8\xfe<\x9e\xa8\xfe\xca`D\x91\x81!QT$\x05T\x85\xd6\xe9!\xb9wfL\x12\xa8\xb0\xb0\x86\xc2\xa1\xf7\x05i\xf5\xf0\r\xe7h\xdaD\xcb\xd4\x87\x84\xe5\xc7r;.\xf0\xed\x17\x83Nn\xb7\x0f!u}J)\xa1\xa1\x16\xc5`Z,\xa3\xcf\xfdy\aH\x06\x14l\x92x\xdbB=\xcc\xcdfpi\xe5\x04=HQ\xeaE-v\x02\x0eY\x8e\xbf\xec\x16\xc4G\xea\x8bS\x8e\xd5f\xdcj\xe1\x86\xf9s\x90\xe5\xf9\x89\xc0\xf3\xcd;r4j]\x9b\xdf\xf5\xe9\x82\xe1\xdb\x11\xb3\b\xa2Y\xdb\\\xc1H\xc3\xcf\xb1W\xe9(\xee\x18\xca\xda\xf5p,\x16\xbc\x17\xfe\xd8\n\xe1\xa1&=+)\xf9Vd\x11\xf6hX\xbe\x85O=\xe2\x9f~I\xa1\"\xa9\xd9\x19\xa2\\\xb8>f\xe2Jh+u\x90\x13\x94\x12\xc8X\xd7\xb4\xf1JS0FN\xa0\xda\xb6ez`\x9a\xea\xcf^\xa5\x17{\v\xe8n\xe9 \xc0/D\t\x7f\xd8\xad\xf2e\xff\x8b\x16p\x0f\xe4\x1a/\xe1\x96\xd2\xae\x94\x0e5\xb0b+\xac\x14\xaa\xb0\xb7\xa5.\x15\x8a\xca\xb5~=D-\x90\xc1\xbf\x05\xb9\xd5\x86\xeb\xd2#\xda\xc132\'\xfc!%\x94\x1f\xbfL)\xc2c\xa8\xef\x152\x8d\xef\xde\xbe\xab\xf5g\x80\x02G>\xf5\x04a-\xff\x06X+\xc1\xd3\xb1\xcdn\x15p\xdf\xd8.\x89\x95{\xb6+:`\x9c\xcf2\x01\x1d1\xf7\xe6\x7f\x1f\xf5\xb0\xb9\t2\x14\x81\x99\xb8@7y\xb4\xce\xf1]\a\x03y\xc5F\xfa\xae\xd1O\x7f7\xa7\xc1\xb2.~B\xe8@G\xd1\xd9R~\x1b\xf7\xa8\x86\xa7\xc1\b\x9ej\x01\xf4\xb7\xd2\x0e\xc2\x15S\x19\xd7\xd4\xe6\xaf!\xf8_\x8aEOp@>4\xd7\xcf\x11\xe0;\x99}QmE\xdd\xa69)Q\x9e\xb9\'\x97\x9b\xe7\xa4?Ed\x9c\x7fE\xba5\x90\xc07\x96S\x9d\xe1\x84\xfa\x1a\xd6\x9a\x15\xd1o \xc0\xd28\x01\xa7\x99\x85q\xbd\x80\x00\x00\x00\x00\x00\x00\x00H\x0f\xbbT\xd5\xb3\xf4\xcd<\x8a\x01\x19\xd0|B\f0\xf8i\xd3\x1bJke\t\x8b7Q\x1dQ&\x96H\x05\xec\x80\xf0\xab\x8f\x94{\x9d+\xefs\x1c\xfck\xf7q\x10\xf6\x16\xbc\xe7\x93\x0f\x7f\xcd\xa7b\xbe\x88\xcc\xb6^\x93\xa9P\xf3\xa3\xe4Az=\xe0+Q\x9e\xb5\x11\xb3\xc1\xa8P0+\xc9\xa1\xdbU~J$\xa4\x03\x11\x1aa~\x9du\x8f\x8d\xbcI\x85k\xa0\xae\xf6\xa0\x94r\xfb\xe3\xaa\xd4\xf0\x99\x06\xe1i\x1f\xfa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\\\xb2/R\xedI2e5\x88(\xc0+^\xe7G\x17\x03^\xd7g\xb9n\x8c2\xb3\x12\x91\x86b\t\xd0R\x01\xda$Y\x85\x02&\x95FC\xc8\xd9') (async) 2.59339897s ago: executing program 8 (id=5524): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder0\x00', 0x1802, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x11, r1, 0x147a5000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFBR(r2, 0x8940, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, 0x0, 0x20) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000180)=[{0x3, 0x0, 0x2, 0xfffffffb}]}, 0x10) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x13, r5, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) mount$9p_xen(0x0, &(0x7f0000004580)='.\x00', &(0x7f00000045c0), 0x1000000, &(0x7f0000004940)={'trans=xen,', {[{@version_L}], [{@func={'func', 0x3d, 'BPRM_CHECK'}}, {@uid_gt}, {@func={'func', 0x3d, 'PATH_CHECK'}}, {@pcr={'pcr', 0x3d, 0x23}}, {@fsname={'fsname', 0x3d, '/dev/md0\x00'}}, {@uid_eq}, {@obj_role={'obj_role', 0x3d, '&&'}}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, 'rlimit'}}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}]}}) close_range(r0, r0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder0\x00', 0x1802, 0x0) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x11, r1, 0x147a5000) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) ioctl$sock_SIOCGIFBR(r2, 0x8940, 0x0) (async) bind$inet6(0xffffffffffffffff, 0x0, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) socket$inet6(0xa, 0x2, 0x0) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, 0x0, 0x20) (async) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000180)=[{0x3, 0x0, 0x2, 0xfffffffb}]}, 0x10) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) (async) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x13, r5, 0x0) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async) mount$9p_xen(0x0, &(0x7f0000004580)='.\x00', &(0x7f00000045c0), 0x1000000, &(0x7f0000004940)={'trans=xen,', {[{@version_L}], [{@func={'func', 0x3d, 'BPRM_CHECK'}}, {@uid_gt}, {@func={'func', 0x3d, 'PATH_CHECK'}}, {@pcr={'pcr', 0x3d, 0x23}}, {@fsname={'fsname', 0x3d, '/dev/md0\x00'}}, {@uid_eq}, {@obj_role={'obj_role', 0x3d, '&&'}}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, 'rlimit'}}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}]}}) (async) close_range(r0, r0, 0x0) (async) 2.507130401s ago: executing program 8 (id=5525): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000280)={0x73622a85, 0x10b}) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x24008040, &(0x7f00000005c0)={0xa, 0x4e20, 0xa3, @private0, 0x5}, 0x1c) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x8000, 0x7, 0x8}, 0x10) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x7) r1 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711}, 0x10) r2 = socket(0x2, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0xf, &(0x7f00000000c0), 0x0) sendto$inet(r2, 0x0, 0xfffd, 0x80, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) pselect6(0x40, &(0x7f0000000000)={0xb, 0x3ef, 0x2, 0x9, 0xaae5, 0x2, 0x1}, 0x0, 0x0, 0x0, 0x0) listen(r1, 0x0) r3 = socket(0x2c, 0xa, 0x0) connect$vsock_stream(r3, &(0x7f0000000080), 0x10) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000140)={0x1}, 0x8) close(r3) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @local}) writev(r4, &(0x7f0000000d80)=[{&(0x7f0000000180)="c1000000da7ff40d5c0cf5", 0xb}, {&(0x7f00000002c0)="0f88a8", 0x3}, {&(0x7f0000000240)="c0c17a81df", 0x5}], 0x3) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) r6 = getpid() gettid() r7 = signalfd(r5, &(0x7f00007aeff8)={[0x8]}, 0xfffffffffffffef3) read(r7, &(0x7f0000000740)=""/345, 0xfffffffffffffdc5) ptrace$PTRACE_GETSIGMASK(0x420a, r6, 0x8, &(0x7f00000001c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) 1.509071731s ago: executing program 8 (id=5538): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder1\x00', 0x800, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x4000010, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0xa, 0x4}) ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='system.posix_acl_access\x00', &(0x7f0000000080)={{}, {0x1, 0x1}, [{0x2, 0x2}], {}, [], {0x10, 0x47261af65e6430a4}}, 0x51, 0x1) syz_usb_connect(0x3, 0x33a, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0], 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 1.380849273s ago: executing program 4 (id=5539): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs2/custom0\x00', 0x1000, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000240)="390000001300034700ab65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{0x0, 0x20}], 0x1}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r4, 0x5452, &(0x7f0000000040)=0x8001) r5 = getpgid(0x0) fcntl$setsig(r4, 0xa, 0xf) fcntl$setownex(r4, 0xf, &(0x7f0000000140)={0x2, r5}) sched_setscheduler(r5, 0x2, &(0x7f0000000000)) close_range(r0, 0xffffffffffffffff, 0x0) 1.327005274s ago: executing program 4 (id=5540): socket(0xa, 0x5, 0x0) socket(0x10, 0x3, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x3000) madvise(&(0x7f0000366000/0x2000)=nil, 0x2000, 0x13) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='smaps_rollup\x00') fchdir(r1) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x4b301, 0x0) write(r2, 0x0, 0x0) r3 = inotify_init() inotify_add_watch(r3, &(0x7f0000000000)='./file0\x00', 0x80000006) write(r3, &(0x7f0000002140)='\x00\x00\x00\x00\x00', 0x5) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='f2fs\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000003180)='./cgroup\x00', &(0x7f00000031c0), &(0x7f0000003200)='system_u:object_r:udev_exec_t:s0\x00', 0x21, 0x0) r4 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x100) lseek(r4, 0x1, 0x1) getdents(r4, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000100)={0x2020, 0x0, 0x0}, 0x2020) ioctl$KVM_SET_XSAVE(r0, 0x5000aea5, &(0x7f0000002180)={[0x2, 0xe, 0xfffffffd, 0x1, 0xa, 0x7fff, 0x200, 0x1, 0x715, 0x10001, 0x2, 0xf, 0x100, 0x5, 0x2, 0x2, 0x100, 0xfff, 0x5, 0xb92, 0xeb, 0x80000000, 0xb0, 0x10, 0x3, 0x4, 0xec3, 0xfff, 0x4, 0x100, 0xa, 0x4, 0x0, 0x1, 0xff, 0x0, 0xa6c1, 0x5, 0x7, 0x80000001, 0xf05, 0x9, 0x80000000, 0xf, 0xffff, 0xa00, 0x8e5, 0x80000001, 0x40, 0x0, 0x4, 0x8, 0x3, 0x0, 0x3, 0x5, 0x80000001, 0x2, 0x1, 0x80, 0x2, 0x0, 0xb8, 0x6, 0x400, 0x10001, 0xdd, 0x6f, 0x8, 0x7, 0x8, 0xd, 0x6, 0x1, 0x61, 0x0, 0xb99, 0x4, 0x0, 0xe, 0x1, 0x8, 0x9, 0x400, 0x3, 0x1, 0x2, 0x8, 0xc9a2, 0x1, 0x101, 0x6, 0x401, 0x6, 0x5, 0x8000, 0x6, 0x8, 0x400, 0xcd, 0x1000, 0xf8f3, 0x4, 0x5, 0x8, 0x4, 0x8, 0xa, 0x7fff, 0x1, 0x2000000, 0xffff, 0x3, 0xe96, 0x445, 0xff, 0x8, 0x101, 0x7, 0x400, 0x8000, 0x9, 0x5, 0x9, 0x40, 0x4d, 0x9, 0xa, 0x5, 0x7, 0x3, 0x9, 0xfffff6e9, 0x6, 0x3, 0x6, 0xf, 0x1, 0xff, 0x1ff, 0x5, 0xd, 0x8, 0x7, 0xfffffffe, 0x4, 0x3, 0x7ff, 0x80000000, 0x2, 0x5, 0x51, 0xe91, 0x1, 0x7fff, 0x0, 0x3, 0x7, 0x6, 0x4, 0x3, 0xe958, 0x3, 0x4, 0xffff0a50, 0x2, 0x5dc, 0x5, 0x401, 0x8, 0x1, 0x2, 0x0, 0xa7a, 0x81, 0x4, 0x7, 0x101, 0x2, 0x4, 0x7f, 0x0, 0x7, 0x1ff, 0xc, 0x0, 0x4, 0x1, 0x5, 0x1, 0x3, 0x9, 0x5d, 0x517, 0x2, 0x7486, 0x9, 0x9, 0xd, 0x3, 0x101, 0x10001, 0x0, 0xa, 0x7, 0x9, 0x12f28ca0, 0x2, 0x5, 0x8, 0x10001, 0x9, 0x8, 0x28, 0x100, 0x3, 0x10000, 0x0, 0x7, 0xff, 0x0, 0x101, 0x8, 0x7, 0x400, 0xfffffff7, 0x200, 0x6, 0x800, 0x3, 0x6, 0x101, 0x3, 0x5, 0x2d0, 0x8000, 0x8, 0xf, 0x77ba, 0x8001, 0xef54, 0xb093, 0x1, 0x52, 0x4, 0xe, 0x3, 0x8001, 0x8, 0x1, 0x8, 0x7, 0x1, 0xfff, 0x8001, 0x4, 0x0, 0x7, 0x5, 0x9, 0x8, 0x6, 0xc19a, 0xa, 0x4, 0xffff, 0x5, 0x0, 0x4, 0xffff, 0x9, 0x8001, 0x989a, 0x1, 0x5, 0x9, 0x6, 0x2, 0x9, 0xffffffff, 0x6, 0x7, 0x40, 0x200, 0xfffffffb, 0x4e0, 0x601, 0x4, 0x3, 0x5, 0x4, 0x35a, 0x0, 0xffffffff, 0x4, 0x8000, 0x3ff, 0x1, 0x0, 0x9, 0x7568, 0x81, 0x7, 0x100, 0x1, 0x0, 0x8000, 0x8, 0x2db9, 0x71f, 0x9a, 0x0, 0x81c2, 0x2, 0x9, 0xfffffff7, 0x2a, 0x0, 0x9, 0x7, 0x6, 0x401, 0x1, 0x0, 0x400, 0x9, 0x2db, 0x7, 0x7f, 0xec4, 0x2, 0x5, 0x9, 0x5fd82a8b, 0xe, 0x4, 0x8, 0x401, 0x9, 0x200000, 0x3, 0x2, 0x9, 0xffffa47f, 0x7, 0xb7b1, 0x81, 0x7f, 0x6, 0x10000, 0x2, 0xfffffffd, 0xcc67, 0x2, 0x9, 0x420b2efc, 0x8, 0x9, 0x10000000, 0xc, 0x8ab8, 0x9, 0x1, 0xc, 0x8, 0x1, 0x81, 0x7, 0x8, 0x8, 0xe88, 0x597c, 0x401, 0x8, 0x0, 0x7, 0x2, 0x5, 0x8, 0x4, 0xfffffff7, 0x4, 0x5, 0xfff, 0x0, 0x2, 0x5, 0x5, 0x76784d12, 0x1, 0x4, 0x2, 0x0, 0x9, 0x1, 0x101, 0xffffffff, 0x6, 0xc, 0x584, 0x8001, 0x4, 0x0, 0x4, 0x100, 0x5, 0x200, 0x24, 0x9, 0x72, 0xa369, 0x9, 0x80, 0x5, 0xee, 0x0, 0x8, 0x1, 0x660, 0x9, 0xbb58, 0x8, 0x0, 0xfff, 0x5, 0x2f5ba5d0, 0x660, 0x2, 0xf, 0x5, 0x5, 0x234, 0x100, 0x8, 0x7, 0x7f, 0xb54a, 0x6, 0x8, 0x9, 0xb, 0xc, 0x100, 0x4, 0x7, 0x4, 0x5, 0x2, 0x401, 0x20, 0x2, 0x0, 0x0, 0x5, 0x8, 0x7ff, 0x6, 0x0, 0x8, 0x7, 0x7, 0x0, 0xff, 0xfffffffc, 0x2, 0x1000, 0x80, 0x4, 0x2, 0x5, 0x2, 0x8, 0x1, 0x4, 0x5, 0xfffffffa, 0x10001, 0x3, 0x7fffffff, 0x0, 0x9, 0x80000000, 0x1, 0xfb, 0x2, 0x0, 0x1, 0x5, 0x9, 0x7fffffff, 0x9, 0x51e, 0xc53, 0x8001, 0x35, 0x2, 0xfffffff1, 0xc7, 0x1000, 0x0, 0x7, 0x1, 0xfffffff7, 0x1df6, 0x1, 0x8, 0x68, 0x9, 0x6, 0x6, 0x3, 0x80000001, 0x4, 0x1b, 0x7, 0x1, 0x0, 0x7, 0x3, 0x7, 0xa, 0x2, 0xd, 0x1000, 0x24ed, 0x8, 0x5, 0x6, 0x4, 0x80, 0x77, 0x5, 0x401, 0x8, 0x3, 0x6a, 0x6, 0x0, 0x1, 0x0, 0xfffffff8, 0xaa2, 0xffff7fff, 0x80000001, 0x9, 0x5d6, 0xb6a, 0x7, 0x7, 0x7f, 0xffffffff, 0x1, 0x81, 0x3, 0xb, 0xfffffffd, 0x3, 0xffffffff, 0x8, 0x6, 0xffff, 0x0, 0xc6, 0x1, 0x306, 0x7, 0x4, 0x152c, 0x2, 0x5c, 0x0, 0x80000000, 0xffffffff, 0x5, 0xfffffffc, 0xfedc, 0x8, 0x0, 0x1622, 0x800, 0x6, 0x29, 0x0, 0x4, 0x8, 0x30, 0x10000000, 0x20, 0x7, 0x4, 0x4, 0x85f, 0x1, 0xf4, 0x10, 0x4, 0x8, 0x5, 0x5, 0x401, 0x0, 0x4, 0x7, 0x7, 0x2, 0x8, 0x6, 0x3ff, 0x2, 0x80, 0x8001, 0x0, 0x9, 0x5325, 0x7e, 0x9, 0x4, 0xfffffff9, 0xa, 0x2, 0x1, 0xdf75, 0x0, 0x19acc522, 0x8000, 0x7b0, 0xae, 0x5, 0x7, 0x7, 0x6, 0x6, 0x9, 0x4, 0x0, 0x3, 0x9, 0x400, 0x5, 0xfffffff8, 0x6, 0x17, 0x7, 0x9, 0x8, 0x9, 0x4, 0x56, 0x2, 0x7, 0x38, 0x80000001, 0x1, 0x0, 0x862, 0x14000000, 0x6, 0x1, 0x2922c3b0, 0x4, 0x7, 0x2, 0x2, 0x4, 0x5, 0x4, 0x7, 0x2, 0xaa0, 0x8, 0x1, 0x3, 0x7, 0x8000, 0x5, 0x68e, 0x100, 0x9, 0xa, 0x40, 0x37ab, 0x800, 0x89, 0x5ac, 0x4, 0x8, 0x3, 0x8, 0x0, 0x7f, 0x81, 0x7, 0x5, 0x0, 0x8, 0x3, 0x8, 0xb3, 0x0, 0xb6e, 0x8948, 0x6f03, 0xfffffffa, 0xa, 0x7ff, 0x6, 0x401, 0x5401a1a2, 0xa, 0x0, 0xf509, 0x80, 0x200, 0x1d111234, 0x2, 0x100, 0x5, 0x6, 0xfffff801, 0x9, 0x3, 0x7, 0x9, 0x4, 0x4, 0x7, 0x0, 0xffffffff, 0x8, 0x1, 0x3, 0xffffffff, 0x753, 0x8d7e, 0x4, 0x1, 0x68, 0x7, 0x6, 0x6, 0x2, 0x7, 0xfffff249, 0xadf9, 0x2, 0x8, 0x80000001, 0x10000, 0x4, 0x7, 0x10000, 0x7, 0x7e, 0x3, 0x8, 0x80000001, 0x4, 0xffffffff, 0x4, 0x5, 0x7, 0x2, 0x7, 0x6c8, 0x2, 0x5, 0x8, 0x372, 0x9, 0x0, 0x9, 0xb, 0x8001, 0x15, 0x5, 0x10000, 0x80000000, 0x101, 0x3, 0x9, 0x4, 0xc694, 0x81, 0xf, 0x6, 0x8, 0x3ff, 0xaa1, 0x2, 0x104c, 0x5af, 0x0, 0x3ff, 0x6, 0x6, 0x3, 0xffff, 0x100, 0x8, 0x3, 0x2, 0x800, 0x0, 0x18a, 0x6, 0x2, 0x3, 0x7, 0xd, 0x4, 0xfffffffd, 0xca, 0x4, 0xb, 0xdd, 0x0, 0xfffeffff, 0xfffffff7, 0x8, 0x9, 0x833, 0x0, 0x4, 0x48b, 0xfffffffc, 0x6, 0x1000, 0x4, 0x10, 0x8, 0x4, 0xe5, 0x8a, 0x8, 0x5, 0x7, 0xaab, 0x2, 0x4, 0x3, 0x80000001, 0x10001, 0x7, 0x4, 0x0, 0x681a, 0x5, 0xb, 0x11, 0xb2fb, 0x10001, 0x9, 0x4, 0x6, 0x5, 0x1, 0x7, 0x6, 0x3d, 0x1, 0x8, 0x3, 0x5, 0xd5, 0x5, 0x43, 0x4, 0x4, 0x7, 0x630, 0xae, 0xa, 0x5, 0xff, 0x200000, 0x4, 0x80, 0x18, 0x0, 0x5, 0x4, 0x28, 0xfffff001, 0x3, 0x2, 0xa46d, 0x7, 0x1, 0x40, 0xfffffdc6, 0x3, 0x431d842a, 0x1, 0xffffffff, 0x2, 0xe, 0x1ca, 0x4, 0x2a4, 0x0, 0xc0, 0x3, 0x0, 0x2, 0xf, 0x6000000, 0x47fa, 0x1, 0x2, 0x10001, 0x61b, 0x8e, 0x8f0, 0x0, 0x3, 0x2, 0x9, 0xfffffff9, 0x2, 0x7, 0x0, 0x6, 0x6, 0x4, 0x8, 0x1, 0x1, 0x83, 0x9, 0x7, 0x2, 0x80, 0x6, 0xe, 0x3, 0x3, 0x8001, 0x3, 0x6, 0x3b40000, 0x6, 0x6, 0x4, 0x6, 0x3ff, 0x3da7d438, 0x1, 0x3b, 0xfffffff8, 0x3, 0x1, 0x5, 0x60000, 0x5, 0x1000, 0x101, 0x4, 0x0, 0x5, 0xd2, 0x84a0, 0x1cc, 0x1, 0x3, 0x7, 0xffffff5e, 0x10001, 0x3, 0x6, 0x1, 0xc, 0x8, 0xb, 0x1, 0x5, 0x0, 0x0, 0x101, 0x2, 0x7dec, 0x8, 0x8000, 0xfffffffa, 0xc99, 0x101, 0x7ff, 0x12000, 0x1c13a00, 0x8, 0x23fa5409, 0x9, 0x9, 0x5, 0x6, 0x9, 0x767, 0x8, 0x0, 0x8311, 0x6, 0x1, 0x40, 0x4, 0x3, 0x80000001, 0x8, 0x3, 0x8, 0x943, 0x4a21, 0x6, 0x400, 0x0, 0x6, 0x7, 0xb, 0x8000, 0x593b, 0xa, 0x10001, 0xffff, 0x0, 0x64, 0xfffffffd]}) write$FUSE_LSEEK(r4, &(0x7f0000000080)={0x18, 0xfffffffffffffff5, r5, {0xad6}}, 0x18) 1.189186457s ago: executing program 4 (id=5541): mkdir(&(0x7f0000000400)='./file0\x00', 0x18c) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x10, 0x0) pipe(&(0x7f0000000000)) pread64(r0, &(0x7f0000002280)=""/4096, 0x1000, 0xd33) 1.188840197s ago: executing program 4 (id=5542): r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) finit_module(r0, 0x0, 0x1) mprotect(&(0x7f0000020000/0x1000)=nil, 0x1000, 0x4) (async) mprotect(&(0x7f0000020000/0x1000)=nil, 0x1000, 0x4) setreuid(0xee00, 0x0) ioprio_get$uid(0x3, 0xee00) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000002000), r1) sendmsg$IEEE802154_ASSOCIATE_REQ(r1, &(0x7f0000002340)={0x0, 0x0, &(0x7f0000002300)={&(0x7f0000002280)={0x14, r2, 0x1, 0x70bd25, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4040041}, 0x2008844) socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/vmallocinfo\x00', 0x0, 0x0) ioctl$RTC_VL_CLR(r3, 0x7014) accept4(r3, 0x0, 0x0, 0xc00) (async) accept4(r3, 0x0, 0x0, 0xc00) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$MRT6_FLUSH(0xffffffffffffffff, 0x29, 0xd4, 0x0, 0x0) (async) setsockopt$MRT6_FLUSH(0xffffffffffffffff, 0x29, 0xd4, 0x0, 0x0) syz_open_dev$usbmon(&(0x7f0000000000), 0x46a, 0x4000) (async) syz_open_dev$usbmon(&(0x7f0000000000), 0x46a, 0x4000) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/devices\x00', 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x804000, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r4}}) socket$inet6(0xa, 0x2, 0x0) (async) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x41, &(0x7f0000000000)=0x2018, 0x4) (async) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x41, &(0x7f0000000000)=0x2018, 0x4) bind$inet6(r6, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r6, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) (async) sendto$inet6(r6, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) (async) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x5a7c3, 0x0) mprotect(&(0x7f00003c0000/0x2000)=nil, 0x2000, 0x2000004) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mincore(&(0x7f00001d2000/0x4000)=nil, 0x4000, &(0x7f0000000040)=""/216) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), r1) 1.071822729s ago: executing program 3 (id=5543): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a00, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8923, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$NLBL_CALIPSO_C_LIST(0xffffffffffffffff, 0x0, 0x4810) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(0xffffffffffffffff, 0x80286722, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_genetlink_get_family_id$nl80211(0x0, r3) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r4 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001580), 0x0, 0x0) listen(r4, 0x9) preadv2(r0, &(0x7f0000000580)=[{&(0x7f0000000000)=""/118, 0x76}, {0x0}, {0x0, 0xfe91}], 0x3, 0x9, 0xd, 0x9) 949.147212ms ago: executing program 4 (id=5544): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x18, 0x209, 0x100, 0x0, {0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x24008004}, 0x8054) clock_nanosleep(0x1, 0xfcfd, &(0x7f0000000000), 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200087fc, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) (async) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000a40), 0x40400, 0x0) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000a40), 0x40400, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000300)={0x70001, 0x0, [0x40000000000, 0x4, 0x4, 0x6, 0xfffffffffffffffc, 0x4, 0x4]}) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, &(0x7f0000000000)="f20f1c0166b864912c870f23c80f21f866350c0080000f23f80f01fc0f20e06635000010000f22e00f20c06635000000400f22c00f1c9700000f01c566b9a001000066b80400000066ba000000000f30c0dbb6660f3adf932700de", 0x54}], 0x1555555555555457, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r8, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r8, 0x0) copy_file_range(r4, &(0x7f0000000000)=0x8000000000000000, r3, 0x0, 0x101, 0x0) (async) copy_file_range(r4, &(0x7f0000000000)=0x8000000000000000, r3, 0x0, 0x101, 0x0) ioctl$TCFLSH(r2, 0x400455c8, 0x0) ioctl$sock_bt_hci(r1, 0x400448cb, &(0x7f0000000140)) (async) ioctl$sock_bt_hci(r1, 0x400448cb, &(0x7f0000000140)) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$TCFLSH(r2, 0x540b, 0x2) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x0, 0x3}) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x86040, 0x0) close_range(r10, r8, 0x0) (async) close_range(r10, r8, 0x0) r11 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r11, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) (async) setsockopt$XDP_UMEM_REG(r11, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r11, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) socket$inet6_udplite(0xa, 0x2, 0x88) 885.117193ms ago: executing program 3 (id=5545): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) socket$packet(0x11, 0x3, 0x300) bind$bt_sco(0xffffffffffffffff, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r6, 0x0) r7 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(r7, 0x4188aec6, &(0x7f0000000a40)={0x1, [{0x2, 0x0, 0x106, 0x0}, {0x2, 0x0, 0x2, 0x0}, {0x2, 0x0, 0x7ff, 0x0}, {0x1, 0x0, 0x912b, 0x0}, {0x2, 0x0, 0x3cb3, 0x0}, {0x3, 0x0, 0x3fe, 0x0}, {0x1, 0x0, 0x2, 0x0}, {0x3, 0x0, 0xfffffffe, 0x0}, {0x1, 0x0, 0xb, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x3, 0x0, 0x7, 0x0}, {0x60cf6ba5a5e3603a, 0x0, 0x0, 0x0}, {0x1, 0x0, 0x7ffffffb, 0x0}, {0x1, 0x0, 0x2005, 0x0}, {0x1, 0x0, 0x8001, 0x0}]}) close_range(r2, 0xffffffffffffffff, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4b, &(0x7f0000000040)=0x78, 0x4) socket$nl_xfrm(0x10, 0x3, 0x6) sendmmsg$inet6(r1, &(0x7f0000000c40)=[{{&(0x7f0000007c00)={0xa, 0x4e24, 0xfffffffe, @local, 0x5}, 0x1c, 0x0, 0x0, &(0x7f00000006c0)=[@pktinfo={{0x24, 0x29, 0x32, {@private1}}}], 0x28}}], 0x1, 0x20000084) r8 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f00000000c0)={'wg1\x00', &(0x7f0000000000)=@ethtool_cmd={0x9, 0x2, 0x3, 0x3ff, 0x3f, 0x7, 0x1, 0x3, 0x6, 0x3, 0x101, 0x142f, 0x8, 0x3, 0x0, 0xa, [0x4000000, 0xff]}}) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r9) r10 = socket$netlink(0x10, 0x3, 0xa) sendmsg$netlink(r10, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="1d0000003900010026bd7000ffdbdf25"], 0x10}], 0x1, 0x0, 0x0, 0x8000}, 0x4000800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000000, 0x8031, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_FROZEN_INFO(r0, 0xc00c620f, 0x0) 776.390415ms ago: executing program 4 (id=5547): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCXONC(r0, 0x540a, 0x0) mount(0x0, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x201020, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000100)=0xfffffffa, 0x4) syz_genetlink_get_family_id$tipc2(&(0x7f0000002580), r1) ioctl$TCFLSH(r0, 0x400455c8, 0x4) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_INPUT(r3, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964ded28f79c862e674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a9786cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25ade162ba3c91bb844aaf6fd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e57060", 0x1000}}, 0x1006) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) bind$bt_sco(0xffffffffffffffff, &(0x7f0000000280)={0x1f, @none}, 0x8) listen(0xffffffffffffffff, 0xb80) getsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, &(0x7f0000000040)=0x1, 0x0) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000180)=@urb_type_control={0x2, {}, 0x2000000b, 0xe0, 0x0, 0x0, 0x8, 0xc, 0x0, 0xffffff7d, 0x101, 0x0}) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000016c0)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022400010000"], 0x0) r4 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x181440) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000180)={0x0, 0x0, 0xffffffff}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r3, 0x0) lsm_get_self_attr(0x0, &(0x7f0000000340)={0x0, 0x0, 0xc6, 0xa6, ""/166}, &(0x7f0000000240)=0xc6, 0x4e6cacb0ca55f2b7) syz_usb_connect(0x2, 0xfffffffffffffe86, 0x0, 0x0) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) personality(0x5400004) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x4000000) fcntl$setstatus(r2, 0x4, 0x400) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e24, 0x4, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x1c) 628.442288ms ago: executing program 3 (id=5549): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000080)={0x8f, 0x0, 0x2}) (async) r3 = syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$x86(r3, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[@code={0xa, 0x6c, {"2e450fe0dfb805000000b9e2e3ffff0f01c10fc7b80050000066ba210066edc74424000d000000c7442402fdffff7fc7442406000000000f011c240f20c035000000800f22c066420f2900c4a3e144fe5e420f01cbc421ee586f00"}}], 0x6c}) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r4, 0x4068aea3, &(0x7f0000000140)={0xbe, 0x0, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r5, 0x0) recvmmsg(r5, &(0x7f0000001c80)=[{{0x0, 0x0, 0x0}, 0x800}], 0x1, 0xf0, 0x0) (async) ioctl$INCFS_IOC_PERMIT_FILL(r0, 0x40046721, &(0x7f0000000140)={r0}) (async) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x2}) (async) r6 = accept$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14) setsockopt$packet_int(r6, 0x107, 0x12, &(0x7f0000000100)=0x21, 0x4) 551.815449ms ago: executing program 7 (id=5550): r0 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) (async) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n\x9f\x04\x89<\xb7S\x7f\x1a\x88\xab$\xd3y\xc2\xe1\x99\xbch\xd3\x83\xcd\x7f\xc5n\xb1\xc1X \x90\xbb\x1f\x01\x90\xb1O\x8d\x7f\xa8\xd4\xdbO\xef\x99\xf3\xd1M\x0f\t\x7f\n,\x84\x1f\xfa\xe2\xc8\x99\x97Oq\xae\x9b\x86h\xfa3\xb9\xfd\xbb\xd4^\xc0t\xa7]Y\xe9\x7f[\x11\xb1\xf3m\x17F\x9d\x18\xe2\xe1\x01\xb6f=-?\xbcI\xf2\xd9\xc4>-\xc0E\x9a\x82\xcc7S\xd4\xb6\'\xd2DY\xa5\x83,\xd1\xbc\xc7\xf6\xe0\x1f o\x06\xc2t\x14\xc2\xe0\x92\xc1\x8a\x85>@\xc9\xb0% \xc7\x13l\x8bJ\xe5\xec\x1dE\xf5\xc5\xe2\xe3\x10G7r#\xbc\x95&\x14\x1e\x97\xce\x83>Q@\xfb\xeb=\x1e\xb3\xd5H\x02\x86\xc6\xf3\xe1i\\\x1d\xf4\xc1\xacJC+\xc8}\x1b{\x86\x17\x00\n\"\xec\xa5x\xe6\xb1i\xeb\xb3\xb7I\x90\x9eai\xde\x01\xdc\xfeA\x05Sn\xe6\xe8^\xdf\x8c`\x17\xca\xbd\\QG\xb15\x82*=\xbd\xe9\xaf\x12<\xd7\xe1$\xa4\xdaU\xfb^\xd8!\xacxy\xd5X\xef\x03\xa7\x10\xa1C#S~\x0f\x17\t>X\\mv0\x9eZ\x89\xf4\xae\a\xc8\x16\xd2o\x16\xf3X%Q\xbd\xe9\x86V\xf2\x99^0\xe8xI(\xde-\x04s\x15\x06#2\xef\xef@\xa3t0d^^\xad\xf6\xad\xe0\x16\xf6\xa8\x99!\x0e\x9d+;D&\xebN\x94\x12\x04\x95o\xd6\x9fl\xcb\x16gc\xf5(\xaa_\xec\x9aiE\f\xd4\xc6\xf2\xae\x85n\x995\xcd\xa7\xbb\xf0pz\xff\x0f\x00\x00\x00\x00\x00\x00Li\r\x95Z\x89\"_\xe4\xba\xd4\x93\xab\xe1\xb9\xd8E[\xbb\xc9.M+\xbe\x81N\xd2\xae\xf4\x18\xd0\xe7\x98\x90,\xce\ft\xc4\xc7\x02\xaa\xc7\xeb1;\x86b)\x12{k#c\x1d@\xc31\x00\xd2}f\x8cX\xce\xed\xa4\xe4\xca\x00\x00\x00\x00\x00\x03\xfcWZ!<\x16a5ZL.\xe6\x15]\xebY\xaa\xbea\x8e\xdc\xc52r\"\xea\x9e\x03\x11&\xc3JU\xa7\xd6\x8a\xf8\xae>S\xdew\x94\x01\x88K\xe6\x86\xaf)hW\xc8\\/Pl\x9b\x1b\xf2\xf1_\xbb\xaa\xc9?\xf7\xae\x13\xc2\f=\x059\x1c\xb7\x1ca\xe4\xb8C[\x06\x8c\f%l\x19I\x1fq9y)\xaf~~\xa8\xaf\'S\xf0kA\xa8\x93\x8a\xd3\x98\xbf[5\x0f\x05\"\xbd4h\xd9\xd4\xb8\x17P\xb4\xa7\xd6\x03\x86\xe6\xb0\x90W\xc3\xbd\xcb\x1er\xc4e\xc2\x96\r\x15\x84\xda\x16m\xc7\x19g\x83O\a=\xcb\'\xb7E\xc2\xd3L\xd5\xe5\xc2&L\xebjb\xfaOBc\x95\xb7\x97[\xcd$n\xbcO\x81\x03\xc3e:C&\"\x06B:\xa4\xe9\xab\x95DG(^\xd7\xb4\x8e5\x1a\xdb\xcf\x12\xccV\xb7\x98i\xfb\xadv\xb3', 0x0) write(r7, &(0x7f0000000140)='/', 0x1) sendfile(r7, r7, &(0x7f0000000040), 0xfec) write$UHID_INPUT(r6, &(0x7f00000001c0)={0xd, {"08c39ee52f329f1698b1c4865f8b0a0a5eee9f496a0809c3d21c25867b6edda88489ab4c09fe0a7f1e8640aa8e344f412df0d69475a5d6570e21f31fac7dfb4aa7ade0e851582d5c1abdd809580cb34c9e48576b1c73ed76013256fca058ada3db47d86cc75b33cf762b67fe61f152618c49a40858f68794a4fc484ab73ccd254ba3d147f5feddaf91dacc238c0a8096f79597ca1e6da781fcf37a0141a335c6a7577d2d53c6e552a7be208381bb31d1d3e0e92ea651655217535734b286d3f19780a4c720075a36a734151f8c00e651cb3a6bbe30e3f6aee48750436da6471e965e81f38134674fcb697108fb7345010bb8fa15fba9b33355d7858327171ab9c68f6c21b2ffbff4eb061dab80bc77a4a7769e7ff73bcd98790e09415bfc5978cf5af45c3ec9ef9c1a39f766c59d59590281038dbcb765580ba2b3f141d5bbfc40910a0894cd1f22d2a8b6d4e4778debef99438b54d44b4b7568de2777431a5b2f3e8d1a45a60a468f5e33e8ef534f803dfb6798c270f52edf031ecd996bb78c4e92961c63c079676d77412ebc6074e5f235417785e7a14b14ce7626b015071c154cc2bf8f4499b93293e9997c23df4c7a1498cf12414fb31eb873728e4f613b540d22e7ca718f18da5b82ed24995e4309c3af4a2e1097465bf09728082d09e71ea365522035eb9772b8e072f8454777ee304dacd59d3eb9f933f151fa14f8c38eadbeba04810a2dea7a66824f09235c13a45f07870210d0d310ce3ae6284577bd4e65f32700f6723727926cb52e4f27776a1dab0f6668327ab5cf1893879a635261f2e0d9923ccecbf5b80f10a8275c1515f47930d614e787f14c105d3a4f8faf8e7f738cf4eae4fc39ef3db3cb87794ace87f7239b69dc4ab4e5ae57cdfbd309e847d99600ef14b51faead01e8ade57d24270bc13a1787896096eeacb8ab1c93d31d93cfb244bb09ecfecf336362a5656db7df327cbb9aeb898f8af229c7bb9452805f2b4510c5df86b6d564e01f000000167ade5205331523a6392af2bea9e6db0ba5480cbf1b202714233289c4017cb66e83c0c8b6e88bedb922162d0ceecf6c5da173bbefe6781ab7720d2be6cca378db650c69d4228141ae190922fbbaddb86c7f0fe138b704e8305b3bcc7910b2280d96d71dafdbfa876b0013fc4de586f85d9ee077b6349becbdca8bd989a51c4c76ed8a8cc691a65078e0272a62edec8236a779f0cbffeda49dcdccd4def7064e0d77ae5a8c64f3057b4a3a0d4457d33f2bc6c112378315411baa4bb126fe540d750491fc58fbb66911ef82bce5ed76872dbcd8e05dea2f3f347a653aa39ab5d75e71671bfeb924e71476134dbf91e3f287fd853cc34bf81e717edd41aa04b6fbeb43cf2074f0c8fe5350401b6cff801c147a3b58b972aa5652629a9fd8b1df2852708ce958d4e9974ec4383aa5da4e3f75fdc85981e97b75863546f67a8703673b6fe2c26f0e9eeb8c45c26f673adac55fa5d69b82ae7d032fd3b26866047e8c029b90a62794a89c11398944b398b4177b2dcc5a743c16d4a5333b1e30af678d3db8df849c1753db067a6f94bab00c0dd3c7e94a8675924c89bda98ac09e10bcdf83f5114b9b466c413477a5cdc48c857230798934bcc1f0eb3a2d2944b139e459af32e515785f46ed4e97cdcb23c7e4dc7c4f91b5b5ca5228344aeb6652fffaf31325c7429bc70a5f6beaaa98ef190dffdeccc94bd814b3edfdd48243bf34291076ab5438ee00e924a827d5b453df42d24144fe1a45bb6c84fcbb2143d0a561c1e867c1279bdf0a47061ea77a84f36c720aff785f0db10eda84c767b5f3874f9455c0f026735ded32f0403ef7dbcf97d2233d59c670114ddf89314ba74fc248bcbdbf43c24e46304e229b3cf583aa410f4dfd119152495da8737518ee2a05a8ca1f004be3c551408f2e4013e444b63bf2bb26ddeae505642dffcc989ee241c48741181b506e22fdc4530319522780c74bf786852dc66ebbb51f8ecbb1e35de09ef7afe589bb8a31c5d63477db5d5e7174694ea04cfa98057d39127a4e5eedb4897a491c6693acd0a036abf846f3b6f3006e5e5fd586f29a4a8a31abbccf732e4f1b88187a72d669c16302657e9cbbeb9322662e111edc7771526400b6123d0f8207bcaa38bee07043e36e223d418ac948d65e7acfe72cc3fdcf03a3e43ecfec8ae489ddba09126709c5c7968829e3504de8a5010c9372de09476a7b96b04d7aed2486d8f89f21f075321abe350024abe00a81f87df3dc372fc3206496776c26b6958243070bda4cace3e358da5d39a3945765c2ba4b002b06efd416af66f3343f218ed84550ea83f02f9a5c3fc677ea60987aa25f0406d6154081cfdc074814a2465accdfa102858f5a52c9eae293c56ddcaf8f6926d3dd0ccb51a30c960d6b7e473038ebd3702b5106f6bc040efdfd7169fd3f2dc42ff23de26a239e13b74278729fd7e843b38a35c55fd50181ac13a9cbbbfd8feb36afaeb1993349c0ac5a0c44ffd92919dfe272b0f8ed7df7198cd299715f021109a58dced4753d3c7ddd6e9ea01596f18b2fe7000000004ccfca57aed5b5cebdff65de480a56bd53f4c7f83ddef00d7c9686311d1fce76f320bb3222a11db30ba6ed31535d8fda61e694478ca9935d72719b8d6b9be88ae3df30b60ee251b919b4d1734b994c62accdf855488b351738331b462eccf27efdc5577d7a5548579dc90d227a42ac010f33a720dc3cf0a63454f8b07c775287495761a058ec1e28e6aaf8057241f4ef8b5de56e279355bb66630c4ddf35e7c2cfff26a4241b1df0379d2a1e9f959e46d3843f89844ead50aff44640fcbc4a1edb033afff7cc9e57c4f8d31900764233e11fa4c28e547788c1b00de4268df692ba3415a9ad90fa712f9618f5ecff57da32809380eeff040cd3b23f508614c72b303cec3bcd732708303b166193366a062b9cea536f28478c387e626744c6a611a8e7162d274efccc84eee8eb31d3310c86752777dd5b5ffe234e895c54909f19a4aabcf3c15b90c02170409e314fd90e766ec4ba93c8ec6321237a980ad3c32fb2fab69e57541ea7f5427a85c2c57d40f9ebe9de5572f46a4713fb28e0af42d0adef3e29195aa41a3ba318181512eebfadffede4e35ff7f975928edc5d4d9f2d931fb44b30e1df55e66c52e1648e9cdaf71221b57c6a6b087428ccc57ade5b1531341cba2be452b426c434c70fd8c493337d4995cbd76ea1dd545226e3eb59d5f94ffb5352f87a4a66cd7c5e88322404fd397c46e198646a9c819d0eb1f10e54d8a3ea912f1cb134ff1095aa7325287f6ea9af8c13b67d6abcbb70dbc06838ecb33e45b60f6cb832c3e72d1401770f66bd02f35a2d007815ab676099e31f5102000000c0e83d5e7107c8dc5830c9cddb9781185b94d7f2814c5058ba3ac54c268741c5728f4997a9628602c2a36090162379f3f37c47619b3e7c7397a5913b7060b51e0c7f7226ff1135444f866f89a4b74136cbd3acb7178bd63183b3fd9cd19fdeb6fcc6341910ad4605da76a9af4bfb8b75fcd666f8188902b380ae560d9aa04f8f9b0ac5c109d1824a470726e06a49d955f8f71c8a86081e75b13f62600deb941da181eaff544cd559c467d8dae432debd22e7a7b3e1ad731a5b9470f5f60423dda061ff899c07c79f3da34f38e1d8182d6ee0c36c602945509167be440382a8a8a759b20e41638fd57152029b190b5701d30a86f579e2d0cc53a2f809ca9bd3aba1eb2772a7acc35c4d983afa83a9baea35c0ed4931234719636cf8f5fe1884bde6cebbdf23bd62b1ebf0a5cb78c27295349bd7d5cf28c4ee4689497238fd3aa71a417914e6892667a56bd69dc2e5882cfb67df71494e9a9199e025892e4e7435f727636cd988cc7563d28db5133f649849c5b3973a3428de10ad39d96146b22acc50f50eee5a038876452b960686892de40efe30081ccdaa2bf64af78d5988026e529b36c62a21378ac42d220d0dd878010178e374e6dbb2b61206066d04e729ed03c6fd9a4e00547fe9304aec0925d85a0acd07fdc5d48c1a1cff656916f5d25952327792255e0d606a32517781cc3d737ec753eb95b5b5b95dabd8946907ab54cc85d05b475e2e5486c6fc070417198d3a50910e2949d20d3fa68fd327934cff5171224942b8f18d88947763a7c710d09c4b269bdf2d3e715329917fb70728a4a0530999b755ba8fc04deabf4bc4bcffc4d62d491538c65078122bf2c263ae0020af67cfc9cf19e5b929e086af281fb43d5504d728935c5cfac136eb81703d50fddb39a5a713b2914c6acd9b2d07819cf7bba495ac5734fe423e611d309b80eeafcf9053d51b0ab3c29d5ca5eb8861ffc1ebc4d53f361b8991baecb52860c15202f979e34054fcde869d018103ccd6d914a70f1840fc6aaf426beec975ddb980b19b0f4cc2ca393c0b9e6ebe5e7d1c9fc1ef7a1c91378f0b73262993fb80667ecf62bac3c47cbd002ae1b87b8dc3ec99d5c987765d778868eb55022cc3bed14b8f934a584bcc98fa0b4f6e6982ab8d8a2bb49f9074ef429dd7b8db332a96ccec6983a97be7c8634c02e7937ffc8d613b83aa375886bf40a87ec062090382f874bf2c8e5fbb58ac18a46c4d9e85af3ca21bdacb7755f49776b0eb3972ff682c84beb07d74cbe2764e378253e72128991b73d2730704a5448280e8a0fd8cc87d4cddcffbfe5525ae3d2304877a3988e33c8e12bf77793e753f25840e9af2ce56bdb999fc62623a2298b4244534f662eb398a2577c72f6cfd5174697dcee151d4f3a7293b11de3889c43744da4165aca4e4a1e926d37ae4d7471584a06f3641f2037a74a58c2397a594f29d142d59f91bb57e24e1a3f30f68c626033cc34895c1b16d62e3a375c3e09f5dbd9338cd3a500643143cd404b57019c648c3ec31d696233fe16efc3c4c84aca0830ca8b9fbf1144b98d82f41e4cf67631c74cdcf8d9c8b8556b876ff1592683ccac0b47a26cb3a2cb1b917f433bb54e0b53deae9ac4b1cd0594c1fa0e6744e7ed88fdac60901e3da989f3b0d7c12b140cc576fa1b0e8e705321d37c303691aafc9fed9c3dc419078d0925ead56455ea5f3cd57941e410c1c14c2e8972d7cca44fcaca1f64fc817f4a41b6d9fb237fed159cb09e788ae560726537f49cb64b9f60915d402e0931355c55ad792cde758548b1af54b196e414046d4af3579a6c30ceac3d68bbfd2adef309c064e759a9f0dd69d682a3880b8ff27b69abffaa45ee7e65d8f1f6e40c188f6249fdf72220b4c87243217ba0292b9e9b67ebeda4fb83406216a4d765812bafeff34cc57f7d2cd1608282079c076055b9cabffe5fa491b970291bc2672540ccc15ed877d7dbe3ef683724c715ace770905e48c2dc6a44e1fc095773676d070eac00ee3834b07590cba7093f56b678313870471c81599d34c53fc03ec6c913d8ba3f604ace8da12d2025cbb5000bc062f4db65a6feacaf3915206d1c15ce7e78c17dc2ea32cb57d6fab0a22d487c77118e75016006f812541ec8180a321287a2d57248d4ee4a19706a19d802c70e250c3b0fc400a0b5cdc06537d2f55fd5300be4eeeaab8cc481a84b6a5e17d8c47ec92fe40710d4ec3530a94ca16710ade2ec7562398106e0ddbb6c8af6412166afd99d45d29a3a967e58decd0d6fc5bebb98d639b5606efd358a43d635d50f0ccb8472197da604994e7fb700243d5f7e45700", 0x1000}}, 0xffffff5c) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x28011, r0, 0xffffd000) 342.497673ms ago: executing program 3 (id=5554): madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x62) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) r1 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in6=@private1, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {0x5}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x33}, 0xfffffffd, 0x3c}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x2}, 0x0, 0x0, 0x0, 0xfd}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002bbd700004000000000000000000000000000000001a00016401010207000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0], 0xfc}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f00000003c0)={@ptr={0x70742a85, 0x2, 0x0, 0x0, 0x0, 0x26}, @flat=@weak_binder={0x77622a85, 0x1001, 0x2}, @fda={0x66646185, 0x2, 0x2, 0x6}}, &(0x7f0000000180)={0x0, 0x28, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f00000005c0)="2078b98d43d07572a4ac17e070f6e4ffd39036ed0af8f56f83f08868dc94aaa397e205bed98262b9477344a911603869d9f3f877f7aad1829f47273251843760bd7de0381b6c857784bb0ddc8246ff1e"}) 285.124675ms ago: executing program 7 (id=5555): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x181100, 0x0) mmap(&(0x7f0000feb000/0x4000)=nil, 0x4000, 0x0, 0x32, 0xffffffffffffffff, 0x8d03000) (async) capget(&(0x7f0000feaff9)={0x20071026}, &(0x7f0000000000)) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_trace_dev_match', 0x109000, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) (async) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 265.444895ms ago: executing program 7 (id=5556): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x8}, 0x0) syz_io_uring_setup(0x3b48, &(0x7f0000000280)={0x0, 0xc5ba, 0x1, 0x1, 0xc3}, 0x0, 0x0) sendto(r0, 0x0, 0x0, 0x880, 0x0, 0x0) (async) sendto(r0, 0x0, 0x0, 0x880, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) gettid() (async) gettid() r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0x24, 0x2e, 0x21, 0x0, 0x0, {0x19}, [@generic="a890bf6b68b722a6fbc30cf96f"]}, 0x24}}, 0x0) (async) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0x24, 0x2e, 0x21, 0x0, 0x0, {0x19}, [@generic="a890bf6b68b722a6fbc30cf96f"]}, 0x24}}, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet_tcp_int(r1, 0x6, 0x14, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r1, &(0x7f0000000300)={0x2, 0x0, @remote}, 0x10) sendto$inet(r1, &(0x7f0000000200)="e1", 0xfea8, 0x0, 0x0, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) r3 = getpid() syz_pidfd_open(r3, 0x0) (async) r4 = syz_pidfd_open(r3, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) 232.739625ms ago: executing program 3 (id=5557): r0 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r1, &(0x7f00000062c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000004200)={0x50, 0x0, r2, {0x7, 0x29, 0x0, 0x80000}}, 0x50) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1, 0x0) mount$9p_unix(&(0x7f0000000240)='./cgroup.cpu/cpuset.cpus\x00', &(0x7f0000000b40)='./file0\x00', 0x0, 0x12c9498, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000840)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000380), 0x12) r5 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') unshare(0x62040200) read$FUSE(r5, &(0x7f0000000ec0)={0x2020}, 0x2020) syz_fuse_handle_req(r1, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000785700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000160000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000eeffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000190000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010800", 0x2000, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)={0x20, 0x0, 0x3, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) setresuid(r7, r7, 0x0) fcntl$setlease(r0, 0x400, 0x0) mount$binderfs(0x0, 0x0, 0x0, 0x4800, 0x0) ioctl$BLKFINISHZONE(r6, 0x40101288, 0x0) 0s ago: executing program 7 (id=5558): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8923, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x2, 0x1, @mcast1, 0x9}, 0x1c) setsockopt$inet6_udp_int(r5, 0x11, 0x65, &(0x7f0000000100)=0xc851, 0x4) connect$pppl2tp(r4, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) writev(r2, &(0x7f0000000640)=[{&(0x7f0000000080)='v', 0x1}], 0x1) bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10) sendmmsg$inet(r3, &(0x7f0000004540)=[{{&(0x7f0000000040)={0x2, 0x4e22, @multicast1}, 0x10, 0x0}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)="15b26f226e2966667482d50703b0a8d92ccd9e69d5cc4cb3d467a670b237a9225fb56c0f7ea725dee27c4bb43bb50c6748c83b71d59f0537405dfab648c096607340fac939a2efd31cbe2f8ca29c409e87ea0974b7bceff9afef5dffd691575f5115f2f961ad488e3386036913e98181a6034febaab853a3e928b9035b0e3a8e1cb393c70f6d0448970e0af2476f8b923ee09c19deca55d58f70e8eeff55dda6381cb96afe97196c0af0a8fd450a1447a1a521e2c211fb84cbcf4aebd31298972ec6be", 0xc3}, {&(0x7f0000000d80)="7d68e6de85f9b0cbc9d710267f321ec64eab043ecad9af7e01e9463218ec45924a99867163e468d36a682fadd749caa325e685d75559a87139e02fae7271be8f55671cfd32a09896278d1941370174720838039d0989bc3394b8a4c4f4a30f0496be313d6d60fe47966c634a3ee1f659e8ef310647725bda0130d5de5028220a4cf5fc808a75694738ee26cb21302b4bba4265b845a5d5dce706d9820c6936b122f9658446d74a9016b94424971dd443a6907eb5c73b6b200e92b23f2c36a214729b0bc231511e4c", 0xc8}, {&(0x7f0000000380)="73fd71361e8d6c80ae1bc9953e2a4aeac7a314273066fc7f65a51969b46df1774bb0be94ccd4824f2d57ad2cd37242b1258402395481f9f07e067652e52aa8ccefcd0962ba0c48757b68d493f3ad702e65d4daa7dfc1605a173185472ae12470eea64c70ef4e64793b8a830447de0f423bef3964934eef4243cac42939ba6fa68d821b9373b5f3e2c26e7ca75ed8fb3203aef3a6637cecdd0251532b99537e02f604058f50e66c8a657d59beeed127695475f082d3d2b9790181fc987ad000ac00887d1506be89f388ecb405660b4ea196ee8f5a92b12ec43bbf49567db613d478ebe2358364f7600bf4f80ef4b2756fb13416c4fa22880cc96a03f07888575aedb001d5a74bb2f906797912b5ac080a0a3d361425f1a92ab03bbe65d5dcb235f43b5ad1162a16ebdc647baac013bf076945126cdd5a080853976a97ad55184601102fbb8df86b21aa8162858d74465c5fb7dc766602a3567f6eaf441f85ec50ca7fb3a4fdb450d1420531da25d01a412958a5e3895c59542238cf8e188e7fb5641eb24a5f1819bf8d2e9dd6c1d0e93564d723e311db9cd268bb1e477036e822b135cdbaf40f812aa7db01d22c829ab01ae24997dae96ddeed49e62d285701d5419e3f94a8b95790cf5a296ed15bffae1f71470c6a6eda872528844a2df42590d898630263cab5cccec57b7cea365ad8c91bfbe7cb419635ce6bf340a56115c0ad922b6fade9538e543bc5def2a85d35ab16d20c219c4733837be2c14ba4d3d32c3a6882ce6857626f55109b4cdcb634425d710bf3108f9b31b4af0cc17a58e49e871a56126dd8bed08e038ba64008587237b3442d28032e52fc9fae1a5784ba59d0edfa03d38352724903ed6f6970b3f4dfa6e40bf933b6765c6ee648174765f1e8ec71b80cac86abd065a3005b40a43a665707cc590997c5048183006a9dd8026d39def05950183b3d4f12f4e1644ef78cddac7c5569985c2c232bb350f28857675339e53f63a868704d2e0b38993dc57a02d3e297fc9a5b9384622841018c303a05bac25d509df5a2d0e3232927283fcc3ec67e4fa7b71d22f115cf693851dcceab4bce38cbfbb32829e211cdcb6a359e14fe416663541050d340aef2555dbd292bd9cbab8fcf20378149cc994569c2bc95fb33fd2d9321b8ac8e5160b02e202492f470eb719a8f2ac3a4be37ea0918b54b14789b7aa228d47f7b13fd9af608740c5a8fe02109a7cc0e555b22628ef790e513ecadfd338d30aed8ca219e64ee4fb0bd0e21e5101bf2072ffa071eb1aa0454caccc015ff1e166813f819a142b56a22e4ff387bb319288a0ef747c6fc8fdee3a0e193b0d086eb816e97e0322fcdaa30da61cd26ac9d8d0748fccd911ce0fd4adc953e9486e137fe66bc8aedfd5b78c562ebfc578ac9f96a453311766564541e16955e30b95914e9411a0b4cd95e0d8732d5ff7a4f921ef41d986a195334266585353b16b9449955523913a30c087532bcb899f733af3abea59baea174cf04359547a633b5f8a582ae3ef12a1d0125bef8c6e8c9fb589d3597c5ab3879491b0c5e3607203f06836a6805d3f7979c4325f9fecb2aceddedb272237132460cda812ef7d613a585898d59f92ef68ec95f12b47b440f6d899ecbfab48055e0c1605ba4cd9dbc17c4cbfec8a953ebbd38c45a6737a57ee58e21a20e530171137968ae4f0d0366cdb0b9d6a4667b011fcd7cd9e77364e5221989d8f0d80793260e748e3bd394849c090c744f6044328304cd6f02e941c5405647daffc1fd2f2864b37f92bbf4931c8e4a7c6bafd0ea79d39d330e70e6776bf6a926de227e5a43653bba04883e98d67bb64aa86e8bf271ba87604bc598e47f2992c7618ad25068860a481554b53352c7339de7e79c3bd1aed5bef8f398432858c888a5d8651969ea40eb3d486e9fe61d49b20500fdfd1548f567da970103d36730657c35d03d2c36b142665f62203b1fb12d616478cfef6f38b34cda87a634dd06d359f33e98b94a5e5b46b2a8d73126352d1d5b65af75055455cc903e384c41876fbdff935d047284d9d203b147a6ba0e9cb50beef7798886c33d2f2f0c0d9abe0e32c7c809f8b0b28fc59471987353c862a311776b8275bf319d5cb9a59f8f103b6e567ef5dd8859973cc3fe41e356bf5bd3186240e49286977eca36a8ad44185973b276cd7958b73e14a221b7fd567818bebf54ad27ee95161bd2aeeb356482ff467500a7d36f0464f58a591ec6b728f984ec78d0abe14c6d3411ac3ffc4c3179d1f95d029f26cceb545723519d3d4209a2b1243e78767273c13dc2bd320512674b6f1a50313bae7b9d16aebb476dbc829e8fd8dd46a1696efaff5795cf75de57c90f05ed9ef4a5cdfbf20d3d9ed95fb4114b1d5c9ade0856212e7ba330ce5bccf2c993dff89112b28bd3b17d3fcfacef7590f62bf948977dd79e2d8025946c80bf263e34035409b5ba1443d4929727180761bd56d258c3670a0aa4de21111fc3172367582de2d164ff3a18d0696b8dd8e5c1423b2ea1e2c0cfe141e4cf04f8cdaed48976b94c40d6a581300458661bbdbfeeb4969af6319eb1798843d0872f68f0c6537bbc9c7dd1e9b0564bf442d8d25f8aa884aba1df074d374f99750d9227bb821ba0355f60de2829a5c8cd47c89d29a2e3d7d53d59db5c3ace8f484664202c210c68a3b33076fb00d59938e84fbad6d6618c0bb89cf94035fa2de4da351e0d71df416450ea7ec3af33aa5c0313c63e654bd79c73b39dc1933636956761058d76648746daca469f8fce62c17a8160cdefc6a927eef9ec4a8dd684e46f35282546ce2362ab8afedd39bf699fd7c2cde538f52ea43c08558f42ba77b2986b800c45fa76a130b30919b3e1d504573e3c1e7dd2dc5d81379df53d736511f1da4ad8791e46adb27bb5c38129e89edda0aed99dcc03fe400f7d05d48e3e9e17744e8487f8ac464c86f7332211fb9799e9d27a6832d5f17ccd1a2da255f6da047e4728dd80860c04391bca4b7833f0346866401ec20033bcf6dfa85fd1520de5a03b4f9f6f5d2f8d7b6e7d7df1cbe5c05e23e080cf335639c94c48aaeb0bfebbe79530d67d35fb101c91839954c0e50dd4b90a86428b22b0be1e906fee30f68d7ce4bf9c68eafe695f07f5e4e4d473d77104b7b1b5dcfeb84e8c83624c0068d4e1cccfe740f8e5d5699603f8481ef2a1f2d4b8fd2314c5cb1985fe34cf8ede7d2e8bddea269422490903489c7f5951114d7ccb29a19455a987d538955712a460243105b25ccb6e6f34c370a6bbb234bee150dbcea5188e45305253f1014f7c0b5d60d517d2d05707f5ca9249a921d6c5307caf41deca0509b49102d801320db65c00f6e1c05fb8c2e1cc554673bf6168dd64086b19af28eec508fd0c304837e802173ac9947c4d73929c61d9632ab929a25f2a04350954612c2de705c1c25215284fe933fc8ccfd30ab3fc9ff5e04dd68d4720d95a29d6da176ac9d332c9ce77358f3c262777ea828fe6473638bc77be2aa586a3733e275744bc42c3742c1ad8f89d25c31958902f2f498c58fc85e9b78fb7a331734cb081cfa9ccfd262df927c0ff46983f8765af4add3532de2b91f2436df028", 0x9fd}], 0x3}}, {{0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)="c9", 0x1}], 0x300}}], 0x3, 0x240080e4) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000080), 0x0, &(0x7f0000000240)={[{@redirect_dir_off}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@metacopy_on}]}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x4) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r7, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x6c, 0x0, 0x0) ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000080)={0xc1, 0x0, 0x1}) kernel console output (not intermixed with test programs): TEXT_MGR already set [ 604.735797][T14636] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 604.742704][T14636] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 604.749545][T14636] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 604.756393][T14636] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 604.762844][T14636] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 604.769331][T14636] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 604.885142][ T331] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 604.900073][ T331] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 604.910483][ T331] usb 3-1: config 220 has no interface number 2 [ 604.916788][ T331] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 604.930062][ T331] usb 3-1: config 220 interface 0 has no altsetting 0 [ 604.936885][ T331] usb 3-1: config 220 interface 76 has no altsetting 0 [ 604.943768][ T331] usb 3-1: config 220 interface 1 has no altsetting 0 [ 604.952508][ T331] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 604.961621][ T331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.969964][ T331] usb 3-1: Product: syz [ 604.974194][ T331] usb 3-1: Manufacturer: syz [ 604.978810][ T331] usb 3-1: SerialNumber: syz [ 605.079605][T14650] netlink: 393 bytes leftover after parsing attributes in process `syz.8.4753'. [ 605.090666][T14651] netlink: 393 bytes leftover after parsing attributes in process `syz.8.4753'. [ 605.104016][ T10] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 605.120114][T14655] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=14655 comm=syz.8.4754 [ 605.192227][ T331] usb 3-1: selecting invalid altsetting 0 [ 605.198393][ T331] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 605.204850][ T331] usb 3-1: No valid video chain found. [ 605.212720][ T331] usb 3-1: USB disconnect, device number 13 [ 605.254131][ T10] usb 7-1: Using ep0 maxpacket: 8 [ 605.261881][ T10] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 605.271064][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 605.279378][ T10] usb 7-1: Product: syz [ 605.283613][ T10] usb 7-1: Manufacturer: syz [ 605.288321][ T10] usb 7-1: SerialNumber: syz [ 605.495621][ T10] usblp 7-1:1.0: usblp0: USB Unidirectional printer dev 16 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 605.758617][T14640] rust_binder: Write failure EFAULT in pid:220 [ 605.764589][ T65] usb 7-1: USB disconnect, device number 16 [ 605.792882][ T65] usblp0: removed [ 605.853043][T14667] bridge0: port 1(bridge_slave_0) entered blocking state [ 605.860350][T14667] bridge0: port 1(bridge_slave_0) entered disabled state [ 605.867851][T14667] bridge_slave_0: entered allmulticast mode [ 605.875604][T14667] bridge_slave_0: entered promiscuous mode [ 605.883613][T14667] bridge0: port 2(bridge_slave_1) entered blocking state [ 605.898291][T14667] bridge0: port 2(bridge_slave_1) entered disabled state [ 605.913681][T14667] bridge_slave_1: entered allmulticast mode [ 605.924656][T14674] loop5: detected capacity change from 0 to 16384 [ 605.931798][T14667] bridge_slave_1: entered promiscuous mode [ 606.074143][T14676] loop5: detected capacity change from 16384 to 0 [ 606.119249][ C1] blk_print_req_error: 9 callbacks suppressed [ 606.119288][ C1] I/O error, dev loop5, sector 5384 op 0x0:(READ) flags 0x80700 phys_seg 18 prio class 0 [ 606.171554][T14667] bridge0: port 2(bridge_slave_1) entered blocking state [ 606.178680][T14667] bridge0: port 2(bridge_slave_1) entered forwarding state [ 606.186025][T14667] bridge0: port 1(bridge_slave_0) entered blocking state [ 606.193094][T14667] bridge0: port 1(bridge_slave_0) entered forwarding state [ 606.248227][ T4824] bridge0: port 1(bridge_slave_0) entered disabled state [ 606.292940][ T4824] bridge0: port 2(bridge_slave_1) entered disabled state [ 606.295138][T14690] rust_binder: Write failure EFAULT in pid:223 [ 606.311135][ T4821] bridge0: port 1(bridge_slave_0) entered blocking state [ 606.324435][ T4821] bridge0: port 1(bridge_slave_0) entered forwarding state [ 606.363816][ T4824] bridge0: port 2(bridge_slave_1) entered blocking state [ 606.370929][ T4824] bridge0: port 2(bridge_slave_1) entered forwarding state [ 606.380082][T14694] FAT-fs (rnullb0): bogus number of reserved sectors [ 606.395888][T14694] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 606.455088][T14667] veth0_vlan: entered promiscuous mode [ 606.480964][T14667] veth1_macvtap: entered promiscuous mode [ 606.482581][T14704] fuse: Bad value for 'group_id' [ 606.492247][T14704] fuse: Bad value for 'group_id' [ 606.644083][ T65] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 606.729396][T14716] can0: slcan on ttyS3. [ 606.806749][ T65] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 606.815976][ T65] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 606.832471][ T65] usb 7-1: Product: syz [ 606.837501][ T65] usb 7-1: Manufacturer: syz [ 606.842174][ T65] usb 7-1: SerialNumber: syz [ 606.942185][T14718] can0 (unregistered): slcan off ttyS3. [ 606.995517][T14751] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:76 [ 608.018007][T14777] netlink: 104 bytes leftover after parsing attributes in process `syz.8.4781'. [ 608.037458][T14777] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4781'. [ 608.124082][ T331] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 608.276010][ T331] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 608.286454][ T331] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 608.296382][ T331] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 608.305695][ T331] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 608.313720][ T331] usb 3-1: SerialNumber: syz [ 608.416710][ T36] audit: type=1107 audit(4963.382:733): pid=14791 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 608.417190][ T36] audit: type=1107 audit(4963.382:734): pid=14791 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 608.531895][ T36] audit: type=1107 audit(4963.382:735): pid=14791 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 608.624782][ T331] usb 3-1: 0:2 : does not exist [ 608.644034][ T36] audit: type=1107 audit(4963.382:736): pid=14791 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 608.730588][ T331] usb 3-1: USB disconnect, device number 14 [ 608.852549][T14800] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14800 comm=syz.2.4787 [ 608.852916][ T8939] udevd[8939]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 608.906017][T14802] rust_binder: validate_parent_fixup: fixup_min_offset=57, parent_offset=37 [ 608.906062][T14802] rust_binder: Error while translating object. [ 608.915222][T14802] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 608.921456][T14802] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:56 [ 608.962164][T14804] binder: Unknown parameter '00000000000000000000' [ 609.149301][T14811] kvm: kvm [14810]: vcpu2, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x7 [ 609.160737][T14811] kvm: kvm [14810]: vcpu2, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x7 [ 609.311703][T14819] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4794'. [ 609.368222][ T65] usb 7-1: USB disconnect, device number 17 [ 609.410136][ T36] audit: type=1400 audit(4964.372:737): avc: denied { associate } for pid=14835 comm="syz.2.4799" name="cgroup" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 609.457966][T14840] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 1176, size: 18446744073709551614) [ 609.457990][T14840] rust_binder: Error while translating object. [ 609.470438][T14840] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 609.476885][T14840] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:104 [ 609.568744][ T36] audit: type=1400 audit(4964.532:738): avc: denied { listen } for pid=14843 comm="syz.6.4803" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 609.599412][T14850] netlink: 100 bytes leftover after parsing attributes in process `syz.7.4805'. [ 609.604092][ T332] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 609.731737][T14860] rust_binder: 14860 RLIMIT_NICE not set [ 609.740108][ T9] rust_binder: 14859: removing orphan mapping 0:1024 [ 609.770212][T14865] netlink: 'syz.2.4810': attribute type 4 has an invalid length. [ 609.780887][T14865] netlink: 'syz.2.4810': attribute type 4 has an invalid length. [ 609.796715][ T332] usb 9-1: config 0 interface 0 altsetting 185 endpoint 0x81 has invalid wMaxPacketSize 0 [ 609.808166][ T332] usb 9-1: config 0 interface 0 has no altsetting 0 [ 609.821953][ T332] usb 9-1: New USB device found, idVendor=0458, idProduct=0087, bcdDevice= 0.00 [ 609.842267][ T332] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.857934][ T332] usb 9-1: config 0 descriptor?? [ 609.872394][T14868] can0: slcan on ttyS3. [ 609.894984][T14871] rust_binder: 237: no such ref 5 [ 609.900085][T14871] rust_binder: Write failure EINVAL in pid:237 [ 609.908125][T14868] netlink: 'syz.2.4811': attribute type 46 has an invalid length. [ 609.943653][T14868] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4811'. [ 609.996714][T14879] ip6gretap0: mtu less than device minimum [ 610.031396][T14868] can0 (unregistered): slcan off ttyS3. [ 610.044602][T14887] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 610.044628][T14887] rust_binder: Read failure Err(EFAULT) in pid:808 [ 610.181344][T14900] pim6reg1: entered promiscuous mode [ 610.224814][T14900] pim6reg1: entered allmulticast mode [ 610.272900][ T332] kye 0003:0458:0087.0016: unbalanced collection at end of report description [ 610.292485][ T332] kye 0003:0458:0087.0016: parse failed [ 610.300010][ T332] kye 0003:0458:0087.0016: probe with driver kye failed with error -22 [ 610.474942][ T332] usb 9-1: USB disconnect, device number 11 [ 610.708842][T14933] rust_binder: Write failure EINVAL in pid:126 [ 610.884258][ T36] audit: type=1400 audit(4965.852:739): avc: denied { append } for pid=14947 comm="syz.6.4830" name="usbmon0" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 611.005927][T14958] binder: Unknown parameter '1844674407370955161501777777777777777777777' [ 611.114914][ T36] audit: type=1400 audit(4966.082:740): avc: denied { read } for pid=14963 comm="syz.6.4835" name="snapshot" dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 611.321287][T14989] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 611.321325][T14989] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:88 [ 611.410807][T14995] netlink: 'syz.8.4843': attribute type 4 has an invalid length. [ 611.445494][T14995] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14995 comm=syz.8.4843 [ 611.504029][ T65] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 611.573817][ T4819] Bluetooth: hci0: Frame reassembly failed (-84) [ 611.664047][ T65] usb 7-1: Using ep0 maxpacket: 16 [ 611.671000][ T65] usb 7-1: config 1 interface 0 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 32 [ 611.681824][ T65] usb 7-1: config 1 interface 0 has no altsetting 0 [ 611.689910][ T65] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 611.699392][ T65] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 611.707555][ T65] usb 7-1: Product: ㆣ꧜⬲饧갃諨俄꽽徾腩뎡ᯊ﯋淇ｽ쌬퓫咠陦閚鯓๬憷䔂찜錒寑缝묠牳푁犼⿐䍖➞鎒疢껀書鎈폐ઃ椋酦拷輁ʉ壛ࣇ傘毆ዾΆ乹麟ꄩ蜞䜫콲촡ᶏ떚ࡓ藶콥趩⹳᳓➅萆訷⒑띞垯ꁏ㏽멉ꉶ핯썮橷뻋嵜Ṉ搿ḝᛋꙴ옼ꭺ꺫ᐚ皾ॉꦶ㎍ꞁ [ 611.738798][ T65] usb 7-1: Manufacturer: చ [ 611.743471][ T65] usb 7-1: SerialNumber: 《 [ 611.750544][T14984] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 611.958765][T14984] rust_binder: Error while translating object. [ 611.958815][T14984] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 611.965255][T14984] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:287 [ 611.978215][ T65] usb 7-1: USB disconnect, device number 18 [ 612.514008][T15016] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 612.522201][T15016] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 612.531215][T15016] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 612.539429][T15016] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 612.794034][ T331] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 612.944069][ T331] usb 7-1: Using ep0 maxpacket: 16 [ 612.951806][ T331] usb 7-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 612.960983][ T331] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.969043][ T331] usb 7-1: Product: syz [ 612.973255][ T331] usb 7-1: Manufacturer: syz [ 612.977924][ T331] usb 7-1: SerialNumber: syz [ 612.985624][ T331] r8152-cfgselector 7-1: Unknown version 0x0000 [ 612.991945][ T331] r8152-cfgselector 7-1: config 0 descriptor?? [ 612.998976][ T331] hub 7-1:0.0: bad descriptor, ignoring hub [ 613.005080][ T331] hub 7-1:0.0: probe with driver hub failed with error -5 [ 613.205791][ T331] r8152-cfgselector 7-1: Unknown version 0x0000 [ 613.212202][ T331] r8152-cfgselector 7-1: bad CDC descriptors [ 613.450535][T15024] binder: Bad value for 'defcontext' [ 613.594009][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 613.594210][ T881] Bluetooth: hci0: command 0x1003 tx timeout [ 613.655408][T15035] rust_binder: 15034 RLIMIT_NICE not set [ 613.660922][ T9] rust_binder: 15033: removing orphan mapping 0:4208 [ 613.683682][T15038] rust_binder: Write failure EFAULT in pid:107 [ 613.794145][ T9] r8152-cfgselector 7-1: USB disconnect, device number 19 [ 613.824091][ T331] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 613.872080][T15054] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 613.881365][T15054] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 613.912141][T15053] rust_binder: Error in use_page_slow: ESRCH [ 613.912177][T15053] rust_binder: use_range failure ESRCH [ 613.924008][T15053] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 613.929534][T15053] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 613.944063][T15053] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:122 [ 613.973271][T15057] rust_binder: Write failure EFAULT in pid:296 [ 613.973707][T15058] rust_binder: Write failure EFAULT in pid:296 [ 613.988719][ T331] usb 3-1: Using ep0 maxpacket: 8 [ 614.014601][ T331] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 520 [ 614.032458][ T331] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 614.055737][ T331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.067855][T15061] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4869'. [ 614.068959][T15063] fuseblk: Unknown parameter 'default_permissions' [ 614.083928][ T331] usb 3-1: Product: syz [ 614.088887][ T331] usb 3-1: Manufacturer: syz [ 614.093717][ T331] usb 3-1: SerialNumber: syz [ 614.104066][T15061] netlink: 16 bytes leftover after parsing attributes in process `syz.7.4869'. [ 614.104200][T15063] fuseblk: Unknown parameter 'default_permissions' [ 614.121149][T15030] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 614.134114][T15061] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4869'. [ 614.145276][T15061] netlink: 16 bytes leftover after parsing attributes in process `syz.7.4869'. [ 614.154916][T15062] rust_binder: 299: no such ref 0 [ 614.160259][T15062] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 614.160488][T15063] fuseblk: Unknown parameter 'default_permissions' [ 614.167905][T15062] rust_binder: 299: no such ref 0 [ 614.332608][ T331] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 15 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 614.545337][T15030] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4856'. [ 614.725429][ T9] usb 3-1: USB disconnect, device number 15 [ 614.734839][ T9] usblp0: removed [ 614.742889][T15089] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 614.743021][T15089] rust_binder: Failed to allocate buffer. len:1160, is_oneway:false [ 614.874016][ T332] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 615.024035][ T332] usb 7-1: device descriptor read/64, error -71 [ 615.264207][ T332] usb 7-1: device descriptor read/64, error -71 [ 615.514088][ T332] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 615.644068][ T332] usb 7-1: device descriptor read/64, error -71 [ 615.844285][ T36] audit: type=1400 audit(4970.812:741): avc: denied { validate_trans } for pid=15108 comm="syz.8.4883" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 615.894033][ T332] usb 7-1: device descriptor read/64, error -71 [ 616.004167][ T332] usb usb7-port1: attempt power cycle [ 616.344037][ T332] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 616.365008][ T332] usb 7-1: device descriptor read/8, error -71 [ 616.495161][ T332] usb 7-1: device descriptor read/8, error -71 [ 616.587906][T15113] rust_binder: Error while translating object. [ 616.587943][T15113] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 616.594197][T15113] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:150 [ 616.639672][T15117] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 616.648984][T15117] rust_binder: Read failure Err(EFAULT) in pid:154 [ 616.744090][ T332] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 616.775069][ T332] usb 7-1: device descriptor read/8, error -71 [ 616.894055][ T331] usb 9-1: new full-speed USB device number 12 using dummy_hcd [ 616.915033][ T332] usb 7-1: device descriptor read/8, error -71 [ 617.024175][ T332] usb usb7-port1: unable to enumerate USB device [ 617.045182][ T331] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 617.056286][ T331] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 617.066109][ T331] usb 9-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 617.075211][ T331] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 617.084041][ T331] usb 9-1: config 0 descriptor?? [ 617.243440][T15119] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 617.354044][ T881] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 617.354110][ T54] Bluetooth: hci0: command 0x1003 tx timeout [ 617.422798][T15121] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4888'. [ 617.432583][T15121] EXT4-fs: Ignoring removed check option [ 617.438475][T15121] No source specified [ 617.461016][T15124] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 617.491404][ T331] isku 0003:1E7D:319C.0017: unknown main item tag 0x0 [ 617.505239][ T331] isku 0003:1E7D:319C.0017: unknown main item tag 0x0 [ 617.512226][ T331] isku 0003:1E7D:319C.0017: unknown main item tag 0x0 [ 617.519080][ T331] isku 0003:1E7D:319C.0017: unknown main item tag 0x0 [ 617.525911][ T331] isku 0003:1E7D:319C.0017: unknown main item tag 0x0 [ 617.532716][ T331] isku 0003:1E7D:319C.0017: unknown main item tag 0x0 [ 617.539575][ T331] isku 0003:1E7D:319C.0017: unknown main item tag 0x0 [ 617.547138][ T331] isku 0003:1E7D:319C.0017: hidraw0: USB HID v0.00 Device [HID 1e7d:319c] on usb-dummy_hcd.8-1/input0 [ 617.905155][T15145] rust_binder: Write failure EFAULT in pid:163 [ 617.944157][T15149] kvm: user requested TSC rate below hardware speed [ 617.976577][ T331] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 617.984338][T15147] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 618.124307][ T520] usb 9-1: USB disconnect, device number 12 [ 618.159877][ T331] usb 7-1: config 220 has an invalid interface number: 76 but max is 2 [ 618.171074][ T331] usb 7-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 618.180349][ T331] usb 7-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 618.190929][ T331] usb 7-1: config 220 has no interface number 2 [ 618.197506][ T331] usb 7-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 618.224043][ T331] usb 7-1: config 220 interface 0 has no altsetting 0 [ 618.231057][ T331] usb 7-1: config 220 interface 76 has no altsetting 0 [ 618.244005][ T331] usb 7-1: config 220 interface 1 has no altsetting 0 [ 618.252558][ T331] usb 7-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 618.261979][ T331] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.270251][ T331] usb 7-1: Product: syz [ 618.274751][ T331] usb 7-1: Manufacturer: syz [ 618.279383][ T331] usb 7-1: SerialNumber: syz [ 618.402799][T15156] rust_binder: Error in use_page_slow: ESRCH [ 618.402830][T15156] rust_binder: use_range failure ESRCH [ 618.410009][T15156] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 618.414426][T15158] rust_binder: Failed to allocate buffer. len:8815263377109862608, is_oneway:false [ 618.415794][T15156] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 618.423617][T15158] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 618.433134][T15156] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:175 [ 618.442222][T15158] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:158 [ 618.557380][ T331] usb 7-1: Found UVC 7.01 device syz (8086:0b07) [ 618.574603][ T331] usb 7-1: No valid video chain found. [ 618.580175][ T331] usb 7-1: selecting invalid altsetting 0 [ 618.582032][T15167] netlink: 1363 bytes leftover after parsing attributes in process `syz.8.4902'. [ 618.595769][T15168] netlink: 1363 bytes leftover after parsing attributes in process `syz.8.4902'. [ 618.596470][ T331] usb 7-1: USB disconnect, device number 24 [ 618.762237][T15176] overlay: ./file0 is not a directory [ 618.795871][T15178] netlink: 'syz.2.4907': attribute type 28 has an invalid length. [ 618.899951][T15188] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=15188 comm=syz.8.4910 [ 618.913890][T15188] rust_binder: Error while translating object. [ 618.914139][T15188] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 618.921881][T15188] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:167 [ 618.952120][T15192] netlink: 'syz.8.4912': attribute type 13 has an invalid length. [ 619.068995][T15196] netlink: 'syz.8.4915': attribute type 32 has an invalid length. [ 619.107222][ T36] audit: type=1400 audit(4974.072:742): avc: denied { write } for pid=15202 comm="syz.6.4916" dev="9p" ino=7016996765293437283 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 [ 619.129763][T15205] tmpfs: Unknown parameter '' [ 619.142846][ T36] audit: type=1400 audit(4974.072:743): avc: denied { open } for pid=15202 comm="syz.6.4916" path="/104/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="9p" ino=7016996765293437283 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 [ 619.143891][T15211] __vm_enough_memory: pid: 15211, comm: syz.2.4914, bytes: 18014402804453376 not enough memory for the allocation [ 619.374037][ T9] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 619.454014][ T685] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 619.524030][ T9] usb 9-1: Using ep0 maxpacket: 16 [ 619.530520][ T9] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 619.541834][ T9] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 619.554679][ T9] usb 9-1: New USB device found, idVendor=046d, idProduct=c51b, bcdDevice= 0.00 [ 619.563731][ T9] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 619.572618][ T9] usb 9-1: config 0 descriptor?? [ 619.605226][ T685] usb 7-1: too many endpoints for config 1 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 619.616267][ T685] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 1056, setting to 1024 [ 619.627347][ T685] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 619.637350][ T685] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 619.651812][ T685] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 619.660925][ T685] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 619.668983][ T685] usb 7-1: Product: syz [ 619.673186][ T685] usb 7-1: Manufacturer: syz [ 619.677822][ T685] usb 7-1: SerialNumber: syz [ 619.683509][T15213] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 619.898238][ T685] usb 7-1: USB disconnect, device number 25 [ 619.978384][T15218] rust_binder: Error in use_page_slow: ESRCH [ 619.978407][T15218] rust_binder: use_range failure ESRCH [ 619.987433][T15218] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 619.992987][T15218] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 620.002460][T15218] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:331 [ 620.037631][T15222] rust_binder: Error while translating object. [ 620.037650][T15223] rust_binder: Error while translating object. [ 620.037677][T15223] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 620.047107][T15222] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 620.053405][T15223] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:207 [ 620.078082][T15222] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:207 [ 620.176648][T15229] overlay: Unknown parameter 'appraise' [ 620.236978][T15232] rust_binder: 214: no such ref 0 [ 620.242074][T15232] rust_binder: 214: no such ref 0 [ 620.248135][T15233] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:333 [ 620.248571][T15233] overlay: Unknown parameter 'appraise' [ 620.269601][ T9] rust_binder: 15228: removing orphan mapping 0:24 [ 620.304741][T15239] erofs: (device rnullb0): erofs_read_superblock: cannot find valid erofs superblock [ 620.337704][T15241] __vm_enough_memory: pid: 15241, comm: syz.6.4928, bytes: 18014402804453376 not enough memory for the allocation [ 620.368618][T15243] rust_binder: 15243 RLIMIT_NICE not set [ 620.374951][ T9] rust_binder: 15242: removing orphan mapping 0:1048 [ 620.422710][T15247] pim6reg1: entered promiscuous mode [ 620.428202][T15247] pim6reg1: entered allmulticast mode [ 620.611267][T15269] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found [ 620.619712][T15269] rust_binder: Write failure EINVAL in pid:851 [ 620.623559][T15263] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 620.632316][T15263] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:355 [ 620.641981][ T36] audit: type=1400 audit(4975.602:744): avc: denied { mounton } for pid=15273 comm="syz.7.4939" path="/280/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 620.760547][T15283] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 620.769346][T15283] rust_binder: Read failure Err(EAGAIN) in pid:865 [ 620.776080][T15283] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:865 [ 620.806727][T15285] rust_binder: Write failure EFAULT in pid:867 [ 620.833181][T15291] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 620.908906][T15295] pim6reg1: entered promiscuous mode [ 620.920798][T15295] pim6reg1: entered allmulticast mode [ 621.025468][T15297] netlink: 'syz.7.4947': attribute type 4 has an invalid length. [ 621.344029][ T685] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 621.372816][ T36] audit: type=1400 audit(4976.332:745): avc: denied { setattr } for pid=15307 comm="syz.6.4952" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 621.394356][ T36] audit: type=1400 audit(4976.362:746): avc: denied { write } for pid=15307 comm="syz.6.4952" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 621.495055][ T685] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 621.506101][ T685] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 621.516303][ T685] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 621.529239][ T685] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 621.538324][ T685] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.547036][ T685] usb 3-1: config 0 descriptor?? [ 621.954767][ T685] plantronics 0003:047F:FFFF.0019: No inputs registered, leaving [ 621.967594][ T685] plantronics 0003:047F:FFFF.0019: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 622.114110][ T331] usb 9-1: USB disconnect, device number 13 [ 622.159468][T15316] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:182 [ 622.173843][T15318] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:185 [ 622.214766][T15300] rust_binder: Write failure EFAULT in pid:217 [ 622.433869][T15340] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 1 [ 622.448388][T15340] rust_binder: Write failure EINVAL in pid:370 [ 622.558787][T15345] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4966'. [ 622.584015][ T331] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 622.744013][ T331] usb 9-1: Using ep0 maxpacket: 8 [ 622.751638][ T331] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 622.760788][ T331] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 622.768918][ T331] usb 9-1: Product: syz [ 622.773098][ T331] usb 9-1: Manufacturer: syz [ 622.777916][ T331] usb 9-1: SerialNumber: syz [ 622.984788][ T331] usblp 9-1:1.0: usblp0: USB Unidirectional printer dev 14 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 623.237818][ T65] usb 9-1: USB disconnect, device number 14 [ 623.245714][ T65] usblp0: removed [ 623.384034][ T331] usb 3-1: reset high-speed USB device number 16 using dummy_hcd [ 623.475516][T15355] rust_binder: 384: no such ref 1 [ 624.177890][T15367] loop7: detected capacity change from 0 to 16384 [ 624.305015][T15378] 9pnet_fd: Insufficient options for proto=fd [ 624.312516][T15378] SELinux: Context system_u:object_r:dlm_control_device_t:s0 is not valid (left unmapped). [ 624.314085][ T36] audit: type=1400 audit(4979.272:747): avc: denied { relabelfrom } for pid=15377 comm="syz.7.4976" name="L2CAP" dev="sockfs" ino=70096 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 624.347207][ T36] audit: type=1400 audit(4979.282:748): avc: denied { relabelto } for pid=15377 comm="syz.7.4976" name="L2CAP" dev="sockfs" ino=70096 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=bluetooth_socket permissive=1 trawcon="system_u:object_r:dlm_control_device_t:s0" [ 624.387351][T15382] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 624.387449][T15382] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 624.394212][T15382] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 624.402916][T15382] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:901 [ 624.415228][T15382] rust_binder: Read failure Err(EAGAIN) in pid:901 [ 624.834484][ T520] usb 3-1: USB disconnect, device number 16 [ 625.014810][T15406] overlay: ./file0 is not a directory [ 625.046649][T15408] netlink: 'syz.2.4986': attribute type 2 has an invalid length. [ 625.055612][T15408] netlink: 1 bytes leftover after parsing attributes in process `syz.2.4986'. [ 625.188617][ T36] audit: type=1326 audit(4980.152:749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15379 comm="syz.6.4977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4691b8eba9 code=0x7fc00000 [ 625.214097][ T36] audit: type=1326 audit(4980.152:750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15379 comm="syz.6.4977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4691b8eba9 code=0x7fc00000 [ 625.417194][ T36] audit: type=1400 audit(4980.382:751): avc: denied { write } for pid=15434 comm="syz.8.4996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 625.484042][ T685] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 625.569671][T15447] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 112, limit: 136, size: 247) [ 625.569694][T15447] rust_binder: Error while translating object. [ 625.580438][T15447] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 625.593947][T15447] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:219 [ 625.606708][T15447] rust_binder: 219: no such ref 1 [ 625.634036][ T685] usb 7-1: Using ep0 maxpacket: 8 [ 625.640150][ T685] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 625.650341][ T685] usb 7-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 625.664737][ T685] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 625.673896][ T685] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.685167][ T685] usb 7-1: Product: syz [ 625.689380][ T685] usb 7-1: Manufacturer: syz [ 625.697191][ T685] usb 7-1: SerialNumber: syz [ 625.829374][T15460] rust_binder: got new transaction with bad transaction stack [ 625.829400][T15460] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:232 [ 625.869096][T15465] binder: Bad value for 'stats' [ 625.908764][ T520] hid-generic 0000:0000:0000.001A: unknown main item tag 0x0 [ 625.916948][ T520] hid-generic 0000:0000:0000.001A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 626.073116][T15477] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 134217728 [ 626.091688][T15477] rust_binder: Write failure EINVAL in pid:244 [ 626.125985][T15482] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 626.268524][T15493] rust_binder: Failed to allocate buffer. len:4248, is_oneway:true [ 626.268570][T15493] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 626.287212][T15493] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:242 [ 626.300784][T15490] rust_binder: Error in use_page_slow: ESRCH [ 626.301111][T15493] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 626.310440][T15490] rust_binder: use_range failure ESRCH [ 626.324086][T15493] rust_binder: Read failure Err(EFAULT) in pid:242 [ 626.330952][T15490] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 626.345094][T15490] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 626.362424][T15490] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:253 [ 626.430059][ T36] audit: type=1326 audit(4981.392:752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15498 comm="syz.8.5016" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7efc7858eba9 code=0x0 [ 626.477821][T15502] 9pnet_fd: Insufficient options for proto=fd [ 626.549201][T15508] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5019'. [ 626.647574][ T4821] Bluetooth: hci0: Frame reassembly failed (-84) [ 626.654858][ T4821] Bluetooth: hci0: Frame reassembly failed (-84) [ 627.554026][ T332] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 627.684008][ T332] usb 9-1: device descriptor read/64, error -71 [ 627.924030][ T332] usb 9-1: device descriptor read/64, error -71 [ 628.164087][ T332] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 628.243729][ T331] usb 7-1: USB disconnect, device number 26 [ 628.282454][T15532] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 628.299345][T15532] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 628.306718][ T332] usb 9-1: device descriptor read/64, error -71 [ 628.400250][T15546] bridge0: port 2(bridge_slave_1) entered disabled state [ 628.407491][T15546] bridge0: port 1(bridge_slave_0) entered disabled state [ 628.415018][T15546] bridge0: entered promiscuous mode [ 628.420488][T15546] bridge0: entered allmulticast mode [ 628.564005][ T332] usb 9-1: device descriptor read/64, error -71 [ 628.664022][ T685] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 628.674210][ T332] usb usb9-port1: attempt power cycle [ 628.716246][ T881] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 628.813992][ T685] usb 3-1: Using ep0 maxpacket: 8 [ 628.820072][ T685] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 628.830409][ T685] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 628.839366][ T685] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 628.849200][ T685] usb 3-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 628.858275][ T685] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 628.868396][ T685] hub 3-1:1.0: bad descriptor, ignoring hub [ 628.874396][ T685] hub 3-1:1.0: probe with driver hub failed with error -5 [ 628.881718][ T685] cdc_wdm 3-1:1.0: skipping garbage [ 628.886972][ T685] cdc_wdm 3-1:1.0: skipping garbage [ 628.892268][ T685] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 629.014026][ T332] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 629.035021][ T332] usb 9-1: device descriptor read/8, error -71 [ 629.069752][ T36] audit: type=1400 audit(4984.032:753): avc: denied { ioctl } for pid=15545 comm="syz.2.5030" path="/dev/cpu/0/msr" dev="devtmpfs" ino=16 ioctlcmd=0x63a0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 629.094510][T15546] bridge0: port 2(bridge_slave_1) entered blocking state [ 629.101606][T15546] bridge0: port 2(bridge_slave_1) entered forwarding state [ 629.109066][T15546] bridge0: port 1(bridge_slave_0) entered blocking state [ 629.116168][T15546] bridge0: port 1(bridge_slave_0) entered forwarding state [ 629.124747][T15546] __vm_enough_memory: pid: 15546, comm: syz.2.5030, bytes: 18014402804453376 not enough memory for the allocation [ 629.165278][ T332] usb 9-1: device descriptor read/8, error -71 [ 629.244117][ T331] usb 3-1: USB disconnect, device number 17 [ 629.260705][ T36] audit: type=1400 audit(4984.222:754): avc: denied { ioctl } for pid=15548 comm="syz.7.5031" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 ioctlcmd=0xf50c scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 629.296066][T15554] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5032'. [ 629.424022][ T332] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 629.445081][ T332] usb 9-1: device descriptor read/8, error -71 [ 629.575055][ T332] usb 9-1: device descriptor read/8, error -71 [ 629.684159][ T332] usb usb9-port1: unable to enumerate USB device [ 629.914294][ T520] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 630.044057][ T520] usb 3-1: device descriptor read/64, error -71 [ 630.284177][ T520] usb 3-1: device descriptor read/64, error -71 [ 630.341554][T15573] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 630.394168][ T54] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 630.405107][ T881] Bluetooth: hci1: command 0x1003 tx timeout [ 630.534066][ T520] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 630.664034][ T520] usb 3-1: device descriptor read/64, error -71 [ 630.714034][ T9] usb 9-1: new full-speed USB device number 19 using dummy_hcd [ 630.864833][ T9] usb 9-1: not running at top speed; connect to a high speed hub [ 630.873356][ T9] usb 9-1: config 95 has an invalid interface number: 1 but max is 0 [ 630.881709][ T9] usb 9-1: config 95 has no interface number 0 [ 630.888370][ T9] usb 9-1: config 95 interface 1 has no altsetting 0 [ 630.896556][ T9] usb 9-1: New USB device found, idVendor=0763, idProduct=2030, bcdDevice=79.79 [ 630.905682][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 630.913697][ T9] usb 9-1: Product: syz [ 630.917928][ T520] usb 3-1: device descriptor read/64, error -71 [ 630.924273][ T9] usb 9-1: Manufacturer: syz [ 630.928898][ T9] usb 9-1: SerialNumber: syz [ 631.034126][ T520] usb usb3-port1: attempt power cycle [ 631.347598][ T9] usb 9-1: USB disconnect, device number 19 [ 631.363089][ T8939] udevd[8939]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:95.1/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 631.379746][ T520] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 631.405110][ T520] usb 3-1: device descriptor read/8, error -71 [ 631.535424][ T520] usb 3-1: device descriptor read/8, error -71 [ 631.774086][ T520] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 631.795623][ T520] usb 3-1: device descriptor read/8, error -71 [ 631.925888][ T520] usb 3-1: device descriptor read/8, error -71 [ 631.959670][T15586] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 631.968982][T15585] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 632.034165][ T520] usb usb3-port1: unable to enumerate USB device [ 632.244040][ T9] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 632.394035][ T9] usb 7-1: Using ep0 maxpacket: 8 [ 632.400703][ T9] usb 7-1: unable to get BOS descriptor or descriptor too short [ 632.409203][ T9] usb 7-1: config 1 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 632.422190][ T9] usb 7-1: config 1 interface 0 has no altsetting 0 [ 632.430316][ T9] usb 7-1: New USB device found, idVendor=06cb, idProduct=73f4, bcdDevice= 0.40 [ 632.439595][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 632.447668][ T9] usb 7-1: Product: syz [ 632.451935][ T9] usb 7-1: Manufacturer: syz [ 632.456630][ T9] usb 7-1: SerialNumber: syz [ 632.619859][T15594] rust_binder: 15593 RLIMIT_NICE not set [ 632.672444][T15594] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:275 [ 632.679227][ T36] audit: type=1326 audit(4987.642:755): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15592 comm="syz.8.5044" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7efc7858eba9 code=0x0 [ 632.718743][ T4821] Bluetooth: hci0: Frame reassembly failed (-84) [ 632.734103][ T4821] Bluetooth: hci0: Frame reassembly failed (-84) [ 632.884978][ T36] audit: type=1400 audit(4987.852:756): avc: denied { ioctl } for pid=15603 comm="syz.2.5047" path="/dev/usbmon0" dev="devtmpfs" ino=90 ioctlcmd=0x9201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 632.925583][T15606] binder: Unknown parameter '000000000000000000000050x0000000000000005' [ 632.925581][T15607] binder: Unknown parameter '000000000000000000000050x0000000000000005' [ 633.150321][T15625] FAT-fs (rnullb0): bogus number of reserved sectors [ 633.157118][T15625] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 633.177653][T15628] binder: Bad value for 'max' [ 633.278566][T15630] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 633.283863][T15633] rust_binder: Error while translating object. [ 633.291019][T15633] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 633.297990][T15633] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:965 [ 633.334889][T15642] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 633.346691][T15642] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 633.384072][ T36] audit: type=1400 audit(4988.342:757): avc: denied { mounton } for pid=15643 comm="syz.7.5060" path="/dev/snd/timer" dev="devtmpfs" ino=206 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sound_device_t tclass=chr_file permissive=1 [ 633.414114][T15644] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5060'. [ 633.427872][ T685] rust_binder: 0: removing orphan mapping 0:24 [ 633.437545][T15650] rust_binder: Write failure EFAULT in pid:279 [ 633.505756][T15657] binder: Bad value for 'stats' [ 633.739411][T15665] 9p: Unknown access argument : -22 [ 633.839717][T15669] netlink: 140 bytes leftover after parsing attributes in process `syz.7.5069'. [ 634.039298][T15673] xt_NFQUEUE: number of total queues is 0 [ 634.053784][T15673] tipc: Enabling of bearer rejected, media not registered [ 634.276888][T15696] netlink: 'syz.8.5077': attribute type 4 has an invalid length. [ 634.781558][T15719] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 634.791981][T15719] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 634.794024][ T881] Bluetooth: hci0: command 0x1003 tx timeout [ 634.800435][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 634.813184][T15719] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 634.822047][T15719] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 634.831807][ T9] usbhid 7-1:1.0: can't add hid device: -22 [ 634.838053][ T9] usbhid 7-1:1.0: probe with driver usbhid failed with error -22 [ 634.855696][ T9] usb 7-1: USB disconnect, device number 27 [ 634.870334][T15722] 9pnet_fd: Insufficient options for proto=fd [ 635.144069][ T520] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 635.294016][ T520] usb 3-1: Using ep0 maxpacket: 8 [ 635.300597][ T520] usb 3-1: unable to get BOS descriptor or descriptor too short [ 635.309245][ T520] usb 3-1: config 6 has an invalid interface number: 248 but max is 0 [ 635.317488][ T520] usb 3-1: config 6 has no interface number 0 [ 635.323629][ T520] usb 3-1: config 6 interface 248 has no altsetting 0 [ 635.332032][ T520] usb 3-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 635.344177][ T520] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 635.352337][ T520] usb 3-1: Product: syz [ 635.357871][ T520] usb 3-1: Manufacturer: syz [ 635.366870][ T520] usb 3-1: SerialNumber: syz [ 635.384941][T15741] rust_binder: Write failure EFAULT in pid:311 [ 635.407359][T15744] rust_binder: Write failure EINVAL in pid:313 [ 635.421007][T15746] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=512 sclass=netlink_route_socket pid=15746 comm=syz.6.5093 [ 635.493193][T15753] overlayfs: failed to resolve './file0': -2 [ 635.539413][ T4819] Bluetooth: hci0: Frame reassembly failed (-84) [ 635.576169][ T520] ums-karma 3-1:6.248: USB Mass Storage device detected [ 635.610792][ T520] usb 3-1: USB disconnect, device number 22 [ 636.277397][T15763] netlink: 'syz.8.5100': attribute type 4 has an invalid length. [ 636.353637][ T36] audit: type=1400 audit(4991.312:758): avc: denied { rename } for pid=15759 comm="syz.2.5099" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 636.376536][T15768] rust_binder: Write failure EINVAL in pid:321 [ 636.427374][T15760] rust_binder: Error while translating object. [ 636.433647][T15760] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 636.439962][T15760] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:340 [ 636.471445][ T4821] Bluetooth: hci1: Frame reassembly failed (-84) [ 637.594020][ T896] Bluetooth: hci0: command 0x1003 tx timeout [ 637.594019][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 638.000879][T15786] rust_binder: Failed to allocate buffer. len:8815263377109862632, is_oneway:false [ 638.000909][T15786] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 638.010675][T15786] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1017 [ 638.065408][T15792] rust_binder: 327: no such ref 2 [ 638.117100][T15795] rust_binder: 15792 RLIMIT_NICE not set [ 638.123230][ T520] rust_binder: 15791: removing orphan mapping 0:24 [ 638.161196][T15797] FAT-fs (rnullb0): bogus number of reserved sectors [ 638.168033][T15797] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 638.215648][T15801] loop7: detected capacity change from 0 to 16384 [ 638.404151][T15807] loop7: detected capacity change from 16384 to 0 [ 638.444525][ T36] audit: type=1400 audit(4993.412:759): avc: denied { map } for pid=15810 comm="syz.6.5118" path="socket:[73738]" dev="sockfs" ino=73738 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 638.467566][T15812] rust_binder: 432: no such ref 0 [ 638.473998][ T896] Bluetooth: hci1: command 0x1003 tx timeout [ 638.480048][ T881] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 639.884053][ T520] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 640.014054][ T520] usb 3-1: device descriptor read/64, error -71 [ 640.230245][T15833] rust_binder: got new transaction with bad transaction stack [ 640.230272][T15833] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:447 [ 640.239551][T15834] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 640.261649][ T520] usb 3-1: device descriptor read/64, error -71 [ 640.281233][T15838] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5126'. [ 640.394001][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 640.394007][ T881] Bluetooth: hci0: command 0x1003 tx timeout [ 640.429822][T15847] overlayfs: overlapping lowerdir path [ 640.451177][T15850] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:346 [ 640.524006][ T520] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 640.575775][ T4824] bridge_slave_1: left allmulticast mode [ 640.581549][ T4824] bridge_slave_1: left promiscuous mode [ 640.587522][ T4824] bridge0: port 2(bridge_slave_1) entered disabled state [ 640.595447][ T4824] bridge_slave_0: left allmulticast mode [ 640.613171][ T4824] bridge_slave_0: left promiscuous mode [ 640.619132][ T4824] bridge0: port 1(bridge_slave_0) entered disabled state [ 640.664072][ T520] usb 3-1: device descriptor read/64, error -71 [ 640.734797][ T4824] veth1_macvtap: left promiscuous mode [ 640.740411][ T4824] veth0_vlan: left promiscuous mode [ 640.817329][T15865] bridge0: port 1(bridge_slave_0) entered blocking state [ 640.824870][T15865] bridge0: port 1(bridge_slave_0) entered disabled state [ 640.831950][T15865] bridge_slave_0: entered allmulticast mode [ 640.838399][T15865] bridge_slave_0: entered promiscuous mode [ 640.846284][T15865] bridge0: port 2(bridge_slave_1) entered blocking state [ 640.853360][T15865] bridge0: port 2(bridge_slave_1) entered disabled state [ 640.854393][T15873] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:363 [ 640.860492][T15865] bridge_slave_1: entered allmulticast mode [ 640.879150][T15865] bridge_slave_1: entered promiscuous mode [ 640.914151][ T520] usb 3-1: device descriptor read/64, error -71 [ 640.944885][T15865] bridge0: port 2(bridge_slave_1) entered blocking state [ 640.951981][T15865] bridge0: port 2(bridge_slave_1) entered forwarding state [ 640.959312][T15865] bridge0: port 1(bridge_slave_0) entered blocking state [ 640.966380][T15865] bridge0: port 1(bridge_slave_0) entered forwarding state [ 640.990209][ T4819] bridge0: port 1(bridge_slave_0) entered disabled state [ 640.997702][ T4819] bridge0: port 2(bridge_slave_1) entered disabled state [ 641.008400][ T4813] bridge0: port 1(bridge_slave_0) entered blocking state [ 641.015490][ T4813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 641.025001][ T4819] bridge0: port 2(bridge_slave_1) entered blocking state [ 641.032064][ T4819] bridge0: port 2(bridge_slave_1) entered forwarding state [ 641.039778][ T520] usb usb3-port1: attempt power cycle [ 641.068033][T15865] veth0_vlan: entered promiscuous mode [ 641.080606][T15865] veth1_macvtap: entered promiscuous mode [ 641.138872][ T36] audit: type=1400 audit(4996.102:760): avc: denied { create } for pid=15882 comm="syz.4.5134" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 641.165400][T15883] syzkaller0: entered allmulticast mode [ 641.171279][T15883] syzkaller0: entered promiscuous mode [ 641.178558][T15881] FAT-fs (rnullb0): bogus number of reserved sectors [ 641.188049][T15881] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 641.284382][T15882] syzkaller0: left promiscuous mode [ 641.289734][T15882] syzkaller0: left allmulticast mode [ 641.357542][T15887] rust_binder: Write failure EINVAL in pid:4 [ 641.384674][ T520] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 641.415477][ T520] usb 3-1: device descriptor read/8, error -71 [ 641.462364][T15898] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5142'. [ 641.471923][T15898] IPv6: NLM_F_CREATE should be specified when creating new route [ 641.548167][ T520] usb 3-1: device descriptor read/8, error -71 [ 641.603295][T15906] 9pnet_fd: Insufficient options for proto=fd [ 641.655589][T15910] rust_binder: Failed to allocate buffer. len:1120, is_oneway:true [ 641.669552][T15912] overlayfs: empty lowerdir [ 641.703324][T15912] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 641.703767][T15912] rust_binder: Error while translating object. [ 641.711137][T15912] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 641.717488][T15912] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:368 [ 641.766283][ T36] audit: type=1326 audit(4996.732:761): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15916 comm="syz.8.5150" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc7858eba9 code=0x7ffc0000 [ 641.803991][ T520] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 641.812467][ T36] audit: type=1326 audit(4996.742:762): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15916 comm="syz.8.5150" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7efc7858eba9 code=0x7ffc0000 [ 641.837348][ T36] audit: type=1326 audit(4996.742:763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15916 comm="syz.8.5150" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc7858eba9 code=0x7ffc0000 [ 641.862618][ T520] usb 3-1: device descriptor read/8, error -71 [ 641.864641][ T36] audit: type=1326 audit(4996.742:764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15916 comm="syz.8.5150" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7efc78590ac7 code=0x7ffc0000 [ 641.894338][ T36] audit: type=1326 audit(4996.742:765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15916 comm="syz.8.5150" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7efc78590a3c code=0x7ffc0000 [ 641.930496][ T36] audit: type=1326 audit(4996.742:766): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15916 comm="syz.8.5150" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7efc78590974 code=0x7ffc0000 [ 641.953466][ T36] audit: type=1326 audit(4996.742:767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15916 comm="syz.8.5150" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7efc78590974 code=0x7ffc0000 [ 641.976928][ T36] audit: type=1326 audit(4996.742:768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15916 comm="syz.8.5150" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7efc7858d80a code=0x7ffc0000 [ 641.984807][T15927] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:375 [ 642.015078][ T520] usb 3-1: device descriptor read/8, error -71 [ 642.134126][ T520] usb usb3-port1: unable to enumerate USB device [ 642.234047][ T332] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 642.383987][ T332] usb 9-1: Using ep0 maxpacket: 8 [ 642.390150][ T332] usb 9-1: config 0 has an invalid descriptor of length 242, skipping remainder of the config [ 642.400620][ T332] usb 9-1: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice=21.c6 [ 642.409769][ T332] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 642.418512][ T332] usb 9-1: config 0 descriptor?? [ 642.759055][T15941] rust_binder: 15941 RLIMIT_NICE not set [ 642.766985][ T332] rust_binder: 15940: removing orphan mapping 0:1168 [ 642.804745][T15945] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4214 sclass=netlink_route_socket pid=15945 comm=syz.2.5160 [ 642.826457][T15945] usb 9-1: USB disconnect, device number 20 [ 643.216903][T15965] ip6gretap0: mtu less than device minimum [ 643.226897][T15965] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 643.236218][T15965] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 643.464054][ T520] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 643.614008][ T520] usb 3-1: Using ep0 maxpacket: 16 [ 643.620419][ T520] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 643.630661][ T520] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 643.641152][ T520] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 643.650300][ T520] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 643.658357][ T520] usb 3-1: Product: syz [ 643.662543][ T520] usb 3-1: Manufacturer: syz [ 643.667224][ T520] usb 3-1: SerialNumber: syz [ 644.317390][T15974] rust_binder: Write failure EFAULT in pid:1033 [ 644.318342][T15974] rust_binder: Write failure EFAULT in pid:1033 [ 644.340418][T15978] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=15978 comm=syz.7.5168 [ 645.088065][ T520] usb 3-1: 0:2 : does not exist [ 645.099925][ T520] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 645.124015][ T520] usb 3-1: USB disconnect, device number 27 [ 645.152299][ T8939] udevd[8939]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 645.195023][T15986] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 645.225435][T15986] kvm: pic: level sensitive irq not supported [ 645.225543][T15986] kvm: pic: non byte read [ 645.236510][T15986] kvm: pic: level sensitive irq not supported [ 645.236581][T15986] kvm: pic: non byte read [ 645.247484][T15986] kvm: pic: level sensitive irq not supported [ 645.247556][T15986] kvm: pic: non byte read [ 645.389484][T15997] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 224, size: 230) [ 645.389514][T15997] rust_binder: Error while translating object. [ 645.400248][T15997] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 645.406516][T15997] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:43 [ 645.499987][T16004] binder: Unknown parameter 'fsuuid' [ 645.695562][T16016] fuse: Bad value for 'group_id' [ 645.700554][T16016] fuse: Bad value for 'group_id' [ 645.713415][T16016] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 645.713448][T16016] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:385 [ 645.723660][T16016] fuse: Bad value for 'group_id' [ 645.737898][T16016] fuse: Bad value for 'group_id' [ 646.426568][T16056] ./file1: Can't lookup blockdev [ 646.431725][T16055] ./file1: Can't lookup blockdev [ 647.194062][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 647.254030][ T10] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 647.361879][T16062] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 647.361903][T16062] rust_binder: Read failure Err(EFAULT) in pid:1039 [ 647.388067][T16066] netlink: 'syz.7.5193': attribute type 4 has an invalid length. [ 647.404172][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 647.414406][ T10] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 39, changing to 9 [ 647.426716][ T10] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 647.437239][ T10] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 8 [ 647.447779][T16068] fuse: Bad value for 'group_id' [ 647.451152][ T520] hid-generic 0000:0000:0000.001B: unknown main item tag 0x0 [ 647.455103][T16068] fuse: Bad value for 'group_id' [ 647.466371][ T520] hid-generic 0000:0000:0000.001B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 647.466462][ T10] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 647.494773][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 647.503029][ T10] usb 5-1: Product: 䮭떹籆䠐잿橏揾嶃⫑聺⁀犖钄缈폟壹ᆮ髈䅞綋ꐉꛪკƚ䛸昀鿨㬪煃讻>Ꮯ诔᯸ᦸ컦浧쌴 [ 647.503455][T16072] fido_id[16072]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 647.517818][ T10] usb 5-1: Manufacturer: ᛓ姒糒៨癌髫娶뭾䀐὞杴卨ﳢ䘹曯層쨠DŽ厕쐳︚ᢥꜾ㲔릜䁗鹅⬵䄚届漴迥桿䶵뜙⭛㎦柤鄒䇦䙽폩鼛⸄籝ꀛ⡈睲掲婄㌙蔡굅漒햮鉝抱縡赠콙酜䷸윻緂ꠍ䍕㦇ꂤ뽖褨ꒀ⺓ᒎĸ䱒狯蔝뜧⿾䞂⹇Sᤊ䮕㬈ﯿ볋뮄鄵쏪滠 [ 647.564247][ T10] usb 5-1: SerialNumber: ᐁ [ 647.723377][T16081] netlink: 'syz.7.5197': attribute type 4 has an invalid length. [ 647.758637][T16085] netlink: 1343 bytes leftover after parsing attributes in process `syz.7.5199'. [ 647.815077][T16089] netlink: 'syz.7.5201': attribute type 4 has an invalid length. [ 647.825972][T16089] netlink: 'syz.7.5201': attribute type 4 has an invalid length. [ 647.919566][ T36] kauditd_printk_skb: 31 callbacks suppressed [ 647.919586][ T36] audit: type=1400 audit(5002.882:800): avc: denied { append } for pid=16094 comm="syz.2.5203" name="hwrng" dev="devtmpfs" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 647.978635][T16099] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 647.980582][ T36] audit: type=1326 audit(5002.942:801): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16096 comm="syz.2.5204" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb32e98eba9 code=0x0 [ 647.980692][T16100] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 648.009862][T16100] rust_binder: Read failure Err(EFAULT) in pid:1065 [ 648.019348][T16100] rust_binder: Failed to allocate buffer. len:8352, is_oneway:false [ 648.019619][T16099] rust_binder: Failed copying remainder into alloc: EFAULT [ 648.026096][T16100] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 648.035105][T16099] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 648.041663][T16100] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1065 [ 648.053176][T16099] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 648.068621][T16099] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:1065 [ 648.120647][T16105] FAT-fs (rnullb0): bogus number of reserved sectors [ 648.138022][T16105] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 648.168456][T16107] rust_binder: Write failure EFAULT in pid:1072 [ 648.707756][T16112] rust_binder: validate_parent_fixup: new_min_offset=21, sg_entry.length=0 [ 648.714164][T16112] rust_binder: Error while translating object. [ 648.722897][T16112] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 648.729198][T16112] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1077 [ 648.771363][T16119] netlink: 64 bytes leftover after parsing attributes in process `syz.7.5212'. [ 648.883774][T16129] netlink: 'syz.2.5217': attribute type 4 has an invalid length. [ 649.164030][ T65] usb 3-1: new full-speed USB device number 28 using dummy_hcd [ 649.315148][ T65] usb 3-1: config index 0 descriptor too short (expected 25953, got 27) [ 649.323597][ T65] usb 3-1: config 9 has an invalid interface number: 144 but max is 0 [ 649.331851][ T65] usb 3-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config [ 649.341984][ T65] usb 3-1: config 9 has no interface number 0 [ 649.348142][ T65] usb 3-1: config 9 interface 144 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 649.361233][ T65] usb 3-1: config 9 interface 144 has no altsetting 0 [ 649.369517][ T65] usb 3-1: New USB device found, idVendor=045e, idProduct=0927, bcdDevice=4b.68 [ 649.378670][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 649.386712][ T65] usb 3-1: Product: syz [ 649.390914][ T65] usb 3-1: Manufacturer: syz [ 649.395562][ T65] usb 3-1: SerialNumber: syz [ 649.403186][ T65] r8152-cfgselector 3-1: Unknown version 0x0000 [ 649.449236][T16135] rust_binder: Error while translating object. [ 649.449276][T16135] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 649.455712][T16135] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:425 [ 649.616065][ T65] r8152 3-1:9.144: Expected endpoints are not found [ 649.643454][ T65] r8152-cfgselector 3-1: USB disconnect, device number 28 [ 650.074033][ T881] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 650.074033][ T54] Bluetooth: hci0: command 0x1003 tx timeout [ 650.091497][ T10] cdc_ncm 5-1:1.0: bind() failure [ 650.098410][ T10] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 650.105521][ T10] cdc_ncm 5-1:1.1: bind() failure [ 650.113635][ T10] usb 5-1: USB disconnect, device number 22 [ 650.155833][T16163] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=16163 comm=syz.4.5229 [ 650.184274][T16160] /dev/rnullb0: Can't open blockdev [ 650.230225][T16170] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 650.278280][T16174] /dev/rnullb0: Can't open blockdev [ 650.345350][T16180] rust_binder: Error in use_page_slow: ESRCH [ 650.345373][T16180] rust_binder: use_range failure ESRCH [ 650.351417][T16180] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 650.357024][T16180] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 650.365094][T16180] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:432 [ 650.397358][T16182] binder: Bad value for 'stats' [ 650.397625][T16183] binder: Bad value for 'stats' [ 650.554149][ T10] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 650.725077][ T10] usb 5-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 207 [ 650.754018][ T10] usb 5-1: config 0 has an invalid descriptor of length 152, skipping remainder of the config [ 650.774008][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 650.788687][ T10] usb 5-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 650.797899][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.809766][ T10] usb 5-1: Product: syz [ 650.815512][ T10] usb 5-1: Manufacturer: syz [ 650.820269][ T10] usb 5-1: SerialNumber: syz [ 650.829708][ T10] usb 5-1: config 0 descriptor?? [ 650.845978][ T10] usb-storage 5-1:0.0: USB Mass Storage device detected [ 650.869679][ T10] usb-storage 5-1:0.0: Quirks match for vid 1908 pid 1315: 20000 [ 650.873178][T16188] rust_binder: Error while translating object. [ 650.877705][T16188] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 650.885131][T16188] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:447 [ 651.056468][T16170] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 224, size: 226) [ 651.078293][T16170] rust_binder: Error while translating object. [ 651.093590][T16170] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 651.100764][T16170] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:73 [ 651.113514][ T332] usb 5-1: USB disconnect, device number 23 [ 651.270721][T16201] 9pnet_fd: Insufficient options for proto=fd [ 651.484012][ T65] usb 3-1: new low-speed USB device number 29 using dummy_hcd [ 651.635088][ T65] usb 3-1: No LPM exit latency info found, disabling LPM. [ 651.645207][ T65] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 8 [ 651.656402][ T65] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x82 is Bulk; changing to Interrupt [ 651.666872][ T65] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x3 is Bulk; changing to Interrupt [ 651.904043][ T685] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 652.053990][ T685] usb 5-1: Using ep0 maxpacket: 32 [ 652.060426][ T685] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 652.074003][ T685] usb 5-1: config 0 has an invalid interface number: 6 but max is 0 [ 652.082244][ T685] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 652.103124][ T685] usb 5-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 652.112363][ T685] usb 5-1: config 0 has no interface number 0 [ 652.123979][ T685] usb 5-1: config 0 has no interface number 1 [ 652.149800][ T685] usb 5-1: config 0 interface 184 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 652.164532][ T685] usb 5-1: config 0 interface 184 has no altsetting 0 [ 652.171802][ T685] usb 5-1: config 0 interface 6 has no altsetting 0 [ 652.188349][ T685] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 652.198844][ T685] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 652.211355][ T685] usb 5-1: Product: syz [ 652.215775][ T685] usb 5-1: Manufacturer: syz [ 652.220553][ T685] usb 5-1: SerialNumber: syz [ 652.231243][ T685] usb 5-1: config 0 descriptor?? [ 652.239252][ T685] smsc75xx v1.0.0 [ 652.243053][ T685] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 652.253595][ T685] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -22 [ 652.264901][ T685] smsc75xx v1.0.0 [ 652.268610][ T685] smsc75xx 5-1:0.6 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 652.278771][ T685] smsc75xx 5-1:0.6: probe with driver smsc75xx failed with error -22 [ 652.441705][T16207] rust_binder: Write failure EFAULT in pid:75 [ 652.444133][ T446] usb 5-1: USB disconnect, device number 24 [ 652.973491][T16224] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 3 [ 653.076391][T16226] rust_binder: Write failure EFAULT in pid:79 [ 653.196725][ T36] audit: type=1400 audit(5008.162:802): avc: denied { create } for pid=16227 comm="syz.7.5250" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 653.225685][ T4824] Bluetooth: hci0: Frame reassembly failed (-84) [ 653.232326][ T4821] Bluetooth: hci0: Frame reassembly failed (-84) [ 654.124004][ T685] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 654.249640][ T65] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 654.261002][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 654.278118][ T65] usb 3-1: can't set config #1, error -71 [ 654.284002][ T685] usb 5-1: Using ep0 maxpacket: 16 [ 654.290016][ T65] usb 3-1: USB disconnect, device number 29 [ 654.296824][ T685] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 8 [ 654.305089][T16238] netlink: 'syz.2.5253': attribute type 4 has an invalid length. [ 654.308788][ T685] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 4.00 [ 654.325408][ T685] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 654.333600][ T685] usb 5-1: Product: syz [ 654.340766][ T685] usb 5-1: Manufacturer: syz [ 654.345524][ T685] usb 5-1: SerialNumber: syz [ 654.351161][ T685] usb 5-1: config 0 descriptor?? [ 654.357442][ T685] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 654.365482][ T685] usb 5-1: Detected FT232B [ 654.560120][T16236] tmpfs: Unknown parameter ':;2SHDOkQ:ۘMck?3\7o+Y;W` zCU\v"I]:sUBr?ISY,8' [ 654.573581][ T685] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 654.580959][ T685] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 654.588703][ T685] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 654.604288][ T685] usb 5-1: USB disconnect, device number 25 [ 654.611879][ T685] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 654.626002][ T685] ftdi_sio 5-1:0.0: device disconnected [ 654.682500][T16248] binder: Binderfs stats mode cannot be changed during a remount [ 654.716055][ T4824] Bluetooth: hci1: Frame reassembly failed (-84) [ 654.722601][ T4821] Bluetooth: hci1: Frame reassembly failed (-84) [ 655.120156][T16258] rust_binder: Write failure EFAULT in pid:93 [ 655.120312][T16258] binder: Unknown parameter '017777777777777777777770000000000000000000318446744073709551615' [ 655.137796][T16258] rust_binder: Write failure EINVAL in pid:93 [ 655.274008][T16251] Bluetooth: hci0: command 0x1003 tx timeout [ 655.274025][ T881] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 655.275678][T16268] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found [ 655.301962][T16268] rust_binder: Write failure EINVAL in pid:102 [ 655.311292][T16270] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 655.318327][T16270] rust_binder: Failed to allocate buffer. len:1152, is_oneway:false [ 655.449290][T16287] binder: Unknown parameter 'context' [ 655.958096][T16297] fuse: Unknown parameter '000000000000000000080x0000000000000007' [ 656.314018][ T331] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 656.465089][ T331] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 656.494007][ T331] usb 5-1: New USB device found, idVendor=0079, idProduct=0006, bcdDevice= 0.00 [ 656.503116][ T331] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.534820][ T331] usb 5-1: config 0 descriptor?? [ 656.794023][ T54] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 656.944160][T16301] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 656.952967][T16301] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 656.965819][ T331] dragonrise 0003:0079:0006.001C: unknown main item tag 0x0 [ 656.973405][ T331] dragonrise 0003:0079:0006.001C: item fetching failed at offset 3/5 [ 656.982039][ T331] dragonrise 0003:0079:0006.001C: parse failed [ 656.988804][ T331] dragonrise 0003:0079:0006.001C: probe with driver dragonrise failed with error -22 [ 657.175156][T16301] netlink: 316 bytes leftover after parsing attributes in process `syz.4.5272'. [ 657.184623][T16301] netlink: 316 bytes leftover after parsing attributes in process `syz.4.5272'. [ 657.194321][T16301] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:105 [ 657.194778][ T685] usb 5-1: USB disconnect, device number 26 [ 657.774831][ T36] audit: type=1400 audit(5012.742:803): avc: denied { setattr } for pid=16329 comm="syz.4.5283" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 657.808197][T16333] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 657.808980][T16333] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 200, size: 226) [ 657.815608][T16333] rust_binder: Error while translating object. [ 657.826212][T16333] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 657.832848][T16333] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:111 [ 657.936107][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 657.962715][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 657.969730][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 657.978648][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 657.988168][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 657.995186][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.001995][T16335] loop7: detected capacity change from 0 to 16384 [ 658.015396][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.015430][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.028731][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.040925][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.051763][T16352] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found [ 658.052884][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.058974][T16352] rust_binder: Write failure EINVAL in pid:497 [ 658.068778][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.081558][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.088488][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.095226][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.102776][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.119499][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.126192][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.132765][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.139395][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.146061][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.152608][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.159496][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.163646][T16348] loop7: detected capacity change from 16384 to 0 [ 658.168307][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.179473][ C1] I/O error, dev loop7, sector 8464 op 0x0:(READ) flags 0x80700 phys_seg 3 prio class 0 [ 658.195933][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.195972][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.202601][ T36] audit: type=1400 audit(5013.172:804): avc: denied { append } for pid=16353 comm="syz.8.5291" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 658.205826][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.244082][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.254992][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.270358][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.277070][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.283895][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.290577][T16346] rust_binder: Read failure Err(EAGAIN) in pid:471 [ 658.315405][T16359] rust_binder: Error while translating object. [ 658.329358][T16359] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 658.335649][T16359] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:505 [ 658.347604][T16363] rust_binder: Write failure EINVAL in pid:475 [ 658.377360][T16365] rust_binder: Error while translating object. [ 658.383712][T16365] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 658.393832][T16365] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:508 [ 658.405647][T16367] rust_binder: Failed to allocate buffer. len:8815263377109862632, is_oneway:false [ 658.415031][T16367] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 658.424537][T16367] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:477 [ 658.518678][T16379] rust_binder: got new transaction with bad transaction stack [ 658.528237][T16379] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:484 [ 658.559439][T16388] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5304'. [ 658.564026][ T685] usb 5-1: new full-speed USB device number 27 using dummy_hcd [ 658.662454][T16393] rust_binder: Write failure EINVAL in pid:488 [ 658.685785][ T36] audit: type=1400 audit(5013.652:805): avc: denied { mount } for pid=16394 comm="syz.2.5306" name="/" dev="9p" ino=7016996765293437283 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 658.716169][ T36] audit: type=1400 audit(5013.682:806): avc: denied { unmount } for pid=14174 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 658.737132][ T685] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 658.748650][ T685] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 658.763105][ T685] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 658.781832][ T685] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 658.798433][ T685] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 658.806640][ T685] usb 5-1: Product: syz [ 658.810945][ T685] usb 5-1: Manufacturer: syz [ 658.816082][ T685] usb 5-1: SerialNumber: syz [ 658.831854][T16361] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 658.841022][ T685] cdc_mbim 5-1:1.0: skipping garbage [ 658.847592][ T685] usb 5-1: selecting invalid altsetting 1 [ 659.048871][ T685] cdc_mbim 5-1:1.0: bind() failure [ 659.060898][ T685] usb 5-1: USB disconnect, device number 27 [ 659.118226][T16430] __vm_enough_memory: pid: 16430, comm: syz.7.5317, bytes: 18014402804453376 not enough memory for the allocation [ 659.165156][T16437] __vm_enough_memory: pid: 16437, comm: syz.8.5320, bytes: 18014402804453376 not enough memory for the allocation [ 659.229219][ T36] audit: type=1400 audit(5014.192:807): avc: denied { read } for pid=16444 comm="syz.7.5323" dev="nsfs" ino=4026532392 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 659.267226][ T36] audit: type=1400 audit(5014.222:808): avc: denied { open } for pid=16444 comm="syz.7.5323" path="net:[4026532392]" dev="nsfs" ino=4026532392 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 659.311789][ T36] audit: type=1400 audit(5014.222:809): avc: denied { create } for pid=16444 comm="syz.7.5323" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 659.346223][ T36] audit: type=1400 audit(5014.222:810): avc: denied { bind } for pid=16444 comm="syz.7.5323" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 659.366675][ T36] audit: type=1400 audit(5014.222:811): avc: denied { getopt } for pid=16444 comm="syz.7.5323" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 659.386766][ T36] audit: type=1400 audit(5014.222:812): avc: denied { listen } for pid=16444 comm="syz.7.5323" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 659.407523][ T36] audit: type=1400 audit(5014.222:813): avc: denied { setopt } for pid=16444 comm="syz.7.5323" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 659.427255][T16447] rust_binder: Error while translating object. [ 659.427287][T16447] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 659.427356][ T65] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 659.444643][T16447] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1148 [ 659.451990][ T36] audit: type=1400 audit(5014.262:814): avc: denied { read write } for pid=9319 comm="syz-executor" name="loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 659.644027][ T65] usb 3-1: Using ep0 maxpacket: 16 [ 659.653283][ T65] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 659.663739][ T65] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 659.675239][ T65] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 659.684530][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 659.692618][ T65] usb 3-1: Product: syz [ 659.698787][ T65] usb 3-1: Manufacturer: syz [ 659.703516][ T65] usb 3-1: SerialNumber: syz [ 659.767671][T16470] binder: Unknown parameter 'defcontext01777777777777777777777' [ 659.788595][T16472] /dev/rnullb0: Can't open blockdev [ 659.815031][T16476] rust_binder: got new transaction with bad transaction stack [ 659.815058][T16476] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:552 [ 659.870284][T16481] fuse: Unknown parameter '0x0000000000000003' [ 659.947300][ T65] usb 3-1: 0:2 : does not exist [ 659.955681][ T65] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 659.967150][ T65] usb 3-1: USB disconnect, device number 30 [ 659.999560][T16484] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 659.999578][T16484] rust_binder: Read failure Err(EFAULT) in pid:129 [ 660.757815][T16493] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 660.764511][T16493] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 660.794025][ T65] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 660.854016][T16497] rust_binder: Write failure EINVAL in pid:137 [ 660.882446][T16499] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 144, limit: 232, size: 201) [ 660.889202][T16499] rust_binder: Error while translating object. [ 660.900194][T16499] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 660.907648][T16499] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1157 [ 660.964008][ T65] usb 3-1: Using ep0 maxpacket: 16 [ 660.983673][ T65] usb 3-1: config 0 has no interfaces? [ 660.990445][ T65] usb 3-1: New USB device found, idVendor=0bd3, idProduct=05f4, bcdDevice= 0.5b [ 661.001546][ T65] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 661.014367][ T65] usb 3-1: config 0 descriptor?? [ 661.033517][T16511] rust_binder: Write failure EFAULT in pid:1166 [ 661.034281][T16511] bridge0: entered allmulticast mode [ 661.070407][T16515] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 661.221504][ T65] usb 3-1: USB disconnect, device number 31 [ 661.281700][T16535] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 661.743045][T16538] rust_binder: validate_parent_fixup: new_min_offset=21, sg_entry.length=0 [ 661.743073][T16538] rust_binder: Error while translating object. [ 661.751911][T16538] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 661.759033][T16538] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:503 [ 661.875247][T16540] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 661.884569][T16540] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:505 [ 661.967042][T16546] usb usb9: usbfs: process 16546 (syz.4.5358) did not claim interface 0 before use [ 662.201817][T16574] fuse: Unknown parameter '0x0000000000000006' [ 662.832883][T16593] rust_binder: validate_parent_fixup: fixup_min_offset=57, parent_offset=37 [ 662.832913][T16593] rust_binder: Error while translating object. [ 662.841845][T16593] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 662.848101][T16593] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:167 [ 662.949457][T16601] rust_binder: Write failure EFAULT in pid:556 [ 662.995714][T16599] rust_binder: 16599 RLIMIT_NICE not set [ 663.017618][ T331] rust_binder: 16598: removing orphan mapping 0:1168 [ 663.135647][T16611] netlink: 165 bytes leftover after parsing attributes in process `syz.2.5379'. [ 663.156468][T16611] rust_binder: Failed to allocate buffer. len:224, is_oneway:false [ 663.200035][T16617] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:558 [ 663.271182][ T331] rust_binder: 16620: removing orphan mapping 0:1024 [ 663.664004][ T65] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 663.734523][ T36] kauditd_printk_skb: 355 callbacks suppressed [ 663.734543][ T36] audit: type=1400 audit(5018.702:1170): avc: denied { ioctl } for pid=16635 comm="syz.4.5386" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 663.766034][ T36] audit: type=1400 audit(5018.732:1171): avc: denied { ioctl } for pid=16643 comm="syz.2.5389" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 663.814775][ T36] audit: type=1400 audit(5018.782:1172): avc: denied { ioctl } for pid=16635 comm="syz.4.5386" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 663.840331][ T685] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 663.848029][ T36] audit: type=1400 audit(5018.812:1173): avc: denied { ioctl } for pid=16635 comm="syz.4.5386" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 663.872658][ T36] audit: type=1400 audit(5018.812:1174): avc: denied { ioctl } for pid=16635 comm="syz.4.5386" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 663.897347][ T65] usb 5-1: config index 0 descriptor too short (expected 39, got 27) [ 663.905992][ T65] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 663.914027][ T36] audit: type=1400 audit(5018.842:1175): avc: denied { ioctl } for pid=16635 comm="syz.4.5386" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 663.918265][ T65] usb 5-1: config 0 interface 0 has no altsetting 0 [ 663.943600][ T36] audit: type=1400 audit(5018.842:1176): avc: denied { ioctl } for pid=16635 comm="syz.4.5386" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 663.974538][ T36] audit: type=1400 audit(5018.842:1177): avc: denied { ioctl } for pid=16643 comm="syz.2.5389" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 664.001996][ T65] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 664.022333][ T65] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 664.029460][ T36] audit: type=1400 audit(5018.872:1178): avc: denied { ioctl } for pid=16635 comm="syz.4.5386" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 664.040791][ T65] usb 5-1: Product: syz [ 664.061391][ T36] audit: type=1400 audit(5018.872:1179): avc: denied { ioctl } for pid=16643 comm="syz.2.5389" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 664.094083][ T65] usb 5-1: Manufacturer: syz [ 664.098768][ T65] usb 5-1: SerialNumber: syz [ 664.103467][ T685] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 664.120341][ T685] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 664.131097][T16647] rust_binder: Error in use_page_slow: ESRCH [ 664.131119][T16647] rust_binder: use_range failure ESRCH [ 664.131391][ T65] usb 5-1: config 0 descriptor?? [ 664.141718][T16647] rust_binder: Failed to allocate buffer. len:1144, is_oneway:true [ 664.145221][ T685] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 664.150669][T16647] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 664.164554][ T65] hub 5-1:0.0: bad descriptor, ignoring hub [ 664.167814][T16647] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:561 [ 664.179380][ T685] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 664.197243][ T65] hub 5-1:0.0: probe with driver hub failed with error -5 [ 664.205038][ T65] usb 5-1: selecting invalid altsetting 0 [ 664.211373][ T685] usb 3-1: SerialNumber: syz [ 664.344216][T16650] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 664.432013][ T685] usb 3-1: 0:2 : does not exist [ 664.440327][ T685] usb 3-1: unit 5 not found! [ 664.462164][ T685] usb 3-1: USB disconnect, device number 32 [ 664.534074][ T331] usb 5-1: USB disconnect, device number 28 [ 664.613014][ T8939] udevd[8939]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 664.961493][T16663] rust_binder: 16662 RLIMIT_NICE not set [ 664.964310][T16664] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:566 [ 664.990832][ T65] rust_binder: 16661: removing orphan mapping 0:24 [ 665.154205][T16671] pim6reg1: entered promiscuous mode [ 665.159713][T16671] pim6reg1: entered allmulticast mode [ 665.273989][ T331] usb 5-1: new low-speed USB device number 29 using dummy_hcd [ 665.415021][T16678] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 665.415967][T16678] rust_binder: Failed to allocate buffer. len:1160, is_oneway:false [ 665.434009][ T331] usb 5-1: Invalid ep0 maxpacket: 16 [ 665.574014][ T331] usb 5-1: new low-speed USB device number 30 using dummy_hcd [ 665.750402][ T331] usb 5-1: Invalid ep0 maxpacket: 16 [ 665.766691][ T331] usb usb5-port1: attempt power cycle [ 665.936888][T16702] veth1: entered allmulticast mode [ 666.124028][ T331] usb 5-1: new low-speed USB device number 31 using dummy_hcd [ 666.143855][T16712] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 666.153992][T16702] veth1: left allmulticast mode [ 666.164750][ T331] usb 5-1: Invalid ep0 maxpacket: 16 [ 666.304000][ T331] usb 5-1: new low-speed USB device number 32 using dummy_hcd [ 666.305204][T16719] rust_binder: Error while translating object. [ 666.321961][T16719] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 666.324995][ T331] usb 5-1: Invalid ep0 maxpacket: 16 [ 666.328836][T16719] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1216 [ 666.341492][ T331] usb usb5-port1: unable to enumerate USB device [ 666.514016][ T10] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 666.617840][ T4819] tipc: Subscription rejected, illegal request [ 666.684026][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 666.716460][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 666.732270][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 666.747476][T16731] rust_binder: Error while translating object. [ 666.747521][T16731] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 666.753812][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 666.776721][T16731] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:590 [ 666.776810][ T10] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 666.779645][T16733] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 666.796948][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 666.813734][ T10] usb 3-1: config 0 descriptor?? [ 666.921786][T16739] random: crng reseeded on system resumption [ 667.226502][ T10] microsoft 0003:045E:07DA.001D: unknown main item tag 0x0 [ 667.233883][ T10] microsoft 0003:045E:07DA.001D: unknown main item tag 0x0 [ 667.241233][ T10] microsoft 0003:045E:07DA.001D: unknown main item tag 0x0 [ 667.248757][ T10] microsoft 0003:045E:07DA.001D: unknown main item tag 0x0 [ 667.256083][ T10] microsoft 0003:045E:07DA.001D: unknown main item tag 0x0 [ 667.263572][ T10] microsoft 0003:045E:07DA.001D: unknown main item tag 0x0 [ 667.270850][ T10] microsoft 0003:045E:07DA.001D: unknown main item tag 0x0 [ 667.278325][ T10] microsoft 0003:045E:07DA.001D: unknown main item tag 0x0 [ 667.285631][ T10] microsoft 0003:045E:07DA.001D: unknown main item tag 0x0 [ 667.293097][ T10] microsoft 0003:045E:07DA.001D: unknown main item tag 0x0 [ 667.300958][ T10] HID 045e:07da: Invalid code 65791 type 1 [ 667.307312][ T10] HID 045e:07da: Invalid code 768 type 1 [ 667.312966][ T10] HID 045e:07da: Invalid code 769 type 1 [ 667.318766][ T10] HID 045e:07da: Invalid code 770 type 1 [ 667.324695][ T10] HID 045e:07da: Invalid code 771 type 1 [ 667.330353][ T10] HID 045e:07da: Invalid code 772 type 1 [ 667.336039][ T10] HID 045e:07da: Invalid code 773 type 1 [ 667.341934][ T10] HID 045e:07da: Invalid code 774 type 1 [ 667.347639][ T10] HID 045e:07da: Invalid code 775 type 1 [ 667.354711][ T10] HID 045e:07da: Invalid code 776 type 1 [ 667.365500][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.001D/input/input41 [ 667.380463][ T10] microsoft 0003:045E:07DA.001D: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 667.444795][ T10] usb 3-1: USB disconnect, device number 33 [ 667.462369][T16742] netlink: 44 bytes leftover after parsing attributes in process `syz.7.5420'. [ 667.484028][T16742] netlink: 43 bytes leftover after parsing attributes in process `syz.7.5420'. [ 667.500861][T16742] netlink: 'syz.7.5420': attribute type 6 has an invalid length. [ 667.524421][T16742] netlink: 'syz.7.5420': attribute type 5 has an invalid length. [ 667.542350][T16742] netlink: 43 bytes leftover after parsing attributes in process `syz.7.5420'. [ 667.559658][T16743] fido_id[16743]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 667.744773][T16747] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 668.017039][T16758] overlayfs: failed to resolve './file0': -2 [ 668.179567][T16774] binder: Bad value for 'max' [ 668.296792][T16777] can0: slcan on ttyS3. [ 668.312924][T16777] 9pnet_fd: Insufficient options for proto=fd [ 668.434008][ T520] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 668.584011][ T520] usb 5-1: device descriptor read/64, error -71 [ 668.765227][ T36] kauditd_printk_skb: 895 callbacks suppressed [ 668.765259][ T36] audit: type=1400 audit(5023.732:2075): avc: denied { ioctl } for pid=16760 comm="syz.4.5426" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 668.824046][ T520] usb 5-1: device descriptor read/64, error -71 [ 668.843626][ T36] audit: type=1400 audit(5023.802:2076): avc: denied { read write } for pid=14667 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 668.875149][T16794] netlink: 28 bytes leftover after parsing attributes in process `syz.8.5431'. [ 668.894650][ T36] audit: type=1400 audit(5023.802:2077): avc: denied { read write open } for pid=14667 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 668.924043][ T36] audit: type=1400 audit(5023.812:2078): avc: denied { ioctl } for pid=14667 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 668.962514][ T36] audit: type=1400 audit(5023.832:2079): avc: denied { create } for pid=16793 comm="syz.8.5431" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 668.983623][ T36] audit: type=1400 audit(5023.842:2080): avc: denied { write } for pid=16793 comm="syz.8.5431" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 669.004419][ T36] audit: type=1400 audit(5023.842:2081): avc: denied { nlmsg_write } for pid=16793 comm="syz.8.5431" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 669.027168][ T36] audit: type=1400 audit(5023.852:2082): avc: denied { read } for pid=16793 comm="syz.8.5431" name="binder1" dev="binder" ino=26 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 669.052723][ T36] audit: type=1400 audit(5023.852:2083): avc: denied { read open } for pid=16793 comm="syz.8.5431" path="/dev/binderfs/binder1" dev="binder" ino=26 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 669.076974][ T36] audit: type=1400 audit(5023.852:2084): avc: denied { read write } for pid=16793 comm="syz.8.5431" name="vhost-vsock" dev="devtmpfs" ino=200 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 669.100815][ T520] usb 5-1: new full-speed USB device number 34 using dummy_hcd [ 669.164626][T16776] can0 (unregistered): slcan off ttyS3. [ 669.234000][ T520] usb 5-1: device descriptor read/64, error -71 [ 669.302259][T16802] rust_binder: Error in use_page_slow: ESRCH [ 669.302287][T16802] rust_binder: use_range failure ESRCH [ 669.309532][T16802] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 669.316069][T16802] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 669.325129][T16802] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:595 [ 669.474002][ T520] usb 5-1: device descriptor read/64, error -71 [ 669.614503][ T520] usb usb5-port1: attempt power cycle [ 669.964005][ T520] usb 5-1: new full-speed USB device number 35 using dummy_hcd [ 669.996876][ T520] usb 5-1: device descriptor read/8, error -71 [ 670.126753][ T520] usb 5-1: device descriptor read/8, error -71 [ 670.364062][ T520] usb 5-1: new full-speed USB device number 36 using dummy_hcd [ 670.386410][ T520] usb 5-1: device descriptor read/8, error -71 [ 670.516342][ T520] usb 5-1: device descriptor read/8, error -71 [ 670.624073][ T520] usb usb5-port1: unable to enumerate USB device [ 670.736442][T16848] fuse: Bad value for 'group_id' [ 670.741468][T16848] fuse: Bad value for 'group_id' [ 671.164669][T16873] netlink: 'syz.4.5446': attribute type 6 has an invalid length. [ 671.182896][T16872] netlink: 'syz.4.5446': attribute type 6 has an invalid length. [ 671.303222][T16881] __vm_enough_memory: pid: 16881, comm: syz.4.5449, bytes: 18014402804453376 not enough memory for the allocation [ 671.390698][T16886] rust_binder: Failed to allocate buffer. len:4224, is_oneway:false [ 671.504007][ T331] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 671.654132][ T331] usb 3-1: device descriptor read/64, error -71 [ 671.909055][ T331] usb 3-1: device descriptor read/64, error -71 [ 672.023467][T16912] __vm_enough_memory: pid: 16912, comm: syz.7.5459, bytes: 18014402804453376 not enough memory for the allocation [ 672.066293][T16914] kernel read not supported for file /policy (pid: 16914 comm: syz.4.5460) [ 672.164122][ T331] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 672.324179][ T331] usb 3-1: device descriptor read/64, error -71 [ 672.564035][ T331] usb 3-1: device descriptor read/64, error -71 [ 672.674142][ T331] usb usb3-port1: attempt power cycle [ 673.014051][ T331] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 673.036567][ T331] usb 3-1: device descriptor read/8, error -71 [ 673.175783][ T331] usb 3-1: device descriptor read/8, error -71 [ 673.319801][T16936] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 673.332908][T16936] veth0: entered promiscuous mode [ 673.337301][T16939] rust_binder: 213: no such ref 2 [ 673.351690][T16939] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:213 [ 673.351705][T16940] rust_binder: 213: no such ref 2 [ 673.351722][T16940] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:213 [ 673.407018][T16943] rust_binder: 217: no such ref 3 [ 673.421423][T16943] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 673.428677][T16943] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 673.436017][ T331] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 673.443643][T16943] rust_binder: Write failure EFAULT in pid:217 [ 673.458828][ T331] usb 3-1: device descriptor read/8, error -71 [ 673.521050][ T10] rust_binder: 16941: removing orphan mapping 0:4200 [ 673.555823][T16946] rust_binder: 220: no such ref 0 [ 673.560991][T16946] rust_binder: 220: no such ref 1 [ 673.566118][T16946] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 673.573650][T16946] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:220 [ 673.574397][T16946] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:220 [ 673.596770][ T331] usb 3-1: device descriptor read/8, error -71 [ 673.685187][ T10] hid-generic 0000:0000:0000.001E: unknown main item tag 0x0 [ 673.693464][ T10] hid-generic 0000:0000:0000.001E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 673.724114][ T331] usb usb3-port1: unable to enumerate USB device [ 673.790102][ T36] kauditd_printk_skb: 1038 callbacks suppressed [ 673.790122][ T36] audit: type=1400 audit(5028.752:3123): avc: denied { create } for pid=16952 comm="syz.4.5471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 673.843999][ T36] audit: type=1400 audit(5028.752:3124): avc: denied { write } for pid=16952 comm="syz.4.5471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 673.864502][ T36] audit: type=1400 audit(5028.752:3125): avc: denied { nlmsg_write } for pid=16952 comm="syz.4.5471" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 673.889785][ T36] audit: type=1400 audit(5028.832:3126): avc: denied { read write } for pid=15865 comm="syz-executor" name="loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 673.913769][ T36] audit: type=1400 audit(5028.832:3127): avc: denied { read write open } for pid=15865 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 673.939421][ T36] audit: type=1400 audit(5028.832:3128): avc: denied { ioctl } for pid=15865 comm="syz-executor" path="/dev/loop4" dev="devtmpfs" ino=53 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 673.964671][ T36] audit: type=1400 audit(5028.912:3129): avc: denied { read } for pid=16956 comm="syz.4.5472" dev="nsfs" ino=4026533081 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 673.985424][ T36] audit: type=1400 audit(5028.912:3130): avc: denied { read open } for pid=16956 comm="syz.4.5472" path="net:[4026533081]" dev="nsfs" ino=4026533081 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 674.012846][ T36] audit: type=1400 audit(5028.912:3131): avc: denied { create } for pid=16956 comm="syz.4.5472" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 674.034013][ T36] audit: type=1400 audit(5028.912:3132): avc: denied { read } for pid=16956 comm="syz.4.5472" dev="nsfs" ino=4026533081 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 674.149531][T16935] veth0: left promiscuous mode [ 674.154844][ T881] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 674.344006][ T685] usb 5-1: new low-speed USB device number 37 using dummy_hcd [ 674.494007][ T685] usb 5-1: device descriptor read/64, error -71 [ 674.654052][ T10] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 674.734015][ T685] usb 5-1: device descriptor read/64, error -71 [ 674.804684][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 674.813312][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 674.826031][ T10] usb 3-1: config 6 has an invalid interface number: 248 but max is 0 [ 674.837609][ T10] usb 3-1: config 6 has no interface number 0 [ 674.844708][ T10] usb 3-1: config 6 interface 248 has no altsetting 0 [ 674.856630][ T10] usb 3-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 674.867417][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.876599][ T10] usb 3-1: Product: syz [ 674.880825][ T10] usb 3-1: Manufacturer: syz [ 674.886377][ T10] usb 3-1: SerialNumber: syz [ 674.994023][ T685] usb 5-1: new low-speed USB device number 38 using dummy_hcd [ 675.109411][ T10] ums-karma 3-1:6.248: USB Mass Storage device detected [ 675.134000][ T685] usb 5-1: device descriptor read/64, error -71 [ 675.195268][T16981] Bluetooth: hci0: Frame reassembly failed (-84) [ 675.205252][ T10] usb 3-1: USB disconnect, device number 38 [ 675.225160][ T8939] udevd[8939]: setting mode of /dev/bus/usb/003/038 to 020664 failed: No such file or directory [ 675.236411][ T4819] Bluetooth: hci0: Frame reassembly failed (-84) [ 675.256232][ T8939] udevd[8939]: setting owner of /dev/bus/usb/003/038 to uid=0, gid=0 failed: No such file or directory [ 675.403984][ T685] usb 5-1: device descriptor read/64, error -71 [ 675.514361][ T685] usb usb5-port1: attempt power cycle [ 675.853989][ T685] usb 5-1: new low-speed USB device number 39 using dummy_hcd [ 675.866722][ T4822] bridge_slave_1: left allmulticast mode [ 675.872622][ T4822] bridge_slave_1: left promiscuous mode [ 675.879372][ T4822] bridge0: port 2(bridge_slave_1) entered disabled state [ 675.888227][ T4822] bridge_slave_0: left allmulticast mode [ 675.894047][ T4822] bridge_slave_0: left promiscuous mode [ 675.900025][ T4822] bridge0: port 1(bridge_slave_0) entered disabled state [ 675.907307][ T685] usb 5-1: device descriptor read/8, error -71 [ 676.047815][ T685] usb 5-1: device descriptor read/8, error -71 [ 676.058681][ T4822] veth1_macvtap: left promiscuous mode [ 676.066320][ T4822] veth0_vlan: left promiscuous mode [ 676.245570][T16992] bridge0: port 1(bridge_slave_0) entered blocking state [ 676.252653][T16992] bridge0: port 1(bridge_slave_0) entered disabled state [ 676.259886][T16992] bridge_slave_0: entered allmulticast mode [ 676.266225][T16992] bridge_slave_0: entered promiscuous mode [ 676.275145][T16992] bridge0: port 2(bridge_slave_1) entered blocking state [ 676.282253][T16992] bridge0: port 2(bridge_slave_1) entered disabled state [ 676.289410][T16992] bridge_slave_1: entered allmulticast mode [ 676.295424][ T685] usb 5-1: new low-speed USB device number 40 using dummy_hcd [ 676.303446][T16992] bridge_slave_1: entered promiscuous mode [ 676.326485][ T685] usb 5-1: device descriptor read/8, error -71 [ 676.407829][T16992] bridge0: port 2(bridge_slave_1) entered blocking state [ 676.415004][T16992] bridge0: port 2(bridge_slave_1) entered forwarding state [ 676.422338][T16992] bridge0: port 1(bridge_slave_0) entered blocking state [ 676.429448][T16992] bridge0: port 1(bridge_slave_0) entered forwarding state [ 676.477925][ T685] usb 5-1: device descriptor read/8, error -71 [ 676.491363][ T4822] bridge0: port 1(bridge_slave_0) entered disabled state [ 676.499719][ T4822] bridge0: port 2(bridge_slave_1) entered disabled state [ 676.515635][ T4813] bridge0: port 1(bridge_slave_0) entered blocking state [ 676.522751][ T4813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 676.535301][ T4822] bridge0: port 2(bridge_slave_1) entered blocking state [ 676.542423][ T4822] bridge0: port 2(bridge_slave_1) entered forwarding state [ 676.604126][ T685] usb usb5-port1: unable to enumerate USB device [ 676.638074][T16992] veth0_vlan: entered promiscuous mode [ 676.676923][T16992] veth1_macvtap: entered promiscuous mode [ 676.888334][T17006] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 676.889665][T17006] rust_binder: Error while translating object. [ 676.899081][T17006] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 676.906073][T17006] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:5 [ 677.077996][T17018] binder: Unknown parameter 'fscontext?}' [ 677.284075][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 677.362485][T17025] can0: slcan on ptm0. [ 677.393999][ T331] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 677.435313][T17025] loop7: detected capacity change from 0 to 16384 [ 677.542106][T17028] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 677.557927][T17028] rust_binder: Write failure EINVAL in pid:241 [ 677.573977][ T331] usb 4-1: Using ep0 maxpacket: 8 [ 677.634909][ T331] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 677.667506][ T331] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.697977][ T331] usb 4-1: Product: syz [ 677.721693][ T331] usb 4-1: Manufacturer: syz [ 677.744522][ T331] usb 4-1: SerialNumber: syz [ 677.750274][T17031] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 677.751151][T17031] rust_binder: Failed to allocate buffer. len:200, is_oneway:false [ 677.924602][T17024] can0 (unregistered): slcan off ptm0. [ 677.980592][ T331] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 15 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 678.174156][ T520] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 678.181598][ T446] usb 4-1: USB disconnect, device number 15 [ 678.209550][ T446] usblp0: removed [ 678.304010][ T520] usb 5-1: device descriptor read/64, error -71 [ 678.320808][T17050] kvm: kvm [17049]: vcpu6, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010000) = 0x8000 [ 678.584048][ T520] usb 5-1: device descriptor read/64, error -71 [ 678.748117][T17062] cgroup: Unknown subsys name 'perf_event' [ 678.795825][ T36] kauditd_printk_skb: 903 callbacks suppressed [ 678.795846][ T36] audit: type=1400 audit(5033.752:4036): avc: denied { ioctl } for pid=17035 comm="syz.4.5497" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 678.849766][ T520] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 678.918540][ T36] audit: type=1400 audit(5033.782:4037): avc: denied { search } for pid=17066 comm="sed" name="resolv.conf" dev="tmpfs" ino=426 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 678.974005][T17074] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 678.990822][ T36] audit: type=1400 audit(5033.782:4038): avc: denied { read } for pid=17066 comm="sed" name="eth0.dhcp" dev="tmpfs" ino=435 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 678.998545][ T520] usb 5-1: device descriptor read/64, error -71 [ 679.038163][T17074] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1284 [ 679.063991][ T36] audit: type=1400 audit(5033.782:4039): avc: denied { read open } for pid=17066 comm="sed" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=435 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 679.090251][T17052] audit: audit_backlog=65 > audit_backlog_limit=64 [ 679.110672][ T9319] audit: audit_backlog=65 > audit_backlog_limit=64 [ 679.124021][ T9319] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 679.141855][T17052] audit: audit_lost=2 audit_rate_limit=0 audit_backlog_limit=64 [ 679.146997][ T36] audit: type=1400 audit(5033.782:4040): avc: denied { read write } for pid=17067 comm="syz.3.5504" name="binder0" dev="binder" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 679.151913][ T9319] audit: backlog limit exceeded [ 679.334005][ T520] usb 5-1: device descriptor read/64, error -71 [ 679.444577][ T520] usb usb5-port1: attempt power cycle [ 679.641820][T17094] SELinux: security_context_str_to_sid (E) failed with errno=-22 [ 679.794103][ T520] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 679.826904][ T520] usb 5-1: device descriptor read/8, error -71 [ 679.895879][T17108] netlink: 'syz.8.5516': attribute type 6 has an invalid length. [ 679.968617][ T520] usb 5-1: device descriptor read/8, error -71 [ 680.033481][T17116] rust_binder: Error while translating object. [ 680.033530][T17116] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 680.041068][T17116] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:671 [ 680.223981][ T520] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 680.280751][ T520] usb 5-1: device descriptor read/8, error -71 [ 680.416637][ T520] usb 5-1: device descriptor read/8, error -71 [ 680.464263][T17133] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 680.504195][T17137] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 1176, size: 18446744073709551614) [ 680.504222][T17137] rust_binder: Error while translating object. [ 680.516444][T17137] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 680.522648][T17137] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1310 [ 680.532293][ T520] usb usb5-port1: unable to enumerate USB device [ 680.595595][T17144] syzkaller0: entered allmulticast mode [ 680.620892][T17145] SELinux: Context system_u:object_r:syslogd_var_lib_t:s0 is not valid (left unmapped). [ 681.031184][T17166] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 681.031224][T17166] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:247 [ 681.068257][T17168] netlink: 104 bytes leftover after parsing attributes in process `syz.7.5533'. [ 681.207016][T17170] netlink: 'syz.7.5534': attribute type 13 has an invalid length. [ 681.500060][T17179] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 681.569973][T17176] rust_binder: Error while translating object. [ 681.576586][T17176] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 681.582776][T17176] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:251 [ 681.637765][T17183] netlink: 'syz.4.5539': attribute type 4 has an invalid length. [ 681.862830][T17189] kernel read not supported for file /policy (pid: 17189 comm: syz.4.5542) [ 681.961979][T17189] 9pnet_fd: Insufficient options for proto=fd [ 682.568126][T17226] rust_binder: Error while translating object. [ 682.568163][T17226] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 682.575133][T17226] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:42 [ 682.585850][ T446] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 682.703184][T17231] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5554'. [ 682.715171][T17233] 9pnet_fd: Insufficient options for proto=fd [ 682.732483][T17231] rust_binder: Error while translating object. [ 682.732536][T17231] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 682.738897][T17231] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:44 [ 682.767371][ T446] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 682.787164][ T446] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 682.796838][ T446] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 682.812188][ T446] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 682.829628][ T446] usb 5-1: config 0 descriptor?? [ 683.122423][ T446] ================================================================== [ 683.130561][ T446] BUG: KASAN: slab-use-after-free in hci_uart_write_work+0x44a/0x790 [ 683.138727][ T446] Read of size 8 at addr ffff8881237be9a8 by task kworker/1:3/446 [ 683.146550][ T446] [ 683.148882][ T446] CPU: 1 UID: 0 PID: 446 Comm: kworker/1:3 Not tainted syzkaller #0 999ed7ff739122807d950cd03a17deb2b8fbe7d9 [ 683.148904][ T446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 683.148915][ T446] Workqueue: events hci_uart_write_work [ 683.148946][ T446] Call Trace: [ 683.148952][ T446] [ 683.148960][ T446] __dump_stack+0x21/0x30 [ 683.148986][ T446] dump_stack_lvl+0x10c/0x190 [ 683.149008][ T446] ? __cfi_dump_stack_lvl+0x10/0x10 [ 683.149030][ T446] ? __cfi__printk+0x10/0x10 [ 683.149046][ T446] print_address_description+0x71/0x200 [ 683.149065][ T446] print_report+0x4a/0x70 [ 683.149082][ T446] kasan_report+0x163/0x1a0 [ 683.149101][ T446] ? hci_uart_write_work+0x44a/0x790 [ 683.149121][ T446] ? hci_uart_write_work+0x44a/0x790 [ 683.149140][ T446] ? __cfi_pty_write+0x10/0x10 [ 683.149185][ T446] __asan_report_load8_noabort+0x18/0x20 [ 683.149209][ T446] hci_uart_write_work+0x44a/0x790 [ 683.149232][ T446] process_scheduled_works+0x7d5/0x1020 [ 683.149261][ T446] worker_thread+0xc58/0x1250 [ 683.149279][ T446] kthread+0x2c7/0x370 [ 683.149295][ T446] ? __cfi_worker_thread+0x10/0x10 [ 683.149310][ T446] ? __cfi_kthread+0x10/0x10 [ 683.149326][ T446] ret_from_fork+0x67/0xa0 [ 683.149348][ T446] ? __cfi_kthread+0x10/0x10 [ 683.149364][ T446] ret_from_fork_asm+0x1a/0x30 [ 683.149388][ T446] [ 683.149394][ T446] [ 683.285010][ T446] Allocated by task 881: [ 683.289249][ T446] kasan_save_track+0x3e/0x80 [ 683.293946][ T446] kasan_save_alloc_info+0x40/0x50 [ 683.299165][ T446] __kasan_slab_alloc+0x73/0x90 [ 683.304091][ T446] kmem_cache_alloc_node_noprof+0x139/0x3b0 [ 683.310006][ T446] __alloc_skb+0x10c/0x370 [ 683.314461][ T446] hci_cmd_sync_alloc+0x3b/0x320 [ 683.319448][ T446] __hci_cmd_sync_sk+0x12d/0xa50 [ 683.324402][ T446] hci_dev_open_sync+0x1053/0x2980 [ 683.329528][ T446] hci_power_on+0x199/0x570 [ 683.334090][ T446] process_scheduled_works+0x7d5/0x1020 [ 683.339658][ T446] worker_thread+0xc58/0x1250 [ 683.344337][ T446] kthread+0x2c7/0x370 [ 683.348409][ T446] ret_from_fork+0x67/0xa0 [ 683.352833][ T446] ret_from_fork_asm+0x1a/0x30 [ 683.357602][ T446] [ 683.359919][ T446] Freed by task 17246: [ 683.363998][ T446] kasan_save_track+0x3e/0x80 [ 683.368669][ T446] kasan_save_free_info+0x4a/0x60 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 683.373696][ T446] __kasan_slab_free+0x5f/0x80 [ 683.378460][ T446] kmem_cache_free+0x1c1/0x510 [ 683.383229][ T446] __kfree_skb+0x18f/0x210 [ 683.387655][ T446] sk_skb_reason_drop+0xd8/0x310 [ 683.392588][ T446] hci_uart_flush+0xa0/0x380 [ 683.397185][ T446] hci_uart_tty_close+0x7e/0x230 [ 683.402141][ T446] tty_ldisc_hangup+0x4dc/0x6e0 [ 683.407026][ T446] __tty_hangup+0x585/0x810 [ 683.411539][ T446] tty_ioctl+0x7c9/0xec0 [ 683.415797][ T446] __se_sys_ioctl+0x132/0x1b0 [ 683.420482][ T446] __x64_sys_ioctl+0x7f/0xa0 [ 683.425091][ T446] x64_sys_call+0x1878/0x2ee0 [ 683.429812][ T446] do_syscall_64+0x58/0xf0 [ 683.434270][ T446] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 683.440204][ T446] [ 683.442548][ T446] The buggy address belongs to the object at ffff8881237be8c0 [ 683.442548][ T446] which belongs to the cache skbuff_head_cache of size 256 [ 683.457148][ T446] The buggy address is located 232 bytes inside of [ 683.457148][ T446] freed 256-byte region [ffff8881237be8c0, ffff8881237be9c0) [ 683.470985][ T446] [ 683.473330][ T446] The buggy address belongs to the physical page: [ 683.479758][ T446] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1237be [ 683.488649][ T446] flags: 0x4000000000000000(zone=1) [ 683.493882][ T446] page_type: f5(slab) [ 683.497917][ T446] raw: 4000000000000000 ffff88810664a500 ffffea00048fff80 dead000000000004 [ 683.506615][ T446] raw: 0000000000000000 00000000000c000c 00000001f5000000 0000000000000000 [ 683.515206][ T446] page dumped because: kasan: bad access detected [ 683.521630][ T446] page_owner tracks the page as allocated [ 683.527342][ T446] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x172820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_MEMALLOC|__GFP_HARDWALL), pid 331, tgid 331 (kworker/0:2), ts 641113985038, free_ts 641045590511 [ 683.549318][ T446] post_alloc_hook+0x3b9/0x3f0 [ 683.554101][ T446] prep_new_page+0x1c/0x120 [ 683.558611][ T446] get_page_from_freelist+0x48ce/0x4960 [ 683.564165][ T446] __alloc_pages_noprof+0x31f/0x7b0 [ 683.569373][ T446] alloc_slab_page+0x6b/0x1f0 [ 683.574058][ T446] allocate_slab+0x69/0x440 [ 683.578568][ T446] ___slab_alloc+0x59a/0x8b0 [ 683.583166][ T446] kmem_cache_alloc_node_noprof+0x20a/0x3b0 [ 683.589077][ T446] __alloc_skb+0x10c/0x370 [ 683.593506][ T446] __netdev_alloc_skb+0x108/0x420 [ 683.598542][ T446] br_send_bpdu+0x31/0x4f0 [ 683.602967][ T446] br_send_config_bpdu+0x45e/0x730 [ 683.608086][ T446] br_transmit_config+0x3e7/0x6c0 [ 683.613121][ T446] br_config_bpdu_generation+0x126/0x1d0 [ 683.618758][ T446] br_hello_timer_expired+0x95/0x180 [ 683.624054][ T446] call_timer_fn+0x49/0x300 [ 683.628596][ T446] page last free pid 9 tgid 9 stack trace: [ 683.634403][ T446] free_unref_page+0xb4d/0xee0 [ 683.639182][ T446] __free_pages+0x6b/0x3b0 [ 683.643614][ T446] __free_slab+0xb6/0x110 [ 683.647953][ T446] free_slab+0x18/0xf0 [ 683.652029][ T446] __put_partials+0x11b/0x150 [ 683.656717][ T446] put_cpu_partial+0x91/0xc0 [ 683.661317][ T446] __slab_free+0x1d3/0x2b0 [ 683.665744][ T446] ___cache_free+0xc9/0xe0 [ 683.670177][ T446] qlist_free_all+0xb5/0x130 [ 683.674780][ T446] kasan_quarantine_reduce+0x14f/0x180 [ 683.680255][ T446] __kasan_slab_alloc+0x28/0x90 [ 683.685113][ T446] kmem_cache_alloc_node_noprof+0x139/0x3b0 [ 683.691022][ T446] __alloc_skb+0x10c/0x370 [ 683.695465][ T446] mld_newpack+0x152/0x9e0 [ 683.699913][ T446] add_grhead+0x67/0x310 [ 683.704164][ T446] add_grec+0xf16/0x11e0 [ 683.708411][ T446] [ 683.710740][ T446] Memory state around the buggy address: [ 683.716407][ T446] ffff8881237be880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 683.725166][ T446] ffff8881237be900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 683.733236][ T446] >ffff8881237be980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 683.741298][ T446] ^ [ 683.746668][ T446] ffff8881237bea00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 683.754730][ T446] ffff8881237bea80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 683.762791][ T446] ================================================================== [ 683.862198][ T446] Disabling lock debugging due to kernel taint [ 683.946876][ T36] kauditd_printk_skb: 782 callbacks suppressed [ 683.953137][ T36] audit: type=1400 audit(5038.920:4822): avc: denied { read } for pid=92 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 684.001327][ T36] audit: type=1400 audit(5038.930:4823): avc: denied { search } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 684.034133][ T36] audit: type=1400 audit(5038.930:4824): avc: denied { write search } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 684.056848][ T36] audit: type=1400 audit(5038.930:4825): avc: denied { add_name search } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 684.078371][ T36] audit: type=1400 audit(5038.930:4826): avc: denied { create } for pid=92 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 684.104040][ T36] audit: type=1400 audit(5038.930:4827): avc: denied { append open } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 684.127029][ T36] audit: type=1400 audit(5038.930:4828): avc: denied { getattr } for pid=92 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 684.149590][ T36] audit: type=1400 audit(5038.930:4829): avc: denied { read } for pid=92 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 684.170948][ T36] audit: type=1400 audit(5038.930:4830): avc: denied { search } for pid=92 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 684.191934][ T36] audit: type=1400 audit(5038.930:4831): avc: denied { append } for pid=92 comm="syslogd" name="messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 684.285742][ T4813] bridge_slave_1: left allmulticast mode [ 684.291424][ T4813] bridge_slave_1: left promiscuous mode [ 684.297120][ T4813] bridge0: port 2(bridge_slave_1) entered disabled state [ 684.304699][ T4813] bridge_slave_0: left allmulticast mode [ 684.310387][ T4813] bridge_slave_0: left promiscuous mode [ 684.316312][ T4813] bridge0: port 1(bridge_slave_0) entered disabled state [ 684.324195][ T4813] bridge_slave_1: left allmulticast mode [ 684.329870][ T4813] bridge_slave_1: left promiscuous mode [ 684.335555][ T4813] bridge0: port 2(bridge_slave_1) entered disabled state [ 684.343142][ T4813] bridge_slave_0: left allmulticast mode [ 684.348953][ T4813] bridge_slave_0: left promiscuous mode [ 684.354640][ T4813] bridge0: port 1(bridge_slave_0) entered disabled state [ 684.383557][ T54] Bluetooth: hci0: command 0x1003 tx timeout [ 684.389732][ T881] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 684.395922][ T881] ------------[ cut here ]------------ [ 684.401423][ T881] refcount_t: underflow; use-after-free. [ 684.407354][ T881] WARNING: CPU: 1 PID: 881 at lib/refcount.c:28 refcount_warn_saturate+0x119/0x1c0 [ 684.416755][ T881] Modules linked in: [ 684.420699][ T881] CPU: 1 UID: 0 PID: 881 Comm: kworker/u9:2 Tainted: G B syzkaller #0 999ed7ff739122807d950cd03a17deb2b8fbe7d9 [ 684.433923][ T881] Tainted: [B]=BAD_PAGE [ 684.438100][ T881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 684.448224][ T881] Workqueue: hci0 hci_power_on [ 684.453072][ T881] RIP: 0010:refcount_warn_saturate+0x119/0x1c0 [ 684.459285][ T881] Code: 05 01 48 c7 c7 e0 6c 31 86 e8 e3 a2 5e fe 0f 0b eb da e8 fa 45 e0 fe c6 05 0e 2f 1e 05 01 48 c7 c7 40 6d 31 86 e8 c7 a2 5e fe <0f> 0b eb be e8 de 45 e0 fe c6 05 ef 2e 1e 05 01 48 c7 c7 80 6c 31 [ 684.478975][ T881] RSP: 0018:ffffc9000cddf958 EFLAGS: 00010246 [ 684.485112][ T881] RAX: 1aa871d1aa4eef00 RBX: 0000000000000003 RCX: ffff888137be4c00 [ 684.493196][ T881] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 684.501356][ T881] RBP: ffffc9000cddf968 R08: 0000000000000003 R09: 0000000000000004 [ 684.509417][ T881] R10: dffffc0000000000 R11: fffffbfff0e5ef18 R12: ffff8881237be9b4 [ 684.517572][ T881] R13: 0000000000000000 R14: ffff8881237be9b4 R15: 0000000000000000 [ 684.525685][ T881] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 684.535115][ T881] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 684.541768][ T881] CR2: 00007f95585abf70 CR3: 000000010b3a0000 CR4: 00000000003526b0 [ 684.549957][ T881] DR0: 0000000000000002 DR1: 0000000000000005 DR2: 8000000000000000 [ 684.558154][ T881] DR3: 1000000100000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 684.566211][ T881] Call Trace: [ 684.569523][ T881] [ 684.572497][ T881] sk_skb_reason_drop+0x101/0x310 [ 684.577764][ T881] hci_uart_flush+0xa0/0x380 [ 684.582471][ T881] hci_uart_close+0x19/0x50 [ 684.587028][ T881] hci_dev_open_sync+0x2118/0x2980 [ 684.592203][ T881] ? __cfi_hci_dev_open_sync+0x10/0x10 [ 684.597705][ T881] ? __switch_to+0xc7b/0x1310 [ 684.602444][ T881] ? psi_group_change+0xb44/0x1130 [ 684.607600][ T881] ? __kasan_check_write+0x18/0x20 [ 684.612868][ T881] ? mutex_lock+0x92/0x1c0 [ 684.617320][ T881] ? __cfi_mutex_lock+0x10/0x10 [ 684.622219][ T881] ? _raw_spin_unlock+0x45/0x60 [ 684.627145][ T881] hci_power_on+0x199/0x570 [ 684.631847][ T881] ? __cfi_hci_power_on+0x10/0x10 [ 684.636951][ T881] ? kick_pool+0xb9/0x550 [ 684.641391][ T881] process_scheduled_works+0x7d5/0x1020 [ 684.647001][ T881] worker_thread+0xc58/0x1250 [ 684.651758][ T881] ? schedule+0xc6/0x240 [ 684.656618][ T881] kthread+0x2c7/0x370 [ 684.660716][ T881] ? __cfi_worker_thread+0x10/0x10 [ 684.665908][ T881] ? __cfi_kthread+0x10/0x10 [ 684.670582][ T881] ret_from_fork+0x67/0xa0 [ 684.675137][ T881] ? __cfi_kthread+0x10/0x10 [ 684.679787][ T881] ret_from_fork_asm+0x1a/0x30 [ 684.684652][ T881] [ 684.687704][ T881] ---[ end trace 0000000000000000 ]--- [ 684.834947][ T4813] veth1_macvtap: left promiscuous mode [ 684.840593][ T4813] veth0_vlan: left promiscuous mode [ 684.846148][ T4813] veth1_macvtap: left promiscuous mode [ 684.851807][ T4813] veth0_vlan: left promiscuous mode [ 684.872083][ T65] usb 5-1: USB disconnect, device number 45 [ 685.298421][ T4813] bridge_slave_1: left allmulticast mode [ 685.304114][ T4813] bridge_slave_1: left promiscuous mode [ 685.309796][ T4813] bridge0: port 2(bridge_slave_1) entered disabled state [ 685.317631][ T4813] bridge_slave_0: left allmulticast mode [ 685.323313][ T4813] bridge_slave_0: left promiscuous mode [ 685.329160][ T4813] bridge0: port 1(bridge_slave_0) entered disabled state [ 685.458270][ T4813] veth1_macvtap: left promiscuous mode [ 685.463862][ T4813] veth0_vlan: left promiscuous mode