last executing test programs: 4.438134279s ago: executing program 1 (id=324): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) setresgid(0xee00, 0xee01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r3 = syz_open_procfs(r2, &(0x7f00000001c0)='fdinfo\x00') r4 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_int(r4, 0x29, 0x18, 0x0, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x89101) chroot(&(0x7f0000000040)='./file0\x00') syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000200)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r5, @ANYBLOB="05", @ANYRES8=0x0, @ANYBLOB="454e0072d7585aff1e3364caa1b8654d029ee5764bf7ccb23a0abc97a729d0adea91e374ea355a10bc198dede5a659ba4c4f56abb779f3917a17ceb1d207a962", @ANYRES64=r3, @ANYRESOCT=r3, @ANYRES64=r1], 0x0) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, &(0x7f0000000080)=0x11, 0x4) 3.211617829s ago: executing program 1 (id=338): ioctl$KVM_CAP_X86_NOTIFY_VMEXIT(0xffffffffffffffff, 0x4068aea3, &(0x7f00000002c0)={0xdb, 0x0, 0x10000}) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x402, 0x0) fremovexattr(r0, &(0x7f0000000480)=@random={'osx.', 'cpuacct.usage_percpu_user\x00'}) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000100000,user_i']) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, 0xffffffffffffffff, 0x0) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ftruncate(r3, 0x2d) preadv(0xffffffffffffffff, &(0x7f0000000580)=[{&(0x7f0000000080)=""/115, 0x73}, {&(0x7f00000004c0)=""/141, 0x8d}], 0x2, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000005c0)=0x0) syz_open_procfs(r5, &(0x7f0000000600)='fd/3\x00') syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0x9, 0xe, 0x0, 0x0, 0x2, 0x2, '\x00', 0x654}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_connect$printer(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201"], 0x0) syz_usb_ep_write$ath9k_ep2(r6, 0x83, 0x8, &(0x7f00000000c0)=ANY=[]) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000440)) ioctl$KVM_PRE_FAULT_MEMORY(r7, 0xc040aed5, &(0x7f0000000040)={0xeeef0000, 0x1000}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x4, 0x10, r8, 0x0) io_pgetevents(0x0, 0x80055, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x3}) 1.576793375s ago: executing program 0 (id=362): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x1a9d42, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000240)=ANY=[@ANYBLOB="010000000000000001000000000000000000000000000000001b0300ff"]) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000008904"]) r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read(r4, &(0x7f0000000000), 0x2002) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_GET_CPUID2(r5, 0xc008ae91, &(0x7f0000000280)={0x5, 0x0, [{}, {}, {}, {}, {}]}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/75, 0x4b, 0x0, 0x32}, @fda={0x66646185, 0x7, 0x0, 0x16}, @ptr={0x70742a85, 0xfffffffc, 0x0, 0x0, 0x1}}, &(0x7f00000004c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x1a9d42, 0x0) (async) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000240)=ANY=[@ANYBLOB="010000000000000001000000000000000000000000000000001b0300ff"]) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000008904"]) (async) openat$urandom(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) read(r4, &(0x7f0000000000), 0x2002) (async) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) (async) ioctl$KVM_GET_CPUID2(r5, 0xc008ae91, &(0x7f0000000280)={0x5, 0x0, [{}, {}, {}, {}, {}]}) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000580)={@ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/75, 0x4b, 0x0, 0x32}, @fda={0x66646185, 0x7, 0x0, 0x16}, @ptr={0x70742a85, 0xfffffffc, 0x0, 0x0, 0x1}}, &(0x7f00000004c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) (async) 1.575514225s ago: executing program 0 (id=363): r0 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00', 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmmsg$inet(r0, &(0x7f0000000600)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}, {{&(0x7f0000000380)={0x2, 0x4e01, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000500)=[@ip_retopts={{0x14, 0x0, 0x7, {[@ra={0x94, 0x4, 0x1}]}}}], 0x18}}], 0x2, 0xe000) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3d, &(0x7f0000000040)=0x10, 0x4) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000180)=ANY=[@ANYBLOB='defcontext']) socket$inet(0x2, 0x3, 0x4) (async) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) (async) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00', 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmmsg$inet(r0, &(0x7f0000000600)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}, {{&(0x7f0000000380)={0x2, 0x4e01, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000500)=[@ip_retopts={{0x14, 0x0, 0x7, {[@ra={0x94, 0x4, 0x1}]}}}], 0x18}}], 0x2, 0xe000) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x3d, &(0x7f0000000040)=0x10, 0x4) (async) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000180)=ANY=[@ANYBLOB='defcontext']) (async) 1.553160715s ago: executing program 0 (id=364): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r0, 0x40082102, &(0x7f0000000080)) r1 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r2, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r2, 0x26, &(0x7f0000000080)={0x1, 0x0, 0x2007, 0x1fd}) fcntl$lock(r2, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x2f, 0x9}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x8000000000000001) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0xf, &(0x7f0000000080)=0x1, 0x4) 1.462872707s ago: executing program 2 (id=365): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000380)={'nr0\x00', &(0x7f0000002200)=@ethtool_sset_info={0x37, 0x7fff, 0x102}}) chdir(&(0x7f0000000080)='./cgroup\x00') r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = accept4(r1, &(0x7f0000000240)=@generic, &(0x7f00000001c0)=0x80, 0x800) r4 = getpid() syz_pidfd_open(r4, 0x0) ioctl$NS_GET_OWNER_UID(r2, 0xb704, &(0x7f00000002c0)=0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) fstat(r6, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) r10 = getpid() sendmsg$netlink(r9, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)={0x10, 0x21, 0x4, 0x70bd28, 0x25dfdbfd}, 0x10}], 0x1, &(0x7f0000000400)=[@cred={{0x1c, 0x1, 0x2, {r10, r7, r8}}}], 0x20, 0x4}, 0x0) setsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000300)={r4, r5, r8}, 0xc) sendmsg$SOCK_DESTROY(r2, &(0x7f0000000180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000140)={&(0x7f0000000840)=ANY=[@ANYBLOB="940200001500020028bd7200fcdbdf25010873000100cdc98a8c70efea892c116dd5c1bd6daad0b07176e2f10a7465fa3c2b1ced2967f60107a4703dfc5b8ab90e917d369e58a59e13e8ab83f234814d919580ca70b740fdc95e33194c77cb874fd00d7aa4b5963b11f702997ce44f68b0622f84894517321cccc8fd744fb57617873e339f002d00010081f7392b0eb5e3d7143c641100524fbd0c3b7b63b4de6ddf2696d10437a157049a8e52ac29c45d8b65000000c60001007f454475a83067b72f8ec5c1e1da3236e86b97d4e5ab1e57c2afa335db8523e689b749bbf620dcae5823beab390096aa313a5f65606cc672cccc88751e04ead14ec1cf4907b606a119c9a3014bd0d6ca3dcb73abb868bfb684530e6b6f364d7e7ca2ebbaa8eda03a9b88e18e687d8e41dde051be91bca4d23d52bfef9da508313aa8fff3867dfcc656b54b84f3f9c58332bf864fce0cb7044b8026438f8427e6dd0a50b6bc35dd248cb7f9030df8711b4c7baeed2b45cec3186522feef839893c39000003d000100dbe535f7524f8b1383aaa49720d43636b516398eae940c8c84b665c0897154efcfbc552dc68b0cdaf78e3ffd22b3f2365b659fd3518bae85c0000000d2000100324e7151d96a1ce6b326f7610746dda3d8dad4e94bed8c14bcefc5d2d0b5827c79e422ed2dbcb61667587971ceae3c24bf8ed73498a5958687f3097cc4676d124af5e1461579b7724fb6e237864c1f16d06fe6afc093df8428340da075a7a9d5c8dc0b8e14ecad9a8f81cbfdc46ad093b516ed734e2ba4ebe555a1109706cdd4dc1207cc383fd6c4a40f452721a250cd5debd3cf11c8e8beab4efa38dd3481a949b4b2ba3fed4af00c0e6e8188a76d149680ae27c6cd9785e20b3605dafe991b8f818510f3af61fa7a85cd04972500000000b36c546fdf2dc17cb81076ebe70e1a07d5b93f73952a90e940f444060b84728400b1ff1b350e6283b01e3d877163454dfeb7d7b7680c86e9aeb19a47fffedf6b2187ff2d0f05d37394f4d5838da904e624a938cf46ed8b21815b28ed2ccb9eb044f3ad98e17af295fa58e0b6b3d6465f34a8909ac5156c94cce18621c501987880416a9910932446ca86f4e5477eecd8d499ac4ec14e1c20b5066103cd40a1a99a7cea3d2aa71366de8f2ed7a9f1e6278fd41ae19fb2fc76c2a6f046f4382d9dc21e2a763bc96caff929297647a8af1e613c8f445bd863c35cf59696a26c58e24175ae98b792352284c08b693a728a4026bedc26bbd7d0d43b0833b1349398fe8454a75ac3602da71deb3f948cb343808e9cab36bba231315052359c65d3fe0bb9a7f6464151686d59cc7e29a3eccf09b8989a6c58553268ebb3941af84508d761308331f4a3a78870345a3510e34e4e8a3ae9fd62b391178975c4056985f8fac47dccad2d437cf013bb5e190f011e5dc97e"], 0x294}}, 0x800) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f0000000540)={0x0, 0x80000000, 0x6570}) r11 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0xc0000, 0x0) getdents64(r11, &(0x7f0000004340)=""/159, 0x9f) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'gre0\x00', 0x20}) 1.386039018s ago: executing program 2 (id=366): ioprio_set$uid(0x3, 0x0, 0x0) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async, rerun: 32) r1 = socket$packet(0x11, 0x3, 0x300) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'veth1_to_hsr\x00', 0x0}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) (async) sendto$packet(r1, &(0x7f00000000c0)="3f031c00dce0140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000100)={{{@in=@dev={0xac, 0x14, 0x14, 0x3b}, @in=@empty, 0x4e20, 0x7580, 0x4e20, 0x7, 0xa, 0x0, 0x20, 0x2, r2, r3}, {0x2, 0x6, 0x6, 0x8001, 0x0, 0x8000000000000000, 0xffffffffffffffff, 0xffffffffffffd194}, {0x5, 0x100000000, 0x516, 0x9}, 0x10, 0x6e6bb3, 0x0, 0x1, 0x2, 0x2}, {{@in6=@local, 0x4d6, 0x32}, 0x8, @in=@empty, 0x3502, 0x0, 0x3, 0x9, 0xffff9ae1, 0x9, 0x5f0a}}, 0xe8) (async) r4 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_opts(r4, 0x0, 0x4, 0x0, 0x0) (async, rerun: 64) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000002c0)='veth1_virt_wifi\x00', 0x10) (rerun: 64) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000280)={0x3, &(0x7f0000000200)=[{0xa000, 0x0, 0x4, 0x46}, {0x9, 0x7f, 0x2, 0xae0d}, {0x2, 0x0, 0x81, 0x2}]}, 0x10) sendmsg$inet(r4, &(0x7f0000000040)={&(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000000100)=[{&(0x7f00000001c0)="08001efb3e6f0000", 0x8}], 0x1, 0x0, 0x0, 0xe0000000}, 0x0) (async) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x88}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8) (async, rerun: 64) r5 = syz_clone(0x1000000, 0x0, 0xfffffd11, 0x0, 0x0, 0x0) (async, rerun: 64) fchdir(0xffffffffffffffff) mount(0x0, 0x0, 0x0, 0x0, 0x0) (async) r6 = gettid() syz_pidfd_open(r6, 0x0) (async) syz_open_procfs(r5, 0x0) (async) sendfile(r0, r0, 0x0, 0x7ffff000) 1.385098558s ago: executing program 2 (id=367): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) syz_usb_connect(0x0, 0x45, &(0x7f0000002d80)={{0x12, 0x1, 0x0, 0xc9, 0xd1, 0xc4, 0x8, 0x499, 0x500a, 0xe7b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x33, 0x2, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x97, 0x0, 0x1, 0xd, 0xd5, 0xce, 0x0, [@uac_as={[@format_type_i_continuous={0x8}]}], [{{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x7, 0x5, "a3f6d2fb5b"}]}}]}}, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x41, 0x6, 0xcf}}]}}]}}, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) r2 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_int(r2, 0x0, 0x13, &(0x7f0000000040)=0x7, 0x4) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4e21, @remote}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000200)="08001efbb0", 0x5}, {&(0x7f0000000180)="d0849e", 0x3}], 0x2, 0x0, 0x0, 0x60000000}, 0x20000004) close_range(r0, 0xffffffffffffffff, 0x0) 698.571599ms ago: executing program 0 (id=384): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60e41, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x20400, 0x0) (async) socketpair(0x2, 0xa, 0x8, &(0x7f0000000300)) (async) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x6, 0x9, &(0x7f0000000080)={{0x3a, @rand_addr=0x64010100, 0x2, 0x2, 'sh\x00', 0x0, 0x0, 0x7c}, {@broadcast, 0x4, 0x0, 0x663, 0x2, 0xfffffffe}}, 0x82) getsockopt$inet_tcp_int(r1, 0x6, 0x9, 0x0, &(0x7f0000000040)) (async, rerun: 64) r2 = socket$inet_icmp(0x2, 0x2, 0x1) (rerun: 64) ioctl$sock_SIOCINQ(r2, 0x541b, 0x0) (async) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r2, 0x8982, &(0x7f0000000100)={0x0, 'wg2\x00', {}, 0x8}) (async) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000140), 0x8001, 0x0) (async, rerun: 64) ioctl$BLKPG(r0, 0x1269, 0x0) (rerun: 64) 598.027541ms ago: executing program 0 (id=387): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeef, 0x8031, 0xffffffffffffffff, 0x1000) r0 = userfaultfd(0x0) tee(r0, r0, 0xfff, 0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x4000000, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0x2, 0xf, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x40}}, 0x0) mkdir(&(0x7f0000001f40)='./file0\x00', 0x84) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000001000/0x3000)=nil, 0x3000}, 0x7}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000180)=ANY=[]) madvise(&(0x7f00001d7000/0x4000)=nil, 0x4000, 0x12) 509.381572ms ago: executing program 0 (id=391): r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)=ANY=[@ANYBLOB="240000005f304433b3c4d403b4c4ddca0e3cf4c122da00a646d2f5d832c05d66d0c0e7f6a1e88d3116c882674e74c604eab452ac64e43e8effe88a272982ecf2ef60b197aa20a77eb246d253986c65bb78cb8bd43cee3440b80f4fc8720bf57f597c50f8b2373f9a67f3e6511c9bcadd35d5cb65433d9e4a97b8a71c5fb1f84d973937eb4ce52122c6d0441ffca0a1bb962430859b3ebbb7782a4e014285611f3adb985f54b120b42a6b64a654918151ae42fa286de83507118c213a27209c9905c676164775c1aa94f5d41ad4a1660f0f3b24109bd9f70bb1ec61eb2516a8fbbf1dda"], 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x4000000) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r5 = inotify_init() inotify_add_watch(r5, &(0x7f00000005c0)='./file0\x00', 0x309) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) sendmmsg$inet6(r4, &(0x7f0000000d80)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x0, @remote, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="38020000000000002900000036000000004300000000000004013f040100c910ff010000000000000000000000000001c910fc0000000000000000000000000000000001000740000000000e07010101000000010000000200000000000000000000000000000001000000010000002000000000000000ffffffff00000000ffffffffffffff7f06aeb07c1c192077cc9e7c45705803ad5588ca8b194d23f748fe792cfa3d32221f25d73b8ffe64a4ddda6efcfb7483b588194d29c7a04395d8500965a9a1d07879040c44db1d5d6f618d2ab920f0bf168ddc9acc6a51edd1230760d4ae8bf30f5f82a78e8114849ee8e37364560400000035bfa8197ef2ba99103ee5f5aae28ec5c8e2675db11530f5c466d55f2244d479dc653c854406155eada3eaeb90d39149b8d13bab75a9bd1452c8c76284b9ddfbeff41344e64f1771d78a706e1c5a6d63f1c954e24a1e73f75c26e9f09ec9b606cc3470f11c4842db651926bd2263a4a0a8fe80de8b2f9cb176e51819d5f4d10a5d1f0488d5e46953fbfd750f6137fbebe89a8d462158a87f9622355104b4f68d7a6d3ad85c373ea52a25afad37ffb743a5c361158087904b09fcc806d032bac00ee0e0251fc032446e45a3e12417ff4703526ffc45f71567857777927903799e0ba453334186009d22e38099c67b5350c7e82136bba947a18fb61d36fcba1f9efe3d79485d06252702833dc8ee417f40bb9064878fb89dd75a49135e5df148c4ad1e1d5626b44c8112d822f4c9a05e693fd5ae5595627f8684016b37a2bf6d0040030000000000002900000037000000006500000000000000fb1a63687c244e6df3aecb13d6eb957495b669cc032f6d0a11a5e16eed9937b046c9dc1a61dcf9754b767df4735c3f8c37b4d5cd15a99c5a19cc62c921ad4e90d6e3695e85000000a53600d5031b5735acafb556e22279975f958ad437c76573e544506e58455772eb11493af933099a5dc7e9e0c8b907e68e23e59d7b94bc774309e2047132758b60955301f277a9032b0bc47e660b243e9e2126733f13ab99055a0999068ada35a38d105a5efe6c7115774effe28695ecae3944413b7764eefde26ed571d857b2cb2dd1b2a4a84c1fec0799cf90f57f7a6d35e2b60cd425b9372ae4a27f453e5d7da2eacd3b98cdb10cec9152d5829c2511eb0f9600a0cd280f3d08849b6cd43d25e3dcd62f7c7dee6123a2682daf4aa9a856b31e9204c5c2b80b84dbeec05d93a64a550f1ebc326488cd620c6fe1aa266a0ce5b24be03b5037786e037cc85ed61f362e081fb694e12e54fcb9eb0f86d6d91fd159023a073278f84d6ada8f9aa25ec223d268f3291b25392c941740932bd1a82f40a8fc586db23d2f6240ce883e3c1dc1e0d07fc3aa73a9ac82a1538d129c9e66cb6a8100abe95bc4064581e8c01ce65ba3ea751db5d8c0a1173fe62b2fd2d415042a97ade4d274a466b6d997eed6bf5d7a305ead804c36b9e1c314b26676ed83412417610d3cf4d07e5b24cf3de9c790ae93850e0f8bba047b710cf340c78a80cef5f6665a647681ff5f7b6ecce8ab65e26406b6a6e0e72ff8501c545bffc00f034dc3a5b251390ae68bb61d936dc9a24e6f66c72e7911c51c716dfd4304566fb32e6c2745d232f990d0bbe0ddf9dc58398dda292c07b16da766a37c60bd9993b4f21e641036a8afa2ccdb47d7990d5a007faccb2f86664179f2e229723bce870aec3f7f4e529c92add713590ce6c0ea1a0499fb76d32636cfd18b6b39fb48f1a6d46f6ae8f45c47ee8260f9531070d170ab92739be0bdf5b76f8a9b93a5e550dfecab79d2e46085a67024b6be883c79ade2873458fda5a7f4eb62b05634356ee3b45723f4cff19c654ad441ff5b8792df7f18d841c351e195151b1b3532e742a6525c86efdb29653f35ce8e0a41c8c6d39f39531e13aeb1172893eeedd83b6afb939f8e6abc5482696aa48918000000000000002900000037"], 0x590}}], 0x1, 0x8008801) r6 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f00000004c0)=[{0x80000006, 0x7, 0x12, 0xf9}]}, 0x10) sendmmsg$inet6(r4, &(0x7f00000002c0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000ac0)="049fcefd2946c3f2c3deeb710f3237dd1bcc1a9a0835ccfd5dee43679a113597f057e0f19b36fc6da47f5e77368d7b77d9e65e3dfa843cd10fdb1e5c5026f2f4a02f47f8d9976e0ce5cb338700fa5fdc60c8b8c413", 0x55}], 0x1}}], 0x1, 0x2604082c) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="b858008ee8f3d919034bdf2ef0200628002ede46520f0666b8d10000000f23d80f21f86635c00000c00f23f80fae030f01cf67660f3808a5db7f0000", 0x3c}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000295000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000300)="8ee8c4e2919024b165650fc7b0a39e00003e0f38079c76dc1f63160f20e035000002000f22e0b9470b00000f320f0666bad00466b82dc666efb9800000c00f3235000100000f30c74424003ada0000b9560a00000f32c7442406000000000f011c244d", 0x63}], 0x1, 0xbf, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0x1, 0x0, 0x0, 0x733ac74, 0x0, 0x10, 0x40, 0x0, 0x0, 0x9, 0x1, 0x0, 0x0, 0x0, 0x0, 0xff, 0x6e, 0x2}) ioctl$KVM_RUN(r7, 0xae80, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x1) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) setpriority(0x2, 0xff, 0x0) r8 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r8, 0x45809000) 388.383124ms ago: executing program 3 (id=395): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r2, &(0x7f0000c00000/0x400000)=nil) ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000000)={0x400, 0x321cf61e, 0x6, 0x2, 0x9, 0x0, 0x95ff}) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2, 0x12, r0, 0x7405e000) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000f57000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="0f01c366b9490800000f3266b8019800000f23c80f21f86635080050000f23f89a00981400b879000f00d0360f01c53e2e0f78cdb839000f00d06564de5400440f20c0663503000000440f22c0", 0x4d}], 0x1, 0x49, &(0x7f0000000140), 0x0) 383.508784ms ago: executing program 3 (id=396): mount$bpf(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x400418, 0x0) (async) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='devpts\x00', 0x4, 0x0) (async) mount$bpf(0x0, &(0x7f0000001080)='./file0\x00', 0x0, 0x1964874, &(0x7f0000000300)=ANY=[@ANYBLOB='uid=', @ANYRESHEX=0x0]) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) (async, rerun: 64) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 64) setsockopt$inet6_tcp_int(r0, 0x6, 0x8, &(0x7f0000000000)=0xfffffffd, 0x4) getsockopt$inet6_tcp_buf(r0, 0x6, 0x8, 0x0, &(0x7f0000001040)) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') lsetxattr$trusted_overlay_nlink(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000100)={'L+', 0xe1d6}, 0x16, 0x1) (async) lseek(r1, 0x10001, 0x0) 322.106785ms ago: executing program 3 (id=397): fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x3) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r3) sendmsg$ETHTOOL_MSG_DEBUG_SET(r3, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002007f00000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x8, 0x0, &(0x7f00000001c0)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, 0x0}) r6 = gettid() ptrace(0x8, r6) 320.749415ms ago: executing program 3 (id=398): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x92) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@loopback, 0x0, 0x0, 0xffff, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x6c}, 0x0, @in6=@empty, 0x0, 0x0, 0x0, 0x3}}, 0xe8) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) fcntl$setlease(r2, 0x400, 0x3) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@userxattr}]}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r3, &(0x7f0000000980)={0x2020}, 0x160e) 313.234405ms ago: executing program 3 (id=399): timer_create(0x1, 0x0, &(0x7f0000000380)=0x0) timer_delete(r0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x280, 0x0) r2 = fsopen(&(0x7f0000000140)='tracefs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x5) fchdir(r3) open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents(r3, 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x8000) ioctl$ASHMEM_SET_PROT_MASK(r1, 0x40087705, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x300000c, 0x12, r1, 0x4d75c000) 308.911385ms ago: executing program 3 (id=400): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000004000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000440005"], 0xfc}}, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0xb03cdf087638818c, 0x3}) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000006c0)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) fcntl$lock(r2, 0x25, &(0x7f0000000100)={0x0, 0x2, 0x80000000000fffe, 0x40000001}) socket$inet(0x2, 0x4, 0xb) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000020bd28940000000000000109022400010000000009040100010300000009210000000122070009058103"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) (async) syz_usb_control_io(r3, &(0x7f0000000240)={0x2c, &(0x7f00000002c0)=ANY=[@ANYBLOB="203107cacc61d1d50001000000d07aa746f5bf3a89110d47a292219c0b7def8c8f181f92f1503403c9d3592c2065f1d836cedc6b1154ac35a828ba2a3c1a07f38965937433e35be8daa68a1931cb165b66ef2e73f086710dd87c4f94349da19a5da693fd055254dd5b9e408b89c833e81e827ec937fbfc3d2310899a6d8cac16fc95e6d417845bf2c503edd2a5d60ec2ac5ecb12100d05c563e0989e32aba886c85b9e1f196f89e0bbfdf8b5a2d44731609b99363cc9e4fe719273fd94746100fca8080693cc19e50b885df7f21e7f31cadf8795f3885eb723c1fbe27f880349aae48e9f48573eb1b431b7eca0b2af941f09f3d22913929104189d627c4ea6443d99735549f2c7722186cd"], 0x0, 0x0, 0x0, 0x0}, 0x0) (async) fcntl$lock(r2, 0x6, &(0x7f0000000080)={0x0, 0x2, 0x1, 0x9}) (async) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/resume', 0x840080, 0x2) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') dup2(r4, r5) (async) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x8000000000000000) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x9e, 0x17, 0x36, 0x10, 0x17ef, 0x721e, 0xde06, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6}}]}}]}}, 0x0) syz_usb_control_io$uac1(r6, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r6, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000380)={0x20, 0xf, 0x1, "80"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0xff06, &(0x7f0000000000)={@fd, @fd, @flat=@binder={0x73622a85, 0x1000, 0x3}}, &(0x7f0000000280)={0x0, 0x18, 0x30}}, 0x10}], 0x0, 0x0, 0x0}) (rerun: 32) 161.218747ms ago: executing program 1 (id=401): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0x0) fchdir(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) lseek(r3, 0x3, 0x0) getdents(r3, 0x0, 0x0) r4 = dup(r0) ioctl$BLKCRYPTOPREPAREKEY(r4, 0xc040128b, &(0x7f00000000c0)={&(0x7f0000000000)="4ee3ba5e86ca172891b21a648628d2275613eab8f7ee0fef03ec14c0ffbb9c6a675f5d67061e5dcdc0e46f7527146edc426f580888e57390a399211604543509cc71628c1d083c7b17f3", 0x4a, &(0x7f0000000080)=""/64, 0x40}) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000140)={&(0x7f0000ffc000/0x2000)=nil, 0x2000}) ioctl$IOC_PR_RESERVE(r0, 0x401070c9, &(0x7f0000000180)={0x7, 0x5, 0x1}) r6 = socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3000002, 0x1010, r4, 0xef78d000) bind$inet(r6, &(0x7f0000000180)={0x2, 0x2000, @broadcast}, 0x10) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) connect$inet(r6, &(0x7f0000000240)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) sendfile(r5, r0, 0x0, 0x1ff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000100)={'wg0\x00'}) 97.966419ms ago: executing program 1 (id=402): mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7, 0x6832, 0xffffffffffffffff, 0x0) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) syz_open_procfs$userns(r0, &(0x7f0000000000)) setns(r1, 0x24020000) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) futex(0x0, 0x3, 0x80000001, 0x0, 0x0, 0x100001) pipe2$9p(&(0x7f0000000080), 0x800) mount$binder(0x0, 0x0, 0x0, 0x20c411, 0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x20000040) r2 = syz_open_dev$usbfs(&(0x7f0000000340), 0x206, 0x8401) ioctl$USBDEVFS_GETDRIVER(r2, 0x41045508, 0x0) syz_clone(0x498144ee5f62e149, 0x0, 0x17, 0x0, 0x0, 0x0) r3 = gettid() rt_sigprocmask(0x0, &(0x7f0000000040)={[0xfffffffffffffff9]}, 0x0, 0x8) r4 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x4801, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000000)={[{0x80000000, 0x4, 0xc2, 0x4f, 0x40, 0x2, 0x80, 0x1, 0x3, 0x44, 0x8, 0x2, 0x1}, {0xb, 0xa7f3, 0x8, 0x8, 0x9, 0xff, 0x4, 0x3, 0xa, 0x13, 0x7, 0x6, 0x1}, {0x21ff, 0x7, 0xd, 0x10, 0x25, 0x9, 0x0, 0xfb, 0x4, 0x15, 0x0, 0x2, 0x4}], 0x9}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0x8, 0x8a, 0x8000000000001, 0xfffffffffffffffd, 0x2, 0xfffffffffffffffd, 0x4002004c4, 0x1000, 0x6, 0x10, 0x10, 0x2, 0x0, 0x0, 0x3], 0x3000, 0x1011c4}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) timer_create(0x0, &(0x7f0000001080)={0x0, 0x12, 0x4, @tid=r3}, &(0x7f0000044000)=0x0) clock_gettime(0x1, &(0x7f0000000000)={0x0, 0x0}) timer_settime(r7, 0x1, &(0x7f00000000c0)={{0x0, 0x989680}, {0x77359400}}, &(0x7f0000000140)) timer_settime(r7, 0x0, &(0x7f0000040fe0)={{r8, r9+10000000}, {0x0, 0x9}}, 0x0) rt_sigaction(0x12, &(0x7f0000000080)={0x0, 0x80000000, 0xffffffffffffffff, {[0x400]}}, 0x0, 0x8, &(0x7f0000000180)) umount2(&(0x7f0000000040)='.\x00', 0x2) 81.998169ms ago: executing program 1 (id=403): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)={0x34, r2, 0x303, 0x0, 0x0, {0x13}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x10010000004e20}, 0x1c) sendmmsg$inet(r4, &(0x7f0000000b00)=[{{&(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x0) recvmmsg(r4, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0}, 0x7f}], 0x1, 0x60, 0x0) setsockopt$inet6_IPV6_RTHDR(r3, 0x29, 0x39, &(0x7f0000000000)={0x5e, 0x2, 0x2, 0x81, 0x0, [@loopback]}, 0x18) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f00000002c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/255, 0xff, 0x0, 0x33}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x31}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x50, 0x0, &(0x7f0000000380)="1920ff09471b1099c7961fdcc405843a41a786d3ed8ebe8e80e4b4144e1cf51c728b926c80eb2a8e4f6b2dab5b6ac95dd16066dc703442a9132a8dd210e45df98d795a638622681df1cb222612051f61"}) 78.195509ms ago: executing program 2 (id=404): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x280, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x8000) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_REINJECT_CONTROL(r2, 0xae71, &(0x7f0000000180)={0x3}) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3, 0x12, r0, 0x4d75d000) 9.97566ms ago: executing program 1 (id=405): r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000080)={@multicast2, 0x1, 0x0, 0x40, 0x0, [{}, {@private}, {@empty}, {@multicast2}]}}) ioctl$AUTOFS_IOC_PROTOVER(r0, 0x80049363, &(0x7f0000000140)) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000180)=0xffffffffffffffff, 0x4) epoll_pwait2(r0, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}], 0x6, &(0x7f0000000240), &(0x7f0000000280)={[0x7fff]}, 0x8) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f00000002c0)={'team0\x00', {0x2, 0x0, @initdev}}) connect$inet(r0, 0xfffffffffffffffc, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r0, &(0x7f0000000300)={0x10}) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000340)={@desc={0x1, 0x0, @auto="4117822035265298"}}) ioctl$F2FS_IOC_SEC_TRIM_FILE(r0, 0x4018f514, &(0x7f0000000380)={0x80000001, 0x2, 0x2}) capset(&(0x7f00000003c0)={0x20071026, 0xffffffffffffffff}, &(0x7f0000000400)={0x4, 0x8, 0x7, 0x7f, 0x8, 0xc}) r1 = socket$inet6(0xa, 0x3, 0x7) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r0) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x20, r2, 0x2, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x7, 0x52}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4004040}, 0x20004040) ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(r1, 0x4008941a, &(0x7f0000000580)=0x2) write$cgroup_subtree(r0, &(0x7f00000005c0)={[{0x2b, 'perf_event'}, {0x2b, 'pids'}, {0x0, 'cpu'}, {0x2b, 'cpuset'}, {0x2b, 'devices'}, {0x2b, 'cpuset'}]}, 0x30) write$P9_RREMOVE(r0, &(0x7f0000000600)={0x7, 0x7b, 0x1}, 0x7) r3 = syz_open_dev$usbfs(&(0x7f0000000640), 0x40, 0x240801) bind$inet(r0, &(0x7f0000000680)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000006c0)={0x30, 0x5, 0x0, {0x0, 0x6, 0x4, 0x7}}, 0x30) ioctl$USBDEVFS_ALLOW_SUSPEND(r3, 0x5522) getsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f0000000700), &(0x7f0000000740)=0x4) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000780)={'vcan0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f00000007c0)={@ipv4={'\x00', '\xff\xff', @loopback}, 0x6a, r4}) ioctl$PTP_EXTTS_REQUEST2(r0, 0x40103d0b, &(0x7f0000000800)={0x9, 0x8}) read(r1, &(0x7f0000000840)=""/57, 0x39) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000880)) write$cgroup_subtree(r0, &(0x7f00000008c0)={[{0x2b, 'freezer'}]}, 0x9) 8.88977ms ago: executing program 2 (id=406): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='\x00', 0x81901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000240)='./file0\x00') rename(&(0x7f0000000240)='./file0\x00', &(0x7f00000003c0)='./file1\x00') ioctl$BINDER_GET_NODE_INFO_FOR_REF(0xffffffffffffffff, 0xc018620c, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x10d042, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r1, 0x45809000) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xf) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000ffc000/0x1000)=nil) mlock(&(0x7f000028e000/0x3000)=nil, 0x3000) 0s ago: executing program 2 (id=407): openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_TSC_KHZ(r2, 0xaea2, 0x400000400) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0x2, 0xb6, '\x00', 0x2}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioprio_set$pid(0x1, 0xffffffffffffffff, 0x6003) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x9c, 0x0, &(0x7f0000000180)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0}, 0x10}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@fda={0x66646185, 0x5, 0x0, 0x2a}, @flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000140)}, 0x1040}, @acquire={0x40046305, 0x2}], 0x0, 0x0, 0x0}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_NESTED_STATE(r4, 0xc080aebe, &(0x7f0000000500)={{0x0, 0x0, 0x80}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.53' (ED25519) to the list of known hosts. [ 25.849501][ T36] audit: type=1400 audit(1750802999.680:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.851057][ T281] cgroup: Unknown subsys name 'net' [ 25.875878][ T36] audit: type=1400 audit(1750802999.680:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.905393][ T36] audit: type=1400 audit(1750802999.710:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.905723][ T281] cgroup: Unknown subsys name 'devices' [ 26.050730][ T281] cgroup: Unknown subsys name 'hugetlb' [ 26.057989][ T281] cgroup: Unknown subsys name 'rlimit' [ 26.232594][ T36] audit: type=1400 audit(1750803000.060:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.260676][ T36] audit: type=1400 audit(1750803000.060:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.288664][ T36] audit: type=1400 audit(1750803000.060:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 26.307876][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 26.323736][ T36] audit: type=1400 audit(1750803000.150:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.351413][ T36] audit: type=1400 audit(1750803000.150:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.363279][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.380193][ T36] audit: type=1400 audit(1750803000.190:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.418317][ T36] audit: type=1400 audit(1750803000.190:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 27.737298][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.744796][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.752662][ T291] bridge_slave_0: entered allmulticast mode [ 27.759403][ T291] bridge_slave_0: entered promiscuous mode [ 27.768381][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.777047][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.784602][ T291] bridge_slave_1: entered allmulticast mode [ 27.791499][ T291] bridge_slave_1: entered promiscuous mode [ 27.824043][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.832076][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.840248][ T289] bridge_slave_0: entered allmulticast mode [ 27.847521][ T289] bridge_slave_0: entered promiscuous mode [ 27.854424][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.861961][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.870635][ T289] bridge_slave_1: entered allmulticast mode [ 27.878214][ T289] bridge_slave_1: entered promiscuous mode [ 27.908642][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.917693][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.926060][ T288] bridge_slave_0: entered allmulticast mode [ 27.933127][ T288] bridge_slave_0: entered promiscuous mode [ 27.944961][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.952424][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.959950][ T288] bridge_slave_1: entered allmulticast mode [ 27.966898][ T288] bridge_slave_1: entered promiscuous mode [ 28.035742][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.043743][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.051638][ T290] bridge_slave_0: entered allmulticast mode [ 28.059153][ T290] bridge_slave_0: entered promiscuous mode [ 28.066202][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.074501][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.084390][ T290] bridge_slave_1: entered allmulticast mode [ 28.091016][ T290] bridge_slave_1: entered promiscuous mode [ 28.204473][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.212269][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.221042][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.228596][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.275964][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.284296][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.292099][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.299372][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.330017][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.338839][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.400600][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.408697][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.424143][ T289] veth0_vlan: entered promiscuous mode [ 28.434879][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.442767][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.470743][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.478143][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.490288][ T289] veth1_macvtap: entered promiscuous mode [ 28.499804][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.508296][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.532436][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.540760][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.556617][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.564168][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.610885][ T291] veth0_vlan: entered promiscuous mode [ 28.619820][ T289] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 28.645226][ T291] veth1_macvtap: entered promiscuous mode [ 28.662280][ T290] veth0_vlan: entered promiscuous mode [ 28.702501][ T290] veth1_macvtap: entered promiscuous mode [ 28.716874][ T288] veth0_vlan: entered promiscuous mode [ 28.729035][ T307] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 28.767329][ T288] veth1_macvtap: entered promiscuous mode [ 28.836754][ T315] rust_binder: Write failure EFAULT in pid:4 [ 28.878771][ T319] __vm_enough_memory: pid: 319, comm: syz.2.3, bytes: 70373039144960 not enough memory for the allocation [ 28.992931][ T332] netlink: 'syz.2.9': attribute type 27 has an invalid length. [ 29.009439][ T332] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.017458][ T332] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.080187][ T332] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9'. [ 29.188246][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 29.289048][ T353] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14'. [ 29.304112][ T353] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14'. [ 29.352503][ T31] usb 1-1: config 4 has an invalid interface number: 95 but max is 0 [ 29.361224][ T31] usb 1-1: config 4 has no interface number 0 [ 29.367714][ T31] usb 1-1: config 4 interface 95 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 29.379762][ T31] usb 1-1: New USB device found, idVendor=7725, idProduct=b0a8, bcdDevice= 7.46 [ 29.389231][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.397478][ T31] usb 1-1: Product: syz [ 29.404247][ T31] usb 1-1: Manufacturer: syz [ 29.414385][ T31] usb 1-1: SerialNumber: syz [ 29.424688][ T325] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 29.464098][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 29.608255][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 29.628183][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 29.635380][ T9] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 29.644611][ T9] usb 3-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 29.655239][ T9] usb 3-1: config 0 has no interface number 1 [ 29.662572][ T9] usb 3-1: config 0 interface 85 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 29.676811][ T9] usb 3-1: too many endpoints for config 0 interface 0 altsetting 51: 129, using maximum allowed: 30 [ 29.688462][ T9] usb 3-1: config 0 interface 0 altsetting 51 has 0 endpoint descriptors, different from the interface descriptor's value: 129 [ 29.705805][ T9] usb 3-1: config 0 interface 85 has no altsetting 0 [ 29.713227][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 29.722592][ T9] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice= 5.72 [ 29.732359][ T9] usb 3-1: New USB device strings: Mfr=2, Product=2, SerialNumber=3 [ 29.741854][ T9] usb 3-1: Product: syz [ 29.746326][ T9] usb 3-1: Manufacturer: syz [ 29.751684][ T9] usb 3-1: SerialNumber: syz [ 29.758383][ T9] usb 3-1: config 0 descriptor?? [ 29.766691][ T9] usbhid 3-1:0.85: couldn't find an input interrupt endpoint [ 29.774368][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 29.784019][ T10] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.797818][ T10] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.818726][ T31] usb 1-1: MIDIStreaming interface descriptor not found [ 29.829146][ T10] usb 4-1: config 0 interface 0 has no altsetting 0 [ 29.838586][ T31] usb 1-1: USB disconnect, device number 2 [ 29.845927][ T10] usb 4-1: New USB device found, idVendor=04b4, idProduct=bca1, bcdDevice= 0.00 [ 29.856346][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.875695][ T351] udevd[351]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:4.95/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 29.876809][ T10] usb 4-1: config 0 descriptor?? [ 29.967961][ T343] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 29.976932][ T343] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 29.989022][ T9] usb 3-1: USB disconnect, device number 2 [ 30.047444][ T367] rust_binder: Write failure EINVAL in pid:24 [ 30.062298][ T370] netlink: 8 bytes leftover after parsing attributes in process `syz.1.19'. [ 30.302738][ T10] cypress 0003:04B4:BCA1.0001: unknown main item tag 0x0 [ 30.311673][ T9] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 30.322523][ T10] cypress 0003:04B4:BCA1.0001: unknown main item tag 0x0 [ 30.329939][ T10] cypress 0003:04B4:BCA1.0001: unknown main item tag 0x0 [ 30.340095][ T10] cypress 0003:04B4:BCA1.0001: hidraw0: USB HID v0.04 Device [HID 04b4:bca1] on usb-dummy_hcd.3-1/input0 [ 30.430016][ T379] Zero length message leads to an empty skb [ 30.481105][ T9] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 30.493516][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.501782][ T9] usb 3-1: Product: syz [ 30.506397][ T9] usb 3-1: Manufacturer: syz [ 30.511671][ T9] usb 3-1: SerialNumber: syz [ 30.629827][ T311] usb 4-1: USB disconnect, device number 2 [ 30.983325][ T375] overlayfs: statfs failed on './file0' [ 31.035962][ T36] kauditd_printk_skb: 100 callbacks suppressed [ 31.035993][ T36] audit: type=1400 audit(1750803004.860:174): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 31.080757][ T400] rust_binder: Failed to allocate buffer. len:65376, is_oneway:true [ 31.080794][ T400] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 31.089843][ T400] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:35 [ 31.151205][ T36] audit: type=1400 audit(1750803004.980:175): avc: denied { append } for pid=412 comm="syz.1.33" name="kvm" dev="devtmpfs" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 31.216373][ T36] audit: type=1400 audit(1750803005.040:176): avc: denied { mounton } for pid=415 comm="syz.0.34" path="/11/file0" dev="tmpfs" ino=77 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 31.334063][ T36] audit: type=1400 audit(1750803005.160:177): avc: denied { create } for pid=412 comm="syz.1.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 31.382140][ T36] audit: type=1400 audit(1750803005.180:178): avc: denied { write } for pid=412 comm="syz.1.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 31.467278][ T36] audit: type=1326 audit(1750803005.290:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=427 comm="syz.3.38" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe90918e929 code=0x0 [ 31.548484][ T36] audit: type=1400 audit(1750803005.380:180): avc: denied { ioctl } for pid=422 comm="syz.0.37" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=3707 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 31.665910][ T36] audit: type=1400 audit(1750803005.490:182): avc: denied { bind } for pid=435 comm="syz.1.40" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 31.691048][ T36] audit: type=1400 audit(1750803005.490:181): avc: denied { read } for pid=433 comm="syz.3.39" name="rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 31.725189][ T434] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 31.725228][ T434] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:26 [ 31.738417][ T36] audit: type=1400 audit(1750803005.490:183): avc: denied { open } for pid=433 comm="syz.3.39" path="/dev/rtc0" dev="devtmpfs" ino=195 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 31.808565][ T438] overlay: Unknown parameter 'uid' [ 31.899123][ T446] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:32 [ 32.135629][ T10] usb 3-1: USB disconnect, device number 3 [ 32.170938][ T465] binder: Bad value for 'stats' [ 32.238148][ T31] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 32.398606][ T31] usb 2-1: Using ep0 maxpacket: 32 [ 32.409297][ T31] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 32.426371][ T31] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 32.451433][ T31] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 32.473362][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 32.499685][ T31] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 32.525547][ T31] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 32.554483][ T31] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 32.572288][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.593473][ T31] usb 2-1: config 0 descriptor?? [ 32.813124][ T31] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 32.850174][ T31] usb 2-1: USB disconnect, device number 2 [ 32.866947][ T31] usblp0: removed [ 33.375865][ T31] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 33.419778][ T499] overlayfs: failed to clone upperpath [ 33.538148][ T31] usb 2-1: Using ep0 maxpacket: 8 [ 33.544956][ T31] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 33.558883][ T31] usb 2-1: New USB device found, idVendor=0458, idProduct=4018, bcdDevice= 0.00 [ 33.568749][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.578706][ T31] usb 2-1: config 0 descriptor?? [ 33.638205][ T310] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 33.788643][ T310] usb 3-1: Using ep0 maxpacket: 32 [ 33.800422][ T310] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 33.813597][ T310] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 33.827049][ T310] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 33.839167][ T310] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 33.849092][ T310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.859399][ T310] usb 3-1: config 0 descriptor?? [ 33.865300][ T495] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 33.874868][ T310] hub 3-1:0.0: USB hub found [ 33.958666][ T502] syz.0.60 uses obsolete (PF_INET,SOCK_PACKET) [ 34.074475][ T310] hub 3-1:0.0: 2 ports detected [ 34.212291][ T484] rust_binder: Write failure EFAULT in pid:59 [ 34.264046][ T31] usbhid 2-1:0.0: can't add hid device: -71 [ 34.280222][ T31] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 34.290700][ T31] usb 2-1: USB disconnect, device number 3 [ 34.480492][ T495] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.491688][ T495] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.503199][ T310] hub 3-1:0.0: set hub depth failed [ 34.519242][ T310] usb 3-1: USB disconnect, device number 4 [ 34.839345][ T506] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 34.927274][ T517] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 35.724637][ T555] netlink: 'syz.3.77': attribute type 4 has an invalid length. [ 35.736680][ T555] netlink: 'syz.3.77': attribute type 4 has an invalid length. [ 35.746116][ T555] netlink: 'syz.3.77': attribute type 4 has an invalid length. [ 35.989784][ T363] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 36.166907][ T363] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 36.184109][ T36] kauditd_printk_skb: 35 callbacks suppressed [ 36.184132][ T36] audit: type=1400 audit(1750803010.010:219): avc: denied { execute } for pid=565 comm="syz.2.81" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 36.233952][ T363] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 36.268118][ T363] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 36.316180][ T363] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 36.359366][ T582] netlink: 'syz.0.85': attribute type 4 has an invalid length. [ 36.376972][ T363] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 36.398461][ T363] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.426653][ T363] usb 4-1: config 0 descriptor?? [ 36.698019][ T9] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 36.828175][ T36] audit: type=1400 audit(1750803010.650:220): avc: denied { setopt } for pid=596 comm="syz.1.89" lport=5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 36.850932][ T36] audit: type=1400 audit(1750803010.660:221): avc: denied { read } for pid=596 comm="syz.1.89" lport=5 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 36.874842][ T363] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 36.885021][ T363] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 36.893114][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 36.898757][ T363] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 36.906765][ T363] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 36.915033][ T363] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 36.923520][ T363] plantronics 0003:047F:FFFF.0002: item fetching failed at offset 14/15 [ 36.933418][ T363] plantronics 0003:047F:FFFF.0002: parse failed [ 36.940058][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.951330][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.962138][ T363] plantronics 0003:047F:FFFF.0002: probe with driver plantronics failed with error -22 [ 36.972117][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 36.986513][ T9] usb 3-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 36.996466][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.005906][ T9] usb 3-1: config 0 descriptor?? [ 37.085674][ T36] audit: type=1400 audit(1750803010.910:222): avc: denied { mounton } for pid=554 comm="syz.3.77" path="/syzcgroup/unified/syz3" dev="cgroup2" ino=83 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 37.086128][ T555] syz.3.77: attempt to access beyond end of device [ 37.086128][ T555] loop3: rw=4096, sector=2, nr_sectors = 2 limit=0 [ 37.126884][ T555] EXT4-fs (loop3): unable to read superblock [ 37.128239][ T310] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 37.288130][ T310] usb 2-1: Using ep0 maxpacket: 8 [ 37.305072][ T310] usb 2-1: config 148 has too many interfaces: 191, using maximum allowed: 32 [ 37.317949][ T363] usb 4-1: USB disconnect, device number 3 [ 37.323906][ T310] usb 2-1: config 148 has 1 interface, different from the descriptor's value: 191 [ 37.323940][ T310] usb 2-1: config 148 has no interface number 0 [ 37.323967][ T310] usb 2-1: config 148 interface 16 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 37.323990][ T310] usb 2-1: config 148 interface 16 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 37.378662][ T310] usb 2-1: config 148 interface 16 has no altsetting 0 [ 37.386022][ T310] usb 2-1: New USB device found, idVendor=5543, idProduct=0042, bcdDevice= 0.00 [ 37.395495][ T310] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.416795][ T9] hid-multitouch 0003:0457:07DA.0003: unknown main item tag 0x0 [ 37.441666][ T9] hid-multitouch 0003:0457:07DA.0003: unknown main item tag 0x0 [ 37.453173][ T9] hid-multitouch 0003:0457:07DA.0003: unknown main item tag 0x0 [ 37.469159][ T9] hid-multitouch 0003:0457:07DA.0003: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.2-1/input0 [ 37.620908][ T31] usb 3-1: USB disconnect, device number 5 [ 37.873044][ T36] audit: type=1400 audit(1750803011.700:223): avc: denied { create } for pid=626 comm="syz.3.99" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 37.902444][ T36] audit: type=1400 audit(1750803011.700:224): avc: denied { write } for pid=626 comm="syz.3.99" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 37.928694][ T632] capability: warning: `syz.0.100' uses 32-bit capabilities (legacy support in use) [ 37.972691][ T628] netlink: 16 bytes leftover after parsing attributes in process `syz.3.99'. [ 37.972691][ T627] netlink: 16 bytes leftover after parsing attributes in process `syz.3.99'. [ 37.973070][ T628] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 37.997661][ T630] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 38.135021][ T310] usb 2-1: string descriptor 0 read error: -71 [ 38.161407][ T310] usbhid 2-1:148.16: couldn't find an input interrupt endpoint [ 38.177342][ T310] usb 2-1: USB disconnect, device number 4 [ 38.243326][ T36] audit: type=1326 audit(1750803012.070:225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=639 comm="syz.2.103" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbe19b8e929 code=0x0 [ 38.346504][ T36] audit: type=1400 audit(1750803012.170:226): avc: denied { append } for pid=643 comm="syz.1.104" name="binder1" dev="binder" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 38.351783][ T644] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 38.373074][ T36] audit: type=1400 audit(1750803012.170:227): avc: denied { ioctl } for pid=643 comm="syz.1.104" path="socket:[5508]" dev="sockfs" ino=5508 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 38.413704][ T647] rust_binder: Failed to allocate buffer. len:120, is_oneway:false [ 38.413943][ T36] audit: type=1400 audit(1750803012.170:228): avc: denied { connect } for pid=643 comm="syz.1.104" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 38.918793][ T692] raw_sendmsg: syz.0.120 forgot to set AF_INET. Fix it! [ 39.008236][ T9] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 39.141774][ T696] rust_binder: inc_ref_done called when no active inc_refs [ 39.158164][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 39.173147][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 39.182462][ T9] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 39.191962][ T9] usb 2-1: config 1 has no interface number 1 [ 39.199015][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 39.213417][ T9] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 39.227627][ T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 39.237681][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.246439][ T9] usb 2-1: Product: syz [ 39.251194][ T9] usb 2-1: Manufacturer: syz [ 39.256163][ T9] usb 2-1: SerialNumber: syz [ 39.467023][ T9] usb 2-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 39.474153][ T9] usb 2-1: 2:1 : invalid channels 0 [ 39.482644][ T9] usb 2-1: USB disconnect, device number 5 [ 39.492568][ T364] udevd[364]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 39.531092][ T698] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:85 [ 39.687387][ T310] hid (null): bogus close delimiter [ 39.702169][ T310] hid (null): global environment stack underflow [ 39.709311][ T310] hid (null): unknown global tag 0xd [ 39.715432][ T310] hid (null): unknown global tag 0xe [ 39.721897][ T310] hid (null): invalid report_count 1423201945 [ 39.729191][ T310] hid (null): invalid report_count 15085 [ 39.744728][ T310] hid (null): report_id 1962299903 is invalid [ 39.756939][ T310] hid (null): unknown global tag 0xc [ 39.764583][ T310] hid (null): unknown global tag 0xd0 [ 39.770942][ T310] hid (null): unknown global tag 0xc [ 39.776794][ T310] hid (null): unknown global tag 0xe [ 39.784124][ T310] hid (null): unknown global tag 0xc [ 39.790439][ T310] hid (null): unknown global tag 0xc6 [ 39.796138][ T310] hid (null): unknown global tag 0xe [ 39.801560][ T310] hid (null): unknown global tag 0xd [ 39.807011][ T310] hid (null): unknown global tag 0xe [ 39.812765][ T310] hid (null): unknown global tag 0xc [ 39.818248][ T310] hid (null): unknown global tag 0xe [ 39.823764][ T310] hid (null): bogus close delimiter [ 39.842015][ T310] hid (null): unknown global tag 0xe [ 39.848035][ T310] hid (null): unknown global tag 0xc [ 40.281807][ T310] hid (null): unknown global tag 0xd [ 40.287895][ T310] hid (null): unknown global tag 0xd [ 40.294263][ T310] hid (null): invalid report_size 6865 [ 40.299979][ T310] hid (null): unknown global tag 0xc [ 40.305638][ T310] hid (null): global environment stack overflow [ 40.312032][ T310] hid (null): unknown global tag 0xe [ 40.317739][ T310] hid (null): unknown global tag 0xe [ 40.323839][ T310] hid (null): unknown global tag 0xe [ 40.329409][ T310] hid (null): bogus close delimiter [ 40.334882][ T310] hid (null): unknown global tag 0x59 [ 40.340361][ T310] hid (null): report_id 2587896191 is invalid [ 40.346647][ T310] hid (null): report_id 0 is invalid [ 40.351992][ T310] hid (null): global environment stack overflow [ 40.359882][ T310] hid (null): unknown global tag 0xe [ 40.365488][ T310] hid (null): invalid report_size -157419238 [ 40.371673][ T310] hid (null): unknown global tag 0xe [ 40.378250][ T310] hid (null): report_id 0 is invalid [ 40.384039][ T310] hid (null): unknown global tag 0xc [ 40.390167][ T310] hid (null): global environment stack overflow [ 40.396623][ T310] hid (null): unknown global tag 0xc9 [ 40.402381][ T310] hid (null): invalid report_count 1744092844 [ 40.408614][ T310] hid (null): global environment stack overflow [ 40.415964][ T310] hid (null): unknown global tag 0xc [ 40.421563][ T310] hid (null): global environment stack overflow [ 40.427895][ T310] hid (null): unknown global tag 0xe [ 40.433257][ T310] hid (null): unknown global tag 0xd [ 40.438853][ T310] hid (null): unknown global tag 0xd [ 40.444754][ T310] hid (null): unknown global tag 0xc [ 40.450469][ T310] hid (null): unknown global tag 0xe9 [ 40.455892][ T310] hid (null): report_id 33499 is invalid [ 40.462570][ T310] hid-generic 0003:0008:FFFFFFF8.0004: unknown main item tag 0x0 [ 40.470611][ T310] hid-generic 0003:0008:FFFFFFF8.0004: unknown main item tag 0xe [ 40.478845][ T310] hid-generic 0003:0008:FFFFFFF8.0004: unknown main item tag 0x3 [ 40.487673][ T310] hid-generic 0003:0008:FFFFFFF8.0004: unknown main item tag 0xd [ 40.495455][ T310] hid-generic 0003:0008:FFFFFFF8.0004: bogus close delimiter [ 40.503148][ T310] hid-generic 0003:0008:FFFFFFF8.0004: item 0 0 2 10 parsing failed [ 40.511567][ T310] hid-generic 0003:0008:FFFFFFF8.0004: probe with driver hid-generic failed with error -22 [ 40.864604][ T753] ======================================================= [ 40.864604][ T753] WARNING: The mand mount option has been deprecated and [ 40.864604][ T753] and is ignored by this kernel. Remove the mand [ 40.864604][ T753] option from the mount to silence this warning. [ 40.864604][ T753] ======================================================= [ 41.015967][ T760] tipc: Started in network mode [ 41.022418][ T760] tipc: Node identity , cluster identity 4711 [ 41.029887][ T760] tipc: Failed to obtain node identity [ 41.039070][ T760] tipc: Enabling of bearer rejected, failed to enable media [ 41.077666][ T763] rust_binder: Got transaction with invalid offset. [ 41.077714][ T763] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 41.084574][ T763] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:70 [ 41.348370][ T310] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 41.412779][ T771] tipc: Started in network mode [ 41.418040][ T771] tipc: Node identity ac1414aa, cluster identity 4711 [ 41.425565][ T771] tipc: Enabling of bearer rejected, failed to enable media [ 41.498171][ T310] usb 3-1: device descriptor read/64, error -71 [ 41.738216][ T310] usb 3-1: device descriptor read/64, error -71 [ 41.971783][ T782] netlink: 16 bytes leftover after parsing attributes in process `syz.3.150'. [ 41.980960][ T310] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 42.013271][ T36] kauditd_printk_skb: 40 callbacks suppressed [ 42.013289][ T36] audit: type=1400 audit(1750803015.840:269): avc: denied { shutdown } for pid=785 comm="syz.3.152" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 42.118202][ T310] usb 3-1: device descriptor read/64, error -71 [ 42.214302][ T36] audit: type=1400 audit(1750803016.040:270): avc: denied { block_suspend } for pid=798 comm="syz.3.156" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 42.358214][ T310] usb 3-1: device descriptor read/64, error -71 [ 42.468267][ T310] usb usb3-port1: attempt power cycle [ 42.478270][ T311] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 42.608179][ T311] usb 4-1: device descriptor read/64, error -71 [ 42.808178][ T310] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 42.829183][ T310] usb 3-1: device descriptor read/8, error -71 [ 42.848200][ T311] usb 4-1: device descriptor read/64, error -71 [ 42.888116][ T36] audit: type=1400 audit(1750803016.710:271): avc: denied { ioctl } for pid=802 comm="syz.0.157" path="socket:[6693]" dev="sockfs" ino=6693 ioctlcmd=0x8913 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 42.888590][ T803] SELinux: Context system_u:object_r:mnt_t:s0 is not valid (left unmapped). [ 42.923209][ T36] audit: type=1400 audit(1750803016.750:272): avc: denied { relabelto } for pid=802 comm="syz.0.157" name="rnullb0" dev="tmpfs" ino=124 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:mnt_t:s0" [ 42.945445][ T805] tipc: Started in network mode [ 42.953999][ T805] tipc: Node identity ac14141d, cluster identity 4711 [ 42.961772][ T805] tipc: New replicast peer: 255.255.255.255 [ 42.966313][ T36] audit: type=1400 audit(1750803016.750:273): avc: denied { associate } for pid=802 comm="syz.0.157" name="rnullb0" dev="tmpfs" ino=124 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:mnt_t:s0" [ 42.974580][ T805] tipc: Enabled bearer , priority 10 [ 42.995644][ T36] audit: type=1400 audit(1750803016.750:274): avc: denied { create } for pid=802 comm="syz.0.157" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 43.004963][ T310] usb 3-1: device descriptor read/8, error -71 [ 43.024813][ T36] audit: type=1400 audit(1750803016.750:275): avc: denied { rename } for pid=802 comm="syz.0.157" name="file0" dev="tmpfs" ino=271 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 43.057959][ T36] audit: type=1400 audit(1750803016.750:276): avc: denied { read write execute } for pid=802 comm="syz.0.157" name="file7" dev="tmpfs" ino=271 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 43.085274][ T36] audit: type=1400 audit(1750803016.860:277): avc: denied { mount } for pid=804 comm="syz.0.158" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 43.108368][ T36] audit: type=1400 audit(1750803016.860:278): avc: denied { search } for pid=804 comm="syz.0.158" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 43.118524][ T311] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 43.269122][ T310] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 43.278161][ T311] usb 4-1: device descriptor read/64, error -71 [ 43.290765][ T310] usb 3-1: device descriptor read/8, error -71 [ 43.390873][ T826] rust_binder: Write failure EINVAL in pid:161 [ 43.419184][ T310] usb 3-1: device descriptor read/8, error -71 [ 43.436934][ T829] 9pnet: p9_errstr2errno: server reported unknown error pA;KZ44/@qkp [ 43.436934][ T829] C<+ [ 43.515822][ T837] binder: Unknown parameter 'Stat' [ 43.518220][ T311] usb 4-1: device descriptor read/64, error -71 [ 43.548798][ T310] usb usb3-port1: unable to enumerate USB device [ 43.555090][ T841] rust_binder: Write failure EINVAL in pid:176 [ 43.628865][ T311] usb usb4-port1: attempt power cycle [ 43.978195][ T311] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 43.999621][ T311] usb 4-1: device descriptor read/8, error -71 [ 44.028151][ T310] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 44.088174][ T769] tipc: Node number set to 2886997021 [ 44.129273][ T311] usb 4-1: device descriptor read/8, error -71 [ 44.179955][ T310] usb 2-1: config 1 interface 0 altsetting 9 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 44.192929][ T310] usb 2-1: config 1 interface 0 has no altsetting 0 [ 44.201274][ T310] usb 2-1: New USB device found, idVendor=046d, idProduct=c086, bcdDevice= 0.40 [ 44.210613][ T310] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.219507][ T310] usb 2-1: Product: syz [ 44.223698][ T310] usb 2-1: Manufacturer: syz [ 44.228642][ T310] usb 2-1: SerialNumber: syz [ 44.368195][ T311] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 44.389400][ T311] usb 4-1: device descriptor read/8, error -71 [ 44.448895][ T875] overlayfs: failed to clone upperpath [ 44.519255][ T311] usb 4-1: device descriptor read/8, error -71 [ 44.628316][ T311] usb usb4-port1: unable to enumerate USB device [ 44.817354][ T310] usbhid 2-1:1.0: can't add hid device: -71 [ 44.824338][ T310] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 44.834575][ T310] usb 2-1: USB disconnect, device number 6 [ 45.188789][ T880] fuse: Bad value for 'user_id' [ 45.194302][ T880] fuse: Bad value for 'user_id' [ 45.218376][ T888] netlink: 4 bytes leftover after parsing attributes in process `syz.2.183'. [ 45.258909][ T892] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 45.276161][ T892] rust_binder: Write failure EINVAL in pid:124 [ 45.276401][ T892] rust_binder: Write failure EFAULT in pid:124 [ 45.318524][ T895] rust_binder: Error while translating object. [ 45.338830][ T890] netlink: 64 bytes leftover after parsing attributes in process `syz.0.184'. [ 45.357584][ T895] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 45.357621][ T895] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:126 [ 45.386482][ T901] binder: Bad value for 'defcontext' [ 45.420675][ T903] incfs: Error accessing: ./file0. [ 45.426040][ T903] incfs: mount failed -20 [ 45.447164][ T905] binder: Bad value for 'defcontext' [ 45.478164][ T310] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 45.528566][ T918] binder: Bad value for 'stats' [ 45.534281][ T920] binder: Bad value for 'stats' [ 45.538175][ T921] rust_binder: Failed to allocate buffer. len:40, is_oneway:false [ 45.588251][ T936] incfs: Options parsing error. -22 [ 45.615289][ T936] incfs: mount failed -22 [ 45.626979][ T936] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 45.658496][ T310] usb 3-1: Using ep0 maxpacket: 8 [ 45.665845][ T310] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 45.676854][ T310] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.694480][ T310] usb 3-1: config 0 descriptor?? [ 45.763769][ T949] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:224 [ 46.014484][ T963] sock: sock_timestamping_bind_phc: sock not bind to device [ 46.896276][ T977] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.896340][ T978] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.964890][ T984] rust_binder: Failed to allocate buffer. len:40, is_oneway:true [ 47.336017][ T1008] rust_binder: Failed to allocate buffer. len:144, is_oneway:true [ 47.380928][ T36] kauditd_printk_skb: 16 callbacks suppressed [ 47.380950][ T36] audit: type=1400 audit(1750803021.210:295): avc: denied { bind } for pid=1011 comm="syz.1.225" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 47.418048][ T1014] fuse: Bad value for 'rootmode' [ 47.459940][ T310] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 47.473051][ T310] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0088: ffffffb9 [ 47.485674][ T310] asix 3-1:0.0: probe with driver asix failed with error -71 [ 47.495166][ T310] usb 3-1: USB disconnect, device number 10 [ 47.576179][ T36] audit: type=1400 audit(1750803021.400:296): avc: denied { listen } for pid=1023 comm="syz.1.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 47.679468][ T1026] rust_binder: Failed to allocate buffer. len:64752, is_oneway:false [ 47.679493][ T1026] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 47.688256][ T1026] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:278 [ 47.779937][ T1028] netlink: 'syz.1.232': attribute type 11 has an invalid length. [ 47.798447][ T1028] netlink: 'syz.1.232': attribute type 1 has an invalid length. [ 47.801320][ T36] audit: type=1400 audit(1750803021.630:297): avc: denied { connect } for pid=1029 comm="syz.3.233" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 47.806927][ T1028] netlink: 3593 bytes leftover after parsing attributes in process `syz.1.232'. [ 47.839774][ T1030] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:170 [ 47.853440][ T1036] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 47.868478][ T36] audit: type=1400 audit(1750803021.700:298): avc: denied { append } for pid=1033 comm="syz.3.236" name="event0" dev="devtmpfs" ino=192 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 47.975835][ T1045] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.155302][ T1057] rust_binder: Failed copying remainder into alloc: EFAULT [ 48.162557][ T1057] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 48.171722][ T1057] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 48.178239][ T363] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 48.185510][ T1057] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:293 [ 48.222410][ T1059] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.239555][ T36] audit: type=1400 audit(1750803022.070:299): avc: denied { mount } for pid=1058 comm="syz.2.245" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 48.242711][ T1059] rust_binder: Error in use_page_slow: ESRCH [ 48.272578][ T1059] rust_binder: use_range failure ESRCH [ 48.279479][ T1059] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 48.285928][ T1059] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 48.295172][ T1059] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:97 [ 48.307657][ T1059] 9pnet_fd: p9_fd_create_unix (1059): problem connecting socket: ./bus: -111 [ 48.329188][ T1064] batadv_slave_1: entered promiscuous mode [ 48.335739][ T36] audit: type=1400 audit(1750803022.160:300): avc: denied { map } for pid=1058 comm="syz.2.245" path="socket:[10476]" dev="sockfs" ino=10476 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 48.336498][ T1059] cgroup: subsys name conflicts with all [ 48.366461][ T36] audit: type=1400 audit(1750803022.160:301): avc: denied { read } for pid=1058 comm="syz.2.245" path="socket:[10476]" dev="sockfs" ino=10476 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 48.389280][ T363] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 48.406712][ T1064] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:297 [ 48.421230][ T363] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 48.436798][ T36] audit: type=1400 audit(1750803022.160:302): avc: denied { mounton } for pid=1058 comm="syz.2.245" path="/28/file0" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=dir permissive=1 [ 48.443916][ T363] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 48.469839][ T36] audit: type=1400 audit(1750803022.200:303): avc: denied { ioctl } for pid=1058 comm="syz.2.245" path="socket:[10476]" dev="sockfs" ino=10476 ioctlcmd=0x89f1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 48.477157][ T363] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 48.502784][ T36] audit: type=1400 audit(1750803022.250:304): avc: denied { unmount } for pid=288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 48.537170][ T363] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 48.550039][ T363] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 48.566635][ T363] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 48.576455][ T363] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 48.586521][ T1063] batadv_slave_1: left promiscuous mode [ 48.618476][ T363] usb 4-1: config 0 descriptor?? [ 48.630851][ T1043] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 48.675910][ T1073] tipc: Started in network mode [ 48.681185][ T1073] tipc: Node identity 964536fd1976, cluster identity 4711 [ 48.688931][ T1073] tipc: Enabled bearer , priority 0 [ 48.699994][ T304] tipc: Resetting bearer [ 48.726513][ T1078] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:300 [ 48.841393][ T363] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 8 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 48.921767][ T1095] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 49.032641][ T1097] rust_binder: Error in use_page_slow: ESRCH [ 49.039520][ T1097] rust_binder: use_range failure ESRCH [ 49.045876][ T1097] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 49.058156][ T1097] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 49.066844][ T1097] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:109 [ 49.082431][ C1] usblp0: nonzero read bulk status received: -71 [ 49.100695][ T310] usb 4-1: USB disconnect, device number 8 [ 49.108689][ T310] usblp0: removed [ 49.364061][ T1122] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 49.375134][ T1122] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 49.389347][ T1122] rust_binder: Write failure EINVAL in pid:329 [ 49.805871][ T1145] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 49.818148][ T310] tipc: Node number set to 2402498301 [ 50.058221][ T1173] syz.0.284: vmalloc error: size 50749440, failed to allocated page array size 99120, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=syz0,mems_allowed=0 [ 50.081476][ T1173] CPU: 0 UID: 0 PID: 1173 Comm: syz.0.284 Not tainted 6.12.30-syzkaller-g94ce385c22d5 #0 16e511e29439c8b2668c1520ec6e7e54ef5e5f6a [ 50.081514][ T1173] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 50.081540][ T1173] Call Trace: [ 50.081547][ T1173] [ 50.081556][ T1173] __dump_stack+0x21/0x30 [ 50.081669][ T1173] dump_stack_lvl+0x10c/0x190 [ 50.081702][ T1173] ? __cfi_dump_stack_lvl+0x10/0x10 [ 50.081742][ T1173] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 50.081779][ T1173] dump_stack+0x19/0x20 [ 50.081803][ T1173] warn_alloc+0x1bc/0x2a0 [ 50.081826][ T1173] ? __kasan_slab_free+0x5f/0x80 [ 50.081863][ T1173] ? __cfi_warn_alloc+0x10/0x10 [ 50.081887][ T1173] ? __get_vm_area_node+0x1dc/0x3a0 [ 50.081910][ T1173] ? xt_counters_alloc+0x6c/0xe0 [ 50.081976][ T1173] __vmalloc_node_range_noprof+0x68e/0x1420 [ 50.082004][ T1173] ? nf_setsockopt+0x290/0x2b0 [ 50.082036][ T1173] ? __kvmalloc_node_noprof+0x11d/0x300 [ 50.082063][ T1173] ? udp_setsockopt+0xa3/0xc0 [ 50.082091][ T1173] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 50.082115][ T1173] ? __kvmalloc_node_noprof+0x168/0x300 [ 50.082143][ T1173] ? __cfi___kvmalloc_node_noprof+0x10/0x10 [ 50.082172][ T1173] ? xt_counters_alloc+0x6c/0xe0 [ 50.082192][ T1173] vzalloc_noprof+0xfd/0x1d0 [ 50.082217][ T1173] ? xt_counters_alloc+0x6c/0xe0 [ 50.082239][ T1173] ? __cfi_vzalloc_noprof+0x10/0x10 [ 50.082265][ T1173] xt_counters_alloc+0x6c/0xe0 [ 50.082287][ T1173] __do_replace+0xb0/0xa80 [ 50.082316][ T1173] ? arpt_register_table+0x930/0x930 [ 50.082346][ T1173] ? __kvmalloc_node_noprof+0x168/0x300 [ 50.082376][ T1173] ? copy_from_sockptr_offset+0xb0/0xb0 [ 50.082405][ T1173] ? _copy_from_user+0x8b/0xb0 [ 50.082435][ T1173] ? copy_from_sockptr_offset+0x77/0xb0 [ 50.082464][ T1173] do_arpt_set_ctl+0x769/0xa00 [ 50.082490][ T1173] ? __asan_memcpy+0x5a/0x80 [ 50.082516][ T1173] ? release_sock+0x171/0x1f0 [ 50.082547][ T1173] ? __cfi_do_arpt_set_ctl+0x10/0x10 [ 50.082574][ T1173] ? sockopt_release_sock+0x5c/0x70 [ 50.082594][ T1173] ? do_ip_setsockopt+0x1bb2/0x29e0 [ 50.082618][ T1173] ? __cfi_avc_has_perm+0x10/0x10 [ 50.082642][ T1173] ? futex_wake+0x63a/0x900 [ 50.082674][ T1173] ? selinux_socket_setsockopt+0x2ea/0x390 [ 50.082705][ T1173] nf_setsockopt+0x290/0x2b0 [ 50.082735][ T1173] ip_setsockopt+0xf6/0x100 [ 50.082759][ T1173] udp_setsockopt+0xa3/0xc0 [ 50.082783][ T1173] sock_common_setsockopt+0xb5/0xd0 [ 50.082812][ T1173] ? __cfi_sock_common_setsockopt+0x10/0x10 [ 50.082844][ T1173] do_sock_setsockopt+0x26d/0x400 [ 50.082870][ T1173] ? __cfi_do_sock_setsockopt+0x10/0x10 [ 50.082899][ T1173] __x64_sys_setsockopt+0x1b8/0x250 [ 50.082933][ T1173] x64_sys_call+0x2adc/0x2ee0 [ 50.082964][ T1173] do_syscall_64+0x58/0xf0 [ 50.082985][ T1173] ? clear_bhb_loop+0x50/0xa0 [ 50.083011][ T1173] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 50.083045][ T1173] RIP: 0033:0x7f969d98e929 [ 50.083075][ T1173] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 50.083094][ T1173] RSP: 002b:00007f969e8be038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 50.083119][ T1173] RAX: ffffffffffffffda RBX: 00007f969dbb5fa0 RCX: 00007f969d98e929 [ 50.083136][ T1173] RDX: 0000000000000060 RSI: 0a02000000000000 RDI: 0000000000000003 [ 50.083151][ T1173] RBP: 00007f969da10b39 R08: 0000000000000438 R09: 0000000000000000 [ 50.083166][ T1173] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 50.083180][ T1173] R13: 0000000000000000 R14: 00007f969dbb5fa0 R15: 00007ffceeff1a28 [ 50.083198][ T1173] [ 50.083212][ T1173] Mem-Info: [ 50.500300][ T1173] active_anon:6234 inactive_anon:0 isolated_anon:0 [ 50.500300][ T1173] active_file:17982 inactive_file:12922 isolated_file:0 [ 50.500300][ T1173] unevictable:23 dirty:42 writeback:4 [ 50.500300][ T1173] slab_reclaimable:6834 slab_unreclaimable:74061 [ 50.500300][ T1173] mapped:24263 shmem:215 pagetables:897 [ 50.500300][ T1173] sec_pagetables:0 bounce:0 [ 50.500300][ T1173] kernel_misc_reclaimable:0 [ 50.500300][ T1173] free:1506506 free_pcp:8879 free_cma:0 [ 50.556443][ T1173] Node 0 active_anon:24936kB inactive_anon:0kB active_file:71928kB inactive_file:53488kB unevictable:92kB isolated(anon):0kB isolated(file):0kB mapped:97052kB dirty:168kB writeback:16kB shmem:860kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:4640kB pagetables:3588kB sec_pagetables:0kB all_unreclaimable? no [ 50.592977][ T1173] DMA32 free:2960212kB boost:0kB min:19088kB low:23860kB high:28632kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2966020kB mlocked:0kB bounce:0kB free_pcp:5808kB local_pcp:68kB free_cma:0kB [ 50.632253][ T1173] lowmem_reserve[]: 0 3921 3921 [ 50.659132][ T1173] Normal free:3079216kB boost:0kB min:25964kB low:32452kB high:38940kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24936kB inactive_anon:0kB active_file:71928kB inactive_file:53588kB unevictable:92kB writepending:184kB present:5242880kB managed:4016120kB mlocked:92kB bounce:0kB free_pcp:14216kB local_pcp:308kB free_cma:0kB [ 50.714864][ T1173] lowmem_reserve[]: 0 0 0 [ 50.719795][ T1173] DMA32: 3*4kB (M) 1*8kB (M) 4*16kB (M) 4*32kB (M) 4*64kB (M) 3*128kB (M) 4*256kB (M) 4*512kB (M) 5*1024kB (UM) 5*2048kB (M) 718*4096kB (M) = 2960212kB [ 50.739895][ T1173] Normal: 167*4kB (UME) 367*8kB (UME) 397*16kB (ME) 440*32kB (UME) 533*64kB (UME) 28*128kB (UME) 18*256kB (ME) 15*512kB (ME) 10*1024kB (UME) 11*2048kB (UME) 729*4096kB (ME) = 3092772kB [ 50.780753][ T1173] 31588 total pagecache pages [ 50.792888][ T1173] 0 pages in swap cache [ 50.802910][ T1173] Free swap = 124996kB [ 50.808868][ T1173] Total swap = 124996kB [ 50.819261][ T1186] capability: warning: `syz.2.287' uses deprecated v2 capabilities in a way that may be insecure [ 50.836811][ T1173] 2097051 pages RAM [ 50.843247][ T1173] 0 pages HighMem/MovableOnly [ 50.858171][ T1173] 351516 pages reserved [ 50.872337][ T1173] 0 pages cma reserved [ 50.903529][ T1173] Memory allocations: [ 50.915011][ T1173] 0 B 0 init/main.c:1370 func:do_initcalls [ 50.933820][ T1173] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 50.949683][ T1173] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 50.964667][ T1173] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 51.004333][ T1173] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 51.031612][ T1173] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 51.052534][ T1173] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 51.071723][ T1173] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 51.094426][ T1173] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 51.127127][ T1173] 0 B 0 init/initramfs.c:101 func:find_link [ 51.161827][ T1193] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 51.162206][ T1193] rust_binder: Failed to allocate buffer. len:65400, is_oneway:true [ 51.179254][ T1193] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 51.201556][ T1193] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:126 [ 51.584945][ T1217] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 51.607181][ T1217] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 168, size: 255) [ 51.626758][ T1217] rust_binder: Error while translating object. [ 51.639116][ T1217] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 51.646830][ T1217] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:136 [ 51.755167][ T1228] process 'syz.3.304' launched './file1' with NULL argv: empty string added [ 51.841945][ T1237] exFAT-fs (rnullb0): invalid boot record signature [ 51.855758][ T1237] exFAT-fs (rnullb0): failed to read boot sector [ 51.865809][ T1237] exFAT-fs (rnullb0): failed to recognize exfat type [ 52.001774][ T1262] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 52.001891][ T1262] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:149 [ 52.011540][ T1262] fuse: blksize only supported for fuseblk [ 52.028353][ T1262] rust_binder: Error while translating object. [ 52.028417][ T1262] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 52.035938][ T1262] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:149 [ 52.128309][ T1271] rust_binder: Failed to allocate buffer. len:16, is_oneway:false [ 52.184838][ T1275] tipc: Enabling of bearer rejected, failed to enable media [ 52.221082][ T1277] rust_binder: Write failure EFAULT in pid:373 [ 52.238795][ T1275] rust_binder: Write failure EFAULT in pid:156 [ 52.270926][ T1286] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 52.278781][ T1286] rust_binder: Error in use_page_slow: ESRCH [ 52.285858][ T1286] rust_binder: use_range failure ESRCH [ 52.293958][ T1286] rust_binder: Failed to allocate buffer. len:4232, is_oneway:false [ 52.300548][ T1286] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 52.310518][ T1286] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:382 [ 52.354104][ T1291] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 52.418169][ T1292] fuse: Unknown parameter 'group_id00000000000000000000' [ 52.588148][ T310] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 52.641759][ T1297] netlink: 8 bytes leftover after parsing attributes in process `syz.0.326'. [ 52.653848][ T1298] netlink: 8 bytes leftover after parsing attributes in process `syz.0.326'. [ 52.749413][ T310] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 52.759881][ T310] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 52.769863][ T310] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 52.779108][ T310] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 52.787497][ T310] usb 2-1: SerialNumber: syz [ 52.995913][ T310] usb 2-1: 0:2 : does not exist [ 53.001621][ T310] usb 2-1: unit 5 not found! [ 53.008374][ T310] usb 2-1: USB disconnect, device number 7 [ 53.026297][ T364] udevd[364]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 53.309547][ T1306] overlayfs: missing 'lowerdir' [ 53.404440][ T1316] netlink: 'syz.3.334': attribute type 4 has an invalid length. [ 53.918153][ T311] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 53.956659][ T1332] 9pnet_fd: Insufficient options for proto=fd [ 54.058369][ T311] usb 2-1: device descriptor read/64, error -71 [ 54.193636][ T1341] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.256175][ T1341] rust_binder: Write failure EFAULT in pid:163 [ 54.308311][ T311] usb 2-1: device descriptor read/64, error -71 [ 54.568153][ T311] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 54.698182][ T311] usb 2-1: device descriptor read/64, error -71 [ 54.913557][ T1378] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 54.923049][ T1378] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 54.938211][ T311] usb 2-1: device descriptor read/64, error -71 [ 55.048248][ T311] usb usb2-port1: attempt power cycle [ 55.107988][ T36] kauditd_printk_skb: 52 callbacks suppressed [ 55.108011][ T36] audit: type=1400 audit(1750803028.930:357): avc: denied { setopt } for pid=1383 comm="syz.0.359" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 55.315526][ T36] audit: type=1400 audit(1750803029.140:358): avc: denied { accept } for pid=1404 comm="syz.2.365" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 55.349460][ T36] audit: type=1400 audit(1750803029.180:359): avc: denied { write } for pid=1406 comm="syz.2.366" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 55.378271][ T36] audit: type=1400 audit(1750803029.210:360): avc: denied { append } for pid=1412 comm="syz.2.367" name="001" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 55.428187][ T311] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 55.447832][ T1416] netlink: 'syz.3.368': attribute type 4 has an invalid length. [ 55.449387][ T311] usb 2-1: device descriptor read/8, error -71 [ 55.455922][ T1416] netlink: 17 bytes leftover after parsing attributes in process `syz.3.368'. [ 55.496813][ T36] audit: type=1400 audit(1750803029.320:361): avc: denied { mount } for pid=1419 comm="syz.3.370" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 55.536253][ T1428] x_tables: arp_tables: NFLOG.0 target: invalid size 80 (kernel) != (user) 0 [ 55.589342][ T311] usb 2-1: device descriptor read/8, error -71 [ 55.628147][ T310] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 55.662974][ T36] audit: type=1400 audit(1750803029.490:362): avc: denied { map } for pid=1436 comm="syz.3.374" path="socket:[11638]" dev="sockfs" ino=11638 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 55.688483][ T36] audit: type=1400 audit(1750803029.490:363): avc: denied { accept } for pid=1436 comm="syz.3.374" path="socket:[11638]" dev="sockfs" ino=11638 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 55.773796][ T36] audit: type=1400 audit(1750803029.600:364): avc: denied { setopt } for pid=1438 comm="syz.3.375" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 55.808163][ T310] usb 3-1: Using ep0 maxpacket: 8 [ 55.815688][ T310] usb 3-1: config 0 has an invalid interface number: 151 but max is 1 [ 55.824686][ T310] usb 3-1: config 0 has no interface number 1 [ 55.831042][ T310] usb 3-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 55.842235][ T310] usb 3-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 55.854861][ T311] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 55.863394][ T310] usb 3-1: config 0 interface 151 altsetting 0 endpoint 0x83 has invalid maxpacket 64466, setting to 1024 [ 55.875682][ T310] usb 3-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 55.886246][ T310] usb 3-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 55.900994][ T311] usb 2-1: device descriptor read/8, error -71 [ 55.907866][ T310] usb 3-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 55.917822][ T310] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.926217][ T310] usb 3-1: Product: syz [ 55.930528][ T310] usb 3-1: Manufacturer: syz [ 55.935333][ T310] usb 3-1: SerialNumber: syz [ 55.941340][ T310] usb 3-1: config 0 descriptor?? [ 55.946816][ T1413] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 55.960169][ T310] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 56.030941][ T36] audit: type=1326 audit(1750803029.860:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1401 comm="syz.0.364" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f969d98e929 code=0x7fc00000 [ 56.033011][ T311] usb 2-1: device descriptor read/8, error -71 [ 56.075057][ T1464] /dev/rnullb0: Can't lookup blockdev [ 56.075524][ T36] audit: type=1400 audit(1750803029.900:366): avc: denied { append } for pid=1462 comm="syz.0.384" name="rnullb0" dev="tmpfs" ino=124 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="system_u:object_r:mnt_t:s0" [ 56.115124][ T1466] 8021q: VLANs not supported on wg2 [ 56.158592][ T310] usb 3-1: USB disconnect, device number 11 [ 56.172970][ T311] usb usb2-port1: unable to enumerate USB device [ 56.428616][ T1502] overlayfs: failed to resolve './file1': -2 [ 56.771309][ T288] ------------[ cut here ]------------ [ 56.777132][ T288] WARNING: CPU: 0 PID: 288 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 56.785308][ T288] Modules linked in: [ 56.789416][ T288] CPU: 0 UID: 0 PID: 288 Comm: syz-executor Not tainted 6.12.30-syzkaller-g94ce385c22d5 #0 16e511e29439c8b2668c1520ec6e7e54ef5e5f6a [ 56.803412][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 56.814191][ T288] RIP: 0010:drop_nlink+0xce/0x110 [ 56.819677][ T288] Code: 04 00 00 be 08 00 00 00 e8 cf 55 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 f2 5a 98 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 56.840359][ T288] RSP: 0018:ffffc9000117fc60 EFLAGS: 00010293 [ 56.847092][ T288] RAX: ffffffff81ed45be RBX: ffff88812027ad10 RCX: ffff88812386cc00 [ 56.857545][ T288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 56.865940][ T288] RBP: ffffc9000117fc88 R08: 0000000000000003 R09: 0000000000000004 [ 56.874255][ T288] R10: dffffc0000000000 R11: fffff5200022ff7c R12: dffffc0000000000 [ 56.882288][ T288] R13: 1ffff1102404f5ab R14: ffff88812027ad58 R15: 0000000000000000 [ 56.890398][ T288] FS: 0000555558a59500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 56.899669][ T288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 56.906786][ T288] CR2: 0000555558a7c4e8 CR3: 0000000101fb0000 CR4: 00000000003526b0 [ 56.914856][ T288] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 56.922877][ T288] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 56.930899][ T288] Call Trace: [ 56.934364][ T288] [ 56.937328][ T288] shmem_rmdir+0x5f/0x90 [ 56.941641][ T288] vfs_rmdir+0x3dd/0x560 [ 56.945915][ T288] incfs_kill_sb+0x109/0x230 [ 56.950908][ T288] deactivate_locked_super+0xd5/0x2a0 [ 56.956806][ T288] deactivate_super+0xb8/0xe0 [ 56.961837][ T288] cleanup_mnt+0x3f1/0x480 [ 56.966502][ T288] __cleanup_mnt+0x1d/0x40 [ 56.971269][ T288] task_work_run+0x1e0/0x250 [ 56.975911][ T288] ? __cfi_task_work_run+0x10/0x10 [ 56.981130][ T288] ? __x64_sys_umount+0x126/0x170 [ 56.986195][ T288] ? __cfi___x64_sys_umount+0x10/0x10 [ 56.991667][ T288] ? __kasan_check_read+0x15/0x20 [ 56.996995][ T288] resume_user_mode_work+0x36/0x50 [ 57.002415][ T288] syscall_exit_to_user_mode+0x64/0xb0 [ 57.008019][ T288] do_syscall_64+0x64/0xf0 [ 57.012770][ T288] ? clear_bhb_loop+0x50/0xa0 [ 57.018226][ T288] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.024232][ T288] RIP: 0033:0x7fbe19b8fc57 [ 57.028792][ T288] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 57.050444][ T288] RSP: 002b:00007ffd0a6dd638 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 57.059960][ T288] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fbe19b8fc57 [ 57.068163][ T288] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd0a6dd6f0 [ 57.076506][ T288] RBP: 00007ffd0a6dd6f0 R08: 0000000000000000 R09: 0000000000000000 [ 57.084882][ T288] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd0a6de780 [ 57.093589][ T288] R13: 00007fbe19c10925 R14: 000000000000ddb8 R15: 00007ffd0a6de7c0 [ 57.101817][ T288] [ 57.105065][ T288] ---[ end trace 0000000000000000 ]--- [ 57.111259][ T288] ================================================================== [ 57.120468][ T288] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 57.127194][ T288] Write of size 4 at addr 0000000000000168 by task syz-executor/288 [ 57.135891][ T288] [ 57.138268][ T288] CPU: 0 UID: 0 PID: 288 Comm: syz-executor Tainted: G W 6.12.30-syzkaller-g94ce385c22d5 #0 16e511e29439c8b2668c1520ec6e7e54ef5e5f6a [ 57.138297][ T288] Tainted: [W]=WARN [ 57.138304][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 57.138314][ T288] Call Trace: [ 57.138321][ T288] [ 57.138328][ T288] __dump_stack+0x21/0x30 [ 57.138353][ T288] dump_stack_lvl+0x10c/0x190 [ 57.138371][ T288] ? __cfi_dump_stack_lvl+0x10/0x10 [ 57.138483][ T288] print_report+0x3d/0x70 [ 57.138512][ T288] kasan_report+0x163/0x1a0 [ 57.138537][ T288] ? ihold+0x24/0x70 [ 57.138559][ T288] ? _raw_spin_unlock+0x45/0x60 [ 57.138583][ T288] ? ihold+0x24/0x70 [ 57.138605][ T288] kasan_check_range+0x299/0x2a0 [ 57.138630][ T288] __kasan_check_write+0x18/0x20 [ 57.138648][ T288] ihold+0x24/0x70 [ 57.138669][ T288] vfs_rmdir+0x26a/0x560 [ 57.138685][ T288] incfs_kill_sb+0x109/0x230 [ 57.138704][ T288] deactivate_locked_super+0xd5/0x2a0 [ 57.138720][ T288] deactivate_super+0xb8/0xe0 [ 57.138735][ T288] cleanup_mnt+0x3f1/0x480 [ 57.138759][ T288] __cleanup_mnt+0x1d/0x40 [ 57.138781][ T288] task_work_run+0x1e0/0x250 [ 57.138798][ T288] ? __cfi_task_work_run+0x10/0x10 [ 57.138813][ T288] ? __x64_sys_umount+0x126/0x170 [ 57.138830][ T288] ? __cfi___x64_sys_umount+0x10/0x10 [ 57.138848][ T288] ? __kasan_check_read+0x15/0x20 [ 57.138866][ T288] resume_user_mode_work+0x36/0x50 [ 57.138882][ T288] syscall_exit_to_user_mode+0x64/0xb0 [ 57.138903][ T288] do_syscall_64+0x64/0xf0 [ 57.138917][ T288] ? clear_bhb_loop+0x50/0xa0 [ 57.138936][ T288] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.138953][ T288] RIP: 0033:0x7fbe19b8fc57 [ 57.138967][ T288] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 57.138987][ T288] RSP: 002b:00007ffd0a6dd638 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 57.139015][ T288] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fbe19b8fc57 [ 57.139030][ T288] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd0a6dd6f0 [ 57.139044][ T288] RBP: 00007ffd0a6dd6f0 R08: 0000000000000000 R09: 0000000000000000 [ 57.139059][ T288] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd0a6de780 [ 57.139075][ T288] R13: 00007fbe19c10925 R14: 000000000000ddb8 R15: 00007ffd0a6de7c0 [ 57.139104][ T288] [ 57.139113][ T288] ================================================================== [ 57.406273][ T288] Disabling lock debugging due to kernel taint [ 57.413248][ T288] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 57.421760][ T288] #PF: supervisor write access in kernel mode [ 57.428559][ T288] #PF: error_code(0x0002) - not-present page [ 57.435865][ T288] PGD 80000001320f7067 P4D 80000001320f7067 PUD 0 [ 57.442568][ T288] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 57.449429][ T288] CPU: 0 UID: 0 PID: 288 Comm: syz-executor Tainted: G B W 6.12.30-syzkaller-g94ce385c22d5 #0 16e511e29439c8b2668c1520ec6e7e54ef5e5f6a [ 57.465637][ T288] Tainted: [B]=BAD_PAGE, [W]=WARN [ 57.470752][ T288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 57.481688][ T288] RIP: 0010:ihold+0x2a/0x70 [ 57.486498][ T288] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 dd 51 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 8c 4c ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 ed [ 57.506326][ T288] RSP: 0018:ffffc9000117fca0 EFLAGS: 00010246 [ 57.513197][ T288] RAX: ffff88812386cc00 RBX: 0000000000000000 RCX: ffff88812386cc00 [ 57.521377][ T288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 57.529461][ T288] RBP: ffffc9000117fcb0 R08: ffffffff88958947 R09: 1ffffffff112b128 [ 57.537552][ T288] R10: dffffc0000000000 R11: fffffbfff112b129 R12: ffff88812027ad1c [ 57.545899][ T288] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 57.554076][ T288] FS: 0000555558a59500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 57.563168][ T288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.569992][ T288] CR2: 0000000000000168 CR3: 0000000101fb0000 CR4: 00000000003526b0 [ 57.578065][ T288] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.586476][ T288] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.594550][ T288] Call Trace: [ 57.597868][ T288] [ 57.601012][ T288] vfs_rmdir+0x26a/0x560 [ 57.605400][ T288] incfs_kill_sb+0x109/0x230 [ 57.610282][ T288] deactivate_locked_super+0xd5/0x2a0 [ 57.615947][ T288] deactivate_super+0xb8/0xe0 [ 57.620854][ T288] cleanup_mnt+0x3f1/0x480 [ 57.625527][ T288] __cleanup_mnt+0x1d/0x40 [ 57.630142][ T288] task_work_run+0x1e0/0x250 [ 57.634871][ T288] ? __cfi_task_work_run+0x10/0x10 [ 57.640098][ T288] ? __x64_sys_umount+0x126/0x170 [ 57.645328][ T288] ? __cfi___x64_sys_umount+0x10/0x10 [ 57.650909][ T288] ? __kasan_check_read+0x15/0x20 [ 57.656038][ T288] resume_user_mode_work+0x36/0x50 [ 57.661172][ T288] syscall_exit_to_user_mode+0x64/0xb0 [ 57.666743][ T288] do_syscall_64+0x64/0xf0 [ 57.671201][ T288] ? clear_bhb_loop+0x50/0xa0 [ 57.675989][ T288] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.681900][ T288] RIP: 0033:0x7fbe19b8fc57 [ 57.686591][ T288] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 57.706292][ T288] RSP: 002b:00007ffd0a6dd638 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 57.714997][ T288] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fbe19b8fc57 [ 57.723358][ T288] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd0a6dd6f0 [ 57.731950][ T288] RBP: 00007ffd0a6dd6f0 R08: 0000000000000000 R09: 0000000000000000 [ 57.740116][ T288] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd0a6de780 [ 57.748302][ T288] R13: 00007fbe19c10925 R14: 000000000000ddb8 R15: 00007ffd0a6de7c0 [ 57.756571][ T288] [ 57.759689][ T288] Modules linked in: [ 57.763607][ T288] CR2: 0000000000000168 [ 57.767850][ T288] ---[ end trace 0000000000000000 ]--- [ 57.773494][ T288] RIP: 0010:ihold+0x2a/0x70 [ 57.778172][ T288] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 dd 51 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 8c 4c ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 ed [ 57.798232][ T288] RSP: 0018:ffffc9000117fca0 EFLAGS: 00010246 [ 57.804593][ T288] RAX: ffff88812386cc00 RBX: 0000000000000000 RCX: ffff88812386cc00 [ 57.812816][ T288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 57.821336][ T288] RBP: ffffc9000117fcb0 R08: ffffffff88958947 R09: 1ffffffff112b128 [ 57.829501][ T288] R10: dffffc0000000000 R11: fffffbfff112b129 R12: ffff88812027ad1c [ 57.837664][ T288] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 57.845903][ T288] FS: 0000555558a59500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 57.854945][ T288] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.861730][ T288] CR2: 0000000000000168 CR3: 0000000101fb0000 CR4: 00000000003526b0 [ 57.870320][ T288] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.878313][ T288] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.886332][ T288] Kernel panic - not syncing: Fatal exception [ 57.892567][ T288] Kernel Offset: disabled [ 57.896996][ T288] Rebooting in 86400 seconds..