last executing test programs: 2.578023587s ago: executing program 0 (id=415): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x103, 0x3}) r1 = mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r2 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x40, 0x2c, 0x11}, 0x18) mkdirat(r2, &(0x7f00000000c0)='./file0\x00', 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newae={0x40, 0x1e, 0x1, 0x70bd26, 0x25dfdbfe, {{@in=@multicast2, 0x4d3, 0xa, 0x33}, @in=@broadcast, 0x4, 0x3505}}, 0x40}}, 0x90) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_INTERRUPT(r5, 0x4004ae86, &(0x7f0000000140)=0xe0) r6 = syz_usb_connect(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000e09d7040460a2196324f01020301090224000100000000090400000206d3450009050102100000000009058b0240"], 0x0) syz_usb_control_io$printer(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, &(0x7f0000000700)={0x84, &(0x7f0000000240)=ANY=[@ANYBLOB="400a06000000eef1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r6, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="20131d00000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$cgroup_int(r3, &(0x7f0000000300)='cpuset.sched_load_balance\x00', 0x2, 0x0) write$cgroup_int(r7, &(0x7f0000000040), 0x1) ioctl$BTRFS_IOC_SNAP_CREATE(r0, 0x50009401, &(0x7f0000000680)={{r0}, "5a511e9189418a284219772599b51d73003675157b531a252b05a569926c23dd743b081e0a32fb7d7cc9985e40b87d2ab0d45fd8a1e1bc01b6605826e878dafb535f6c15b12b10acbfe1b2a01348fac736ce5f47cb8c2ec664d0f9a2250a0acf4736b11c505e2a7f761b71672d09fb184a0f5177eb540ae223bfc71532e4f4e18412c910d4a0b31ea46642cc3ee8861e47ceea0588b8bf7e66b46f245450f62cb5f1a0bad85db40d55f12e295c062701c72e4c4bcb6d4bee504e19b6907533f01c18b32d80b29a54877cd1f7f77e4e2b970871d9a9db25730efbf4442284ea9c0fb472bf8538c3853805978ce3913ffd8e563626f2bfe581af01c29f3d3ee4cf3f345d32363538fd373247adb7793e9c09349fa3f0719b82b480e226a5ba6f223d1bf19bfed88254cfe9ecc6bd1d809708a2e1c264ca1252b5c92275637b7000974234cb029087f377a4737772e0c26d128c259700f4d86c55dc4d3ffc5bb9f8f317966757b3e17737d2e9b32fda0511e290d9272bd7962eeff79f4931d88184895abc24f54109b3227fde7b9496651bf62810db6b0b1239f671b60bb25176b6ff7354e4246a35c259ef8e5dccac56d06e70c28e9b1786f3d20079fc2b3a5f3ece307ab4475377155cb1f565a88c72182a9086f7adec4a2c7b2c7bc1221b2b18a9a83dda9edd306a75c7a45e9cae3685c7f33389fdc806fa3a9a966e5423fc98bf94f09a55238bac4ad767d47ab70239c74ac1674582a01fc2337040ebb3017a73bd9d2b849f881cfb56465ae6e14f7fc426bf3f489ca4ba9df9bfd27338efdb60c330ae891ecd04d2852843dba92291917509a715ef813b19214d58e4a2d01dbe301daed98b1c1b85cc02e6f51aceba2e682c12ba72d80d7ddc3b7c2052b7794ceaaee35a275413f88856df01af033258e8335d05b242c0147aa6c6f36e91b87b633ec1077cb7d11ba911ca54ad18ad855eba2071533199925291b367d77c9e061f8d12edc697fd0f4468a6052653a94e20a8660951359bd424c7284a9d6ef62af4a15b98600aef92bef8b9aaa83972e794adc6925d5c961ee4ebf9af93dbeb7668ad0ce7b1d65bec68c3f3757c25c4c60be0bc07a112dbfa638ef849aea71f517b774119e0d6289b942b67bf39de9983e5974706a9139717f09b68ded07e5e3436e644770b21dcbf3586a364b2367e3196e9236e6fa07c0694256681bf7961c6efa73fdd4decb96d60ce05d1233fda525ed40d20750dd19c68f2a7a1643c0bd520042bea3dc7a8f76aa3f999a1e9c01c2ead12ad6c7a09dc1afdb95a72af9b748cb435ed8da5ba6487f219a7b6dba344a1fb3fb6dfe80dae68e90e250ea50bc51cc512d352ca696c7c06c18d6ce85f2edf47b8ea84f586f4ae8e997f87abdc040a449ea71204581ab29f5bbeafb8641f3ad00c66aa9a016049caaa0a205f39e53c79d231c820b585ac42b8a60663495c38f649236da5a95c6565ef2dd5baf4f440c027107fb66e8cf0c93684bcc6d2afd872252e640c515417564d82ea518841c0bf35253713885ebc4e37161455465268c0e30d7e065c7656a4dac7604af61221313f47f91cea546d69a01e84f840ab8756ecc17d6cafecdea1b9b8d39db298ef8958aca9910827e2c2d989f0e40132955f4cc78ef764a2b63d1632897c4a834cdd36317b714c8f055ed9637c0441107e34c9246fc8bfdbb2e0d7bb77d39ad46250d4cad3fb6ed9b04fde28f3c8d474f22e8085ac604846a7f8271445e6344addc3a1e03e97ed0f4a8d8f4882b903c437684a51e9d219d3c17993c94f6733c85dfcd7891e7cb5aa72131e5723cee497a05cea256262b2081760aa8f23a46a69e94be30fba6ab4edc40c6b16817f09159da6ca79461a8a93541813d3f2b2f0c650330a8539549e104cd000f6bc5c391def86529381ce326d49b5fecaf200cbae0074a795e3d9f2c53a491956ec241002f2de39e059d5164ee265b34ec6a34abb23c870cc97a60844174560f3976c20972f368f02bf40a9f8c34aa1a9074f193718dad757e96bb799285aa1c96807aee16d6f4ba6d1f777e1b46ce098dcddca30b8bd12161128361fa9b7b2fafa5225f8a86f704ad7a497d6cc58f04265ff9ef4781d19bd4c5457b2e9a192c8fd060262f7f0710e5a4874080d04e802f81d2e90796d56d7f6a337a0c5da2049a5f2acd5c39db2b7712b2b1e9380392dfd2f93015db22f3df0cbce2f0fd8ee177782d34ab0a2356704415f637b5e8bf2c15d8313593b4ddc7d9e353d33afd6c28c57d22a965d9ab5203ab5e8daf7db2055f5417596c1b71ab33754dfaf015b042e3c5c04a44997143b8c35582a2a77ef11e11951c31aeeb897c862061819e96f159853222e48f7d4d9e9fa1f9a65c84a451faee157655bc715489e6547fb61b6fe4da281f7fce7555d45e10d3d022101135e1ad012adb745c2bb4be44a558a64911c895187a57f9083c01514c163708698adea1581011c1adce0cc7999a5e1e02766313353c5e4a7b5b0f60eefffd31b4548894f3f2e21ec7fa7d87a66e66764063a2eacc54292c5a0b67fe9819d96981d3fc60e25976785b2e005db6d72a92df5d1a3862fde37db9d3811762836ed33fdabccb00d518274fef150aaf00ba60dacc522bb7ca48d37af9671f6b6c678252ac01f30276ee6b831d6e527fbf94fffef3a8de1d180e61a7c663f6b3f5a907ea899a5454f8858527ef07af9649640f86f1af6b6f78d9334d2215bb61f2beddc22055fa35638cd302977f947f09a5b85a77e3c9d68a9f9dc9548b5e81b45c653b6cafba2f59e92cb2e500b1c5657580e2624600dae4b8d101ad90a2e4afea35108dcd8ac1af77216368b042c5a215707f3b9451a4c1103dc5a85d990c43b4ee930409d4a0e2b1dcd136c4a1e6890c83c23f329f7bf8bd4f2e4f7888ce6467f4442d06ae66ad759a3edd7d628a0339791ea43386f7d96e23f294ab6d2335db40e2c93c61ca3499c832ff5ebfa17baffeb3a000ec4a17f60ddbc73f95daed80d9f2bda569b29d27c83dbe73737d1d60f1d18d695e2cdd92558e45df479a834264c2e833beb9401bdd7e54b954f442d7108017ce355e785ef5d93dd53f657ef880156f22e50f2456a11d2085f8e65f5ee7934f430f601f0eeee6ade5fd33ecbbbb07be9f3d25e1fc4ac13e92765e97649f58f12cea0eb8db3cd5763a83647ce476aef407523279c0424d87de02247346eb9e95bff06f411cc4b0031ab9e91236c9c27a19a9c7fa7d81925f8eb208b25f14d36d2c19547f5807b13f57a88218992dc9b3dc43ba476d197ae30dcd3e271ab1161cb22f28be967dc6302ec978c11b9303ed458b9709ab0be1ff6c45078153edc745ec719e287f151342603dbfaebd64533c44f4ef2c26bdf8494ed6044163d14d959871bddbb971c3a5ad0b9d4676f2d5ddfe4bb7a345fd838ea3862eb51611b1ed1096bc9cbdc5b10f6c1bd8631616eb4cd2df1a76af9ee4ee3884402fefd35c778aeaaf47f7c19a844fe1555dd1b183a54255764e7a920c450055bcd8ecbaaeb09cbc553453a4013535567c07af5f28e34581e2844df31bed25d0dcc87c6b685e5f66db1bbd1d7463433ff4e341190be49ff563fc242f5c3fa789b38eca9141b643e024578846d61dbe006655179a8173274b734d9c1afcb1f11d1df7a97b901fc4a72873286ec70b95e26d185c2b4ed39773de9fd009e68672f46b9e419ade983eea4ca74770a44f886888bc7fe6f1c12a8d545ff5504be7f446b6cc328fa395cbb0edac7b550d70d21d3a6c35b7fe54440f1f3375e85f4108371ec6cf85970954e62515d748922efbc6cbfa0608eafe4eeacb4654f0c50fbf1d978861c9c6ec291ce700747b6614841361d109d29101d13d77d70035701e07bcfec64fb34eecf37f2318a3f8e7db9c9ae90f3daf92e26f45fc6101c1f8ca9a399953183f66e718a3fa318a1720f11c8b5fc55891ca9b335e9b21bcca3dfa5c398f53cad4585ef3f00462db0acd322ceb767f49d24fd0e379d220a2598578940ca7daf4708bbe6d36045e7a718127455599f26e486f97620720f8b565f6950dca55b403eac10ed406c4eb54800cf1306c1692680404e84206e4ca38d9c032f1911ad7c143541dea8efcbc57a69f9380765f5fe9fc337fd986085ab5e6480b3e0034552d5bc4b0736cbdb5b13c288e0a71082a69c372dc84fbffc011b937fe73f3482fe7cd5ec77fed034a5b7843353d7ebc54fcb5060be118490dce7cc4b4fa8854d5a2477839739f192148d3db2d1994f375b915913d28ab22790637878b61bb400f20ef8cb3792bd2ba36c2d164d6729cbf7a037c49c6331a99d06ef569756cab3fa8a5194575e29692f3574e8debb18761054e89aaa47a4e8f04e75fdd97e9b46329e882dc8d38ae35c4b39ecacf0014572a2d53d1304fba4241966eb708122e065dd696cf0e4d12de0629d949c502ad96cd0fdf50f43802e90aa0bfb48ae3fae133a9ca58d8766e7d111ee77e4367f6326252c67b696dcc98c7446880b0ae7df8cb7a0bf826f20920c97cf1ddedab2890706c2f6c3441fc9dbfa7b29b82661f49c5386bb1c6d1a33740c608c056fcbfc806e99e7954c43cf8aa9750477bf43aeed4904ad1ccdeb4b462cbed96d224f49a8da09bbc3892d28f19a814e354386bc30b502ee6134dc0f9b1986683423db556080bedcb9e446237bb0bc280727e0afe8930ff9566ad339f154683897ce73da51239a6ea82fdb9a6d87365563aea87d724443b7d19d792f287ecb2fc6880e8e202bcdaf21289a9bff7cd7e28f458632c8681147c853a81445972977b3257e776a82861da2d996ecfa8441435835456687b156ed35108aaddf3d7e2ec90016334b3738aadc2aa9700d6a6878b8afb32eaa2fe0123b16dbc471a587bade64a90ec413b017e0f57face96b0120f98435f3c8b316b0372f93d511dcc98f3079908775dda20adb8ababdc0101090a5171d4810b5af77908518084af4a2ae0bddb4414eb08101467c5297aaaaad72ba7067a11e652611f28e64883cb32361f645c62d5967e3ca3d2131dd2b2f996da869a5dad1356c35da8a19ebdaffe31000f3ec2f7b38f3cd0bdafab021bd9fb7e01d1cceffc8a632a89ac2f027ab3908eeb3e5040fcb57154283c50992a0f7814a7b88009d19f70541df533e072d92254ab9117dd3ff2cadaafafd461b35edc1ce7ed97801bb17de7bcc43c6216f6c20ff71ac56bb6f4b0035daf97afc553a58ac644648d1d465017e660d06bb46561468b9f525d1806df41636bbffded790f83c00450eeb2d7fa0fcb1225f0e87009e70245da1c3c6a926f3b75e24801dd7123e6f28a3c211822f9141728cceaf88f4c6247b446d3d1d660e6d4ea47d907daeb8f3bd41f9ef700471660f5e2f79c88b4c6dfa6fa8e15bea5612574082b8dddb88573a6280df23ff385754a6ea8bbb9fdd736525486b1d01821d5aa4954f045bcf43a2d97980e6109bf62641dcdf970cda3066c4a909846abbd5c3b38aa8f96f4b746f15b911bab94a1f92612319092ba526d0e8805bf6b1e98702ceeec4569a4c2a69fa10e2f983177e33ee9a836d859041592a9c9b2abf0d5766b04d57c4cfcea8ee1f9aff271d9eae0a21f9c78401e0bbf267749f83872919020d829229e65aeeecbe8ee2c73547bf4b0096074f441dba77af91714a227a939e1ce450ca58d4b68be55319b4df377d653d62ff4ca11254a273dbfabc5e5a3bb17ff6372740a47a5326744e4f587de931c04a044b5b1261"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xf0, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}, @free_buffer={0x40086303, r1}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000280)={0x30, 0x30, 0x30}}, 0x40}], 0x0, 0x0, 0x0}) 755.507616ms ago: executing program 3 (id=434): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x1000, 0x8, '9P2000.u'}, 0x15) (async) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) (async) write$FUSE_INIT(r2, &(0x7f0000001740)={0x50, 0x0, 0x0, {0x7, 0x21, 0x0, 0x14210000, 0x7d, 0x1005, 0x0, 0x3}}, 0x50) (async) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000180)={0x0, 'pimreg\x00', {0x3}, 0x3fc}) (async) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000140)=0x2, 0x4) (async) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/power/mem_sleep', 0x8002, 0x80) (async) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$PTP_SYS_OFFSET_EXTENDED(r4, 0xc4c03d09, 0x0) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r7, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d}) syz_usb_connect(0x0, 0x24, 0x0, 0x0) (async) r8 = dup(r6) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r9, 0x0, 0x0) eventfd(0x0) ioctl$NS_GET_USERNS(0xffffffffffffffff, 0x8004b708, 0x0) (async) mount$binderfs(0x0, 0x0, &(0x7f00000000c0), 0x4, 0x0) (async) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r5, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) (async) poll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x11}, {0xffffffffffffffff, 0x4}, {0xffffffffffffffff, 0x4023}, {r3, 0x404}, {0xffffffffffffffff, 0x4202}, {0xffffffffffffffff, 0x500}, {0xffffffffffffffff, 0x5004}], 0x7, 0x0) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0x3e) (async) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000280)={r3, 0x0, {0x0, 0x0, 0x0, 0x6, 0x4000000000000ffd, 0x0, 0x0, 0x1b, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a84a55ba129f8ac61b7ad3300", [0xffffffffffffff00, 0xa]}}) (async) ioctl$AUTOFS_IOC_CATATONIC(r5, 0x9362, 0x0) (async) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000004380), 0x1814800, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@ignoreqv}, {@noxattr}, {@version_L}], [], 0x6b}}) 686.424073ms ago: executing program 3 (id=436): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x101c00, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = getpgrp(r1) kcmp(r2, r1, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x9, 0x28011, r0, 0xffffa000) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/rcu_expedited', 0x2600, 0x140) r5 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, @dev, @dev={0xfe, 0x80, '\x00', 0x37}, 0x10, 0x0, 0x0, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r5, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x0, 0x0, 0x0, 0x4007}}) getsockopt$TIPC_DEST_DROPPABLE(r5, 0x10f, 0x81, &(0x7f0000000400), &(0x7f0000000440)=0x4) r6 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r4, 0xb) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000940)={0x84, 0x0, &(0x7f0000000340)=[@free_buffer={0x40086303, r6}, @enter_looper, @exit_looper, @exit_looper, @clear_death={0x400c630f, 0x2}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000280)={@fd={0x66642a85, 0x0, r0}, @fda={0x66646185, 0x9, 0x0, 0x15}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000300)={0x0, 0x18, 0x38}}, 0x40}, @request_death], 0x0, 0x0, 0x0}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/207, 0xcf, 0x1, &(0x7f0000000100)=""/165, 0xa5}, &(0x7f0000000200)=0x40) 678.307984ms ago: executing program 3 (id=437): sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x34}}, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) recvmmsg(r1, &(0x7f0000005300)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x40000042, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000180)=""/249, 0xf9, 0x2, 0x4}, @fda={0x66646185, 0x7, 0x0, 0x12}, @fda={0x66646185, 0x0, 0x0, 0x23}}, &(0x7f0000000000)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) 630.050088ms ago: executing program 3 (id=438): mount$binderfs(0x0, &(0x7f0000000080)='./binderfs\x00', 0x0, 0x2010860, &(0x7f0000000000)=ANY=[@ANYBLOB="636f6e74657874ccf0d4f05b379200ee000000000000000007c92e93c31fddfe210a7dce7f4826"]) r0 = accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000000c0)=0x14) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000000, 0x8010, r0, 0xa9a07000) 555.893895ms ago: executing program 3 (id=439): mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000440), 0x1, 0x0) write(r0, &(0x7f0000000480)="532e87ac770767f7429748", 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000001240)={0x2, &(0x7f0000001200)=[{0x1f, 0x2, 0x0, 0x400}, {0x6}]}) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='fdinfo\x00') getdents64(r1, &(0x7f0000000080)=""/38, 0x26) getdents64(r1, &(0x7f0000000040)=""/22, 0x16) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="0000000000000000000000000000b63e22ff64f64b3ad04c288d00abf2466325e3a6338425ae621fdfcdb5d868ac5aa6867c9401ff559bb12521767ea0f0f8c551aa573b72d173b59526d3365457d9d958ff84db921c588988c15f"], 0x14}, 0x1, 0x0, 0x0, 0x48c05}, 0x4040140) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000ac0), 0x0, &(0x7f0000000400)) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x108100, 0x0) r4 = syz_usb_connect$hid(0x4, 0x3f, &(0x7f0000000100)={{0x12, 0x1, 0x140, 0x0, 0x0, 0x0, 0x10, 0x57e, 0x2019, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xd, 0x90, 0x1, [{{0x9, 0x4, 0x0, 0x7, 0x1, 0x3, 0x1, 0x2, 0x6, {0x9, 0x21, 0x4, 0x8, 0x1, {0x22, 0xeb4}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x2, 0x1, 0x9}}, [{{0x9, 0x5, 0x2, 0x3, 0x3ff, 0x4, 0x6c, 0x2}}]}}}]}}]}}, &(0x7f0000000680)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x300, 0xe1, 0x7c, 0x3, 0x10, 0x6}, 0x4c, &(0x7f0000000440)={0x5, 0xf, 0x4c, 0x5, [@ssp_cap={0x18, 0x10, 0xa, 0x3, 0x3, 0x5, 0xf000, 0x400, [0xc030, 0x10160c0, 0x80bfc0]}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x6, 0xe2, 0x9, 0x34a}, @ssp_cap={0x10, 0x10, 0xa, 0x82, 0x1, 0x3, 0xf000, 0xf, [0xc0c0]}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x8, 0x9, 0x9e, 0x8}, @wireless={0xb, 0x10, 0x1, 0x2, 0x43, 0x2c, 0x7, 0x1, 0x34}]}, 0x5, [{0x73, &(0x7f00000004c0)=@string={0x73, 0x3, "b9372b20b5e46b88d896432eedb588ae7bc75f7eafa01b3eca0a3f5dbe0b605e6f117e3cf5be8c18eef5cf1178c66da86aa1997556afa4277b15538e66c995c5e0183a0c89a697419eb37fec887a183166f5f1cb8de1c77ffd6e92c4c6215f9f856f7e38599b029c80f02788aabc746746"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0xc07}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x44a}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x43f}}, {0x45, &(0x7f0000000600)=@string={0x45, 0x3, "12a2704c995bfc3225f2a887e84e019fddfd3e834a3bd2076566caf7b6f16b0d5f06a16e622a82cbff2ba88fe1fb2d76eb9abfa07267ea86d7304504875c4a1748d689"}}]}) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) fsetxattr$security_selinux(r5, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:boot_t:s0\x00', 0x1c, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000840)={0x24, &(0x7f0000000580)=ANY=[@ANYBLOB="40062000000020220d0000499fbcff00008d321bf798bc82ef314432153ff15600dec50feb6c"], &(0x7f0000000700)={0x0, 0x3, 0xb3, @string={0xb3, 0x3, "2f93d0a1b8e1ec9aa9fba5663cdf2171e7dd29a3620dd54673b3f7bfac3d52d49b825d4df1f238dad8e6cae5ab89f9090d309d5acf33ecbde86cbbf2ac5827cbae7ed2c844d784a1a9caa0e5f2fac7a941a9e04dfe722281b15c9fbf1f65c50cefd3bdbd48f440d5f327f932bff692949c7f8aaf4ea9a11c6bc5b38969c3ec84329b08d768c592d39585a0a6198a09358f079f8ad3406a17b3268f379c691118ca3122d2458ec6993b07047b242e558821"}}, &(0x7f00000007c0)={0x0, 0x22, 0x12, {[@main=@item_4={0x3, 0x0, 0xb, "9189de8c"}, @main=@item_012={0x2, 0x0, 0x8, "0203"}, @global=@item_012={0x2, 0x1, 0x4, "e6a4"}, @main=@item_4={0x3, 0x0, 0x8, "d5e68b2c"}, @main=@item_012={0x0, 0x0, 0xa}, @local=@item_012={0x0, 0x2, 0x5}]}}, &(0x7f0000000800)={0x0, 0x21, 0x9, {0x9, 0x21, 0xf46, 0xa, 0x1, {0x22, 0xf65}}}}, &(0x7f0000000a80)={0x2c, &(0x7f0000000880)={0x40, 0x1, 0xa0, "a7f2e9793e9a6e3d51d83b767b141acff9963067f3e655733284e1ff5607611105e34f65d0faae5f0155c6e57bf60c0ff4a46471ad899574235516909a842993d7661de477566394b2c278813885a872f0750e65c43dfe5350a0fcdef9c1cce697daf8dea27e39d5654b9f437279013ae98339ac1bbb6d1870fe24cc80a30d4df3bd4b682eeb1b559a93e36289c7365a547a028602e9b7f31ca981eaa452d409"}, &(0x7f0000000940)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000980)={0x0, 0x8, 0x1, 0x10}, &(0x7f0000000d80)=ANY=[@ANYBLOB="2001710000007a69dd1df4f89406a13270e52e88cee60aa5738161282b250a4f70efcff21d5a4a7433fe22c551dd4cf2f610ccdd4a8a7f1dd1e54f96e0ac33f3eaf1a7920d747648ace3c546b6be3271a6eadae086b4fc19d7c04e9f9582b8041716cd698e4c09afdd8fd3526b3f02036abdca878cc265a486f0a378d48fa14dea"], &(0x7f0000000a40)={0x20, 0x3, 0x1, 0xb}}) chdir(&(0x7f0000000140)='./bus\x00') syz_open_procfs(0x0, &(0x7f00000003c0)='mountinfo\x00') open(&(0x7f0000000200)='./bus\x00', 0x141a42, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000001b00)={'wg0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r6, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000007fc0)={&(0x7f0000000b80)={0x1f4, r7, 0x1, 0x70bd26, 0x25dfdbff, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}, @HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}, @HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x1f4}, 0x1, 0x0, 0x0, 0x24040050}, 0x8000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$incfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x2010800, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) r10 = openat$incfs(r9, &(0x7f00000001c0)='.pending_reads\x00', 0x0, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r10, 0x80106725, 0x0) 465.059715ms ago: executing program 1 (id=441): socket$inet_tcp(0x2, 0x1, 0x0) (async) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x33, 0x0, &(0x7f0000000080)) prctl$PR_SET_SECUREBITS(0x1c, 0x30) prctl$PR_SET_SECUREBITS(0x8, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder1\x00', 0x800, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x0, 0x0) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x0, 0x0) getpid() (async) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) ioctl$BINDER_GET_FROZEN_INFO(r1, 0xc00c620f, &(0x7f00000000c0)={r2}) 390.942092ms ago: executing program 0 (id=442): prctl$PR_GET_SECUREBITS(0x1b) r0 = signalfd(0xffffffffffffffff, &(0x7f0000000080)={[0xda]}, 0x8) openat$cgroup_freezer_state(r0, &(0x7f0000000100), 0x2, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='msdos\x00', 0x808081, 0x0) 390.635572ms ago: executing program 1 (id=443): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) (async) syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0xd7, 0x56a, 0xc6, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xfb, 0x40, 0x7, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x1, 0x0, 0x6, {0x9, 0x21, 0x9, 0x0, 0x1, {0x22, 0x846}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x3, 0xf5, 0x7b}}}}}]}}]}}, 0x0) (async) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc0004}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1f, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) (async) r1 = gettid() rt_tgsigqueueinfo(r1, r1, 0x14, &(0x7f0000000480)={0x12, 0x0, 0x80000000}) (async) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) (async) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000340)={0x5, 0x0, [{0x40000001, 0x5, 0x2, 0xffff3418, 0x10, 0xc813, 0x3}, {0x40000000, 0x8, 0x1, 0x0, 0x5, 0x2, 0x97c}, {0xb, 0x1, 0x5, 0x0, 0xb71e, 0x8000, 0x5}, {0x40000001, 0xffff8001, 0x1, 0x5, 0xfffffff7, 0x7, 0x4}, {0x80000001, 0x7, 0x7, 0x93e6, 0x6060, 0x3, 0x8}]}) (async) unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00') 389.904272ms ago: executing program 0 (id=444): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x10001) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r1 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) fstat(r1, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r2) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) process_madvise(r4, 0x0, 0x0, 0x14, 0x0) syz_clone(0x80000000, &(0x7f00000000c0)="6b2d2cb3cca423417e9334a3d8219fe34ea05389cdbf328020b0512d99863a3796034cab267c159c05b2c204beacd7dc5f88593dfd7e0f8297d7925cd5d84aa063bd361390bdb4cd2aed2a251856237f94e4bf8d44f1c00b5347342ba77b7e5cd98077f0e1ef61dfbacb8f6ee6e03f6ce6f755f431834e69a90fa7fcb2721a98715837243ab95717984376858933fe27c0305d2526a16daf3b457d26852788b8fab6c101c65328e01179f9c86c8fa907c5d89d", 0xb3, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000180)="e6dad8e9635d33d4f68df4a599ff83b57ab12d77d87c7af2446a0ccfbf0b6ac18244435c4c65000b2454c3c5b02cbcd867f2f24a501efdc570aa890d8f7e29c8589081f0975c9427df4b5e18877f53da4433") mmap(&(0x7f0000018000/0x4000)=nil, 0x4000, 0xa8ca3411d1c26001, 0x13, r0, 0xd3c59000) 387.519642ms ago: executing program 0 (id=445): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000000c0)='/devFtR\xac\x13\x1e\x14e\x81h\xa3K\xd6\xd0^\xed\xd7\xb3\xac\xa0&&\xf8\x0f|\xe8\x15\xf2\x82\xb4\xa0\xc2\x01e\x1e\xf4\x19\x06\x03\xf5+\xc4\r\xa1\xb8DY-\x17\x0f\xf7\x8d\x7f\x9473\x1f\xc5!\xb2\x1bs\xfc\x91~c\xd1*en\xd1\xfc\t\x9c\xda\xfd\xde\xc0\xa2\xf4\x15\xf1\xd9\xe0\xe2\xf3^R\x8d\xae\x8d\x87Fc\a\xe6_\xd0V\'B?\x8b\xa6\x9cIT\x1f\x93\x8b\xfd\x814dX\x93\x89\x1a_45\x94y(\xb9\xaa\x91\xa5\xe8n\xe6\xb58.\xc4\ntJ\x11\f\xb8\x18\xfe\xb2\x93\x93\xe6\x82\\\xe8]fV\xc0#\x1c\xbf\xd1T\x809/\xc3\xa3\x17\xc4\x0e\xdby\xd6\xff\xfb\xbe\x83\xf7$\xf7\xc4\x16\xee\xa0Tn\t\x0f,|\r\xc3\xb39A\xc2wF\xb9l\'_\x89B\xf8z\xe6\xc13\x9d~\xd5\xc6\xae8\a\xa1\x90\f)M4J\xaf\x010;\xc7\xfd\xe7\x95\xfb\x95\xd6N\v\xf9\xe1=3\xe7\x8a\xc8\xca\xf12\x1aJ\xd6Xj4\x1a\x88\x04\xb1DJ\xce\x95\xdb\xd2\xab\xd6\xeb\xc6\xc6v\xd0#x@\x96\xbf\xa4E\x11\x9dH$+\xadS&\xa6\xcd>\xa2<\xe2\xa7\xa3\x99\n7c\xc5\xbb\xc2\xb9\xa3k\xaa\x9e\xe9\xb4\xd4\xbc\xda') r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r2, 0xae03, 0x51) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000280)='/dev/ashmem\x00') 330.176208ms ago: executing program 1 (id=446): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x8a280, 0x0) ioctl$BLKRRPART(r0, 0x125f, 0x0) (async) r1 = syz_open_dev$hiddev(&(0x7f0000000000), 0x9, 0x80) ioctl$HIDIOCGNAME(r1, 0x80404806, &(0x7f0000000040)) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000000c0)={0x3, 0x201, 0xa90, 0x401, 0x8, 0x400}) 314.803829ms ago: executing program 1 (id=447): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) 288.278232ms ago: executing program 1 (id=448): madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r0 = syz_clone(0x1204000, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0xffffc000) r1 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x4) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000000)=r0) 226.907398ms ago: executing program 0 (id=449): mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f00000002c0)=ANY=[@ANYBLOB="73746174733d676c6f62616c2c73746174733d676c6f62616c2c6c617a7974696d652c00e948845b239e6682aaae76fd62d8"]) mount$9p_rdma(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x2, &(0x7f0000000180)={'trans=rdma,', {'port', 0x3d, 0x4e22}, 0x2c, {[{@common=@ignoreqv}, {@timeout={'timeout', 0x3d, 0x8000}}, {@timeout={'timeout', 0x3d, 0x8}}, {@common=@cache_mmap}, {@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_fscache}, {@sq={'sq', 0x3d, 0x6}}, {@rq={'rq', 0x3d, 0x5caf}}, {@common=@noxattr}], [{@appraise}, {@smackfstransmute={'smackfstransmute', 0x3d, './binderfs\x00'}}, {@subj_role={'subj_role', 0x3d, 'binder\x00'}}, {@hash}, {@subj_user={'subj_user', 0x3d, 'binder\x00'}}]}}) (async) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000000180), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) (async) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0xef8c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(r2, 0x1, 0x2b, &(0x7f0000000100), 0x4) 192.290411ms ago: executing program 0 (id=450): futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000)=0x2000000, 0x300) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0xfffffffd, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000000c0)='/devFtR\xac\x13\x1e\x14e\x81h\xa3K\xd6\xd0^\xed\xd7\xb3\xac\xa0&&\xf8\x0f|\xe8\x15\xf2\x82\xb4\xa0\xc2\x01e\x1e\xf4\x19\x06\x03\xf5+\xc4\r\xa1\xb8DY-\x17\x0f\xf7\x8d\x7f\x9473\x1f\xc5!\xb2\x1bs\xfc\x91~c\xd1*en\xd1\xfc\t\x9c\xda\xfd\xde\xc0\xa2\xf4\x15\xf1\xd9\xe0\xe2\xf3^R\x8d\xae\x8d\x87Fc\a\xe6_\xd0V\'B?\x8b\xa6\x9cIT\x1f\x93\x8b\xfd\x814dX\x93\x89\x1a_45\x94y(\xb9\xaa\x91\xa5\xe8n\xe6\xb58.\xc4\ntJ\x11\f\xb8\x18\xfe\xb2\x93\x93\xe6\x82\\\xe8]fV\xc0#\x1c\xbf\xd1T\x809/\xc3\xa3\x17\xc4\x0e\xdby\xd6\xff\xfb\xbe\x83\xf7$\xf7\xc4\x16\xee\xa0Tn\t\x0f,|\r\xc3\xb39A\xc2wF\xb9l\'_\x89B\xf8z\xe6\xc13\x9d~\xd5\xc6\xae8\a\xa1\x90\f)M4J\xaf\x010;\xc7\xfd\xe7\x95\xfb\x95\xd6N\v\xf9\xe1=3\xe7\x8a\xc8\xca\xf12\x1aJ\xd6Xj4\x1a\x88\x04\xb1DJ\xce\x95\xdb\xd2\xab\xd6\xeb\xc6\xc6v\xd0#x@\x96\xbf\xa4E\x11\x9dH$+\xadS&\xa6\xcd>\xa2<\xe2\xa7\xa3\x99\n7c\xc5\xbb\xc2\xb9\xa3k\xaa\x9e\xe9\xb4\xd4\xbc\xda') 191.680921ms ago: executing program 2 (id=451): modify_ldt$read(0x0, &(0x7f0000000080), 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x802, 0x0, 0x0, 0x7}, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0xc0}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$packet(0x11, 0x3, 0x300) prctl$PR_MCE_KILL_GET(0x3d) ioctl$sock_SIOCGIFINDEX(r0, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00'}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0x3, 0x7fff0001}]}) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) r1 = socket$inet6(0xa, 0x5, 0xfffffffb) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x8982, &(0x7f00000001c0)={0x7, 'pimreg0\x00', {0x11ff}, 0x6454}) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x80cd}], 0x1, 0x7) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000040)=ANY=[], 0x118) getsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000080), &(0x7f0000000140)=0x6) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r3, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x34, 0x874fd42a7836ef6b, 0x4}) sendmmsg$inet6(r2, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x2, 0x6}, 0x10) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x89a1, &(0x7f0000000040)={'syzkaller0\x00'}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000940)={0x4c, 0x1d, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) 183.023942ms ago: executing program 2 (id=452): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='binder\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) r1 = open_tree(r0, &(0x7f0000000000)='./file0\x00', 0x9100) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x44, r3, 0xc4fc9e906872338b, 0x24, 0x25dfdbff, {{0x15}, {@void, @val={0xc, 0x99, {0xa, 0x2}}}}, [@NL80211_ATTR_TID_CONFIG={0x24, 0x11d, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x1c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x0, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x25, 0x9, 0x800, 0x2, 0x5, 0x963, 0x6, 0x8]}}]}]}]}]}]}, 0x44}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r1, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, r3, 0x1, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x37}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x5a}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x800) listxattr(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 158.841065ms ago: executing program 2 (id=453): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1006, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) socketpair(0xb, 0x5, 0x6, &(0x7f0000000100)) (async, rerun: 32) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async, rerun: 32) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x68080, 0x0) close(r2) (async, rerun: 32) socket$netlink(0x10, 0x3, 0x0) (rerun: 32) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) close_range(r0, 0xffffffffffffffff, 0x0) (async) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='msdos\x00', 0x808081, 0x0) 78.892453ms ago: executing program 2 (id=454): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000700)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x1100, 0x1}, @ptr={0x70742a85, 0xfffffffc, &(0x7f00000029c0)=""/193, 0xc1, 0x1, 0x14}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x1d}}, &(0x7f0000000180)={0x0, 0x18, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000000700)='./bus\x00', &(0x7f0000004380), 0x1814800, &(0x7f0000000080)=ANY=[@ANYRESHEX]) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000440), 0x1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000003c0)='mountinfo\x00') sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, 0x0, 0x0) write$P9_RVERSION(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff018000000800395032303030"], 0x15) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, &(0x7f00000004c0)) r5 = dup(r4) write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r5, &(0x7f0000000240)=ANY=[@ANYBLOB="38010000fe"], 0x138) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}}) r6 = open(&(0x7f0000000200)='./bus\x00', 0x141a42, 0x0) sendfile(r6, r2, 0x0, 0xffffffff) 67.400804ms ago: executing program 1 (id=455): r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setlease(r0, 0x400, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x599200, 0x0) ioctl$PPPIOCSCOMPRESS(r1, 0x4010744d) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x22842, 0x8d) rename(&(0x7f0000000100)='.\x00', &(0x7f0000000140)='./file0\x00') ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "715237601a8ca5b07dcc141802c4dacf162e43ac61f7ad330000000000a04100", [0xfffffffffffffce8, 0xa]}}) ioctl$LOOP_CLR_FD(r0, 0x4c01) 66.821284ms ago: executing program 2 (id=456): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) 45.429736ms ago: executing program 3 (id=457): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000180)={'ip_vti0\x00', &(0x7f00000000c0)={'gre0\x00', 0x0, 0x7800, 0x7800, 0x4, 0x5, {{0x5, 0x4, 0x1, 0x8, 0x14, 0x67, 0x0, 0x4, 0x2f, 0x0, @private=0xa010100, @rand_addr=0x64010100}}}}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r5, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r6 = dup(r5) write$FUSE_BMAP(r6, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r6, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}, 0x2c, {[{@cache_readahead}], [], 0x6b}}) truncate(&(0x7f0000000240)='./file0\x00', 0xffff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x143042, 0x80) sendfile(r7, r7, 0x0, 0x7a680000) read$FUSE(r7, 0x0, 0xeffd) sendmsg$NL80211_CMD_AUTHENTICATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x44, r2, 0x8007023327f40d31, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_MAC={0xa}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000005}, 0x20000010) sendmsg$NL80211_CMD_SET_MPATH(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r1, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x34}, 0x1, 0x0, 0x0, 0x884}, 0x44800) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) r9 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r10 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x1000000, &(0x7f0000000240)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r10, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_DIRENTPLUS(r10, &(0x7f00000001c0)=ANY=[@ANYBLOB="10000000", @ANYRES64=r10], 0x10) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r8, 0x40182103, &(0x7f0000000080)={0x0, 0x3, r9, 0x2}) fsetxattr$trusted_overlay_upper(r9, &(0x7f0000000340), &(0x7f00000005c0)=ANY=[@ANYBLOB="00fb8100ea9db374af24d6d5b0bad4a80090170f0917f3d0e26d2ba84a5175161072770acd64a21f3a0aad5ef55e81887c34d27414c0021599b50853f489195a3a1bc9c192a4c715ec815d9a8924f7ae87eab2424a76a6c95debbd3e9b2b465719e53e316796292a441696a30dd259b977fe4a18632905c1d1e99632480734c0b0091fa30d09adc1b679d197c5687a7ff724eb0be9b8989f3b39df8813bf19959a26dd18c247b68a4a0b51d5ad5047153f07992e211635288bc2f80e9b042c1875084f1b83e620ff1e2c44be664e6df91875999e37953898fa4601e860"], 0x81, 0x6) 0s ago: executing program 2 (id=458): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x2, 0x3}]}]}, 0xfc}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=@migrate={0xa0, 0x21, 0x1, 0x0, 0x0, {{@in=@remote, @in6=@private2, 0xfffc, 0x0, 0x4e21, 0xffff, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x50, 0x11, [{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in=@multicast1, @in=@rand_addr=0x64010102, @in6=@private2, 0x3c, 0x2, 0x0, 0x0, 0x8, 0x8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x800}, 0x4a050) (async) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=@migrate={0xa0, 0x21, 0x1, 0x0, 0x0, {{@in=@remote, @in6=@private2, 0xfffc, 0x0, 0x4e21, 0xffff, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x50, 0x11, [{@in6=@ipv4={'\x00', '\xff\xff', @loopback}, @in=@multicast1, @in=@rand_addr=0x64010102, @in6=@private2, 0x3c, 0x2, 0x0, 0x0, 0x8, 0x8}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x800}, 0x4a050) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0x0) (async) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.132' (ED25519) to the list of known hosts. [ 20.101674][ T36] audit: type=1400 audit(1761452156.090:64): avc: denied { mounton } for pid=282 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 20.102927][ T282] cgroup: Unknown subsys name 'net' [ 20.105053][ T36] audit: type=1400 audit(1761452156.090:65): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.108895][ T36] audit: type=1400 audit(1761452156.100:66): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 20.109015][ T282] cgroup: Unknown subsys name 'devices' [ 20.254403][ T282] cgroup: Unknown subsys name 'hugetlb' [ 20.259999][ T282] cgroup: Unknown subsys name 'rlimit' [ 20.354299][ T36] audit: type=1400 audit(1761452156.350:67): avc: denied { setattr } for pid=282 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 20.377476][ T36] audit: type=1400 audit(1761452156.350:68): avc: denied { mounton } for pid=282 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 20.402261][ T36] audit: type=1400 audit(1761452156.350:69): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 20.411441][ T284] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 20.434156][ T36] audit: type=1400 audit(1761452156.440:70): avc: denied { relabelto } for pid=284 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.459995][ T36] audit: type=1400 audit(1761452156.440:71): avc: denied { write } for pid=284 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.489154][ T36] audit: type=1400 audit(1761452156.490:72): avc: denied { read } for pid=282 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.489651][ T282] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 20.514688][ T36] audit: type=1400 audit(1761452156.490:73): avc: denied { open } for pid=282 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.823492][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.830550][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.837661][ T290] bridge_slave_0: entered allmulticast mode [ 21.843903][ T290] bridge_slave_0: entered promiscuous mode [ 21.855390][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.862526][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.869568][ T290] bridge_slave_1: entered allmulticast mode [ 21.875875][ T290] bridge_slave_1: entered promiscuous mode [ 21.904081][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.911114][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.918188][ T292] bridge_slave_0: entered allmulticast mode [ 21.924372][ T292] bridge_slave_0: entered promiscuous mode [ 21.941865][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.948924][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.955986][ T292] bridge_slave_1: entered allmulticast mode [ 21.962131][ T292] bridge_slave_1: entered promiscuous mode [ 21.968147][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.975230][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.982271][ T289] bridge_slave_0: entered allmulticast mode [ 21.988534][ T289] bridge_slave_0: entered promiscuous mode [ 21.997556][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.004748][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.011787][ T291] bridge_slave_0: entered allmulticast mode [ 22.018031][ T291] bridge_slave_0: entered promiscuous mode [ 22.026977][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.034039][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.041112][ T289] bridge_slave_1: entered allmulticast mode [ 22.047338][ T289] bridge_slave_1: entered promiscuous mode [ 22.056247][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.063330][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.070370][ T291] bridge_slave_1: entered allmulticast mode [ 22.076661][ T291] bridge_slave_1: entered promiscuous mode [ 22.228588][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.235661][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.242971][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.249993][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.260621][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.267670][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.274936][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.281959][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.294779][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.301800][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.309067][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.316107][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.341384][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.348485][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.355779][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.362810][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.391310][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.398665][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.406778][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.414264][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.421439][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.428730][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.436044][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.453346][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.460368][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.473244][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.480273][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.487930][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.494983][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.526591][ T289] veth0_vlan: entered promiscuous mode [ 22.537996][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.545040][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.553009][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.560033][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.582088][ T291] veth0_vlan: entered promiscuous mode [ 22.591207][ T289] veth1_macvtap: entered promiscuous mode [ 22.597886][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.604927][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.621283][ T291] veth1_macvtap: entered promiscuous mode [ 22.635632][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.642669][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.658001][ T292] veth0_vlan: entered promiscuous mode [ 22.685855][ T292] veth1_macvtap: entered promiscuous mode [ 22.697293][ T291] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 22.701993][ T290] veth0_vlan: entered promiscuous mode [ 22.725995][ T290] veth1_macvtap: entered promiscuous mode [ 22.747098][ T334] SELinux: policydb version -1443296006 does not match my version range 15-33 [ 22.758398][ T334] SELinux: failed to load policy [ 22.771133][ T334] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 22.844444][ T348] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 22.851681][ T348] rust_binder: Write failure EINVAL in pid:9 [ 22.853039][ T348] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 22.859142][ T348] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:9 [ 22.866706][ T350] Bluetooth: hci0: sending frame failed (-49) [ 22.882061][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -49 [ 22.962356][ T361] rust_binder: Failed to allocate buffer. len:8, is_oneway:true [ 22.962845][ T361] rust_binder: Write failure EINVAL in pid:13 [ 23.051324][ T367] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 23.058124][ T367] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 23.067566][ T367] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:7 [ 23.117496][ T369] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 23.127549][ T369] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:9 [ 23.242572][ T10] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 23.330967][ T381] rust_binder: 17: no such ref 0 [ 23.336058][ T381] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 23.343603][ T381] rust_binder: 17: no such ref 2 [ 23.348751][ T381] rust_binder: Failed to allocate buffer. len:1128, is_oneway:false [ 23.432477][ T10] usb 4-1: device descriptor read/64, error -71 [ 23.583906][ T394] input: syz1 as /devices/virtual/input/input4 [ 23.682460][ T10] usb 4-1: device descriptor read/64, error -71 [ 23.683494][ T401] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:14 [ 23.922458][ T10] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 24.064365][ T10] usb 4-1: device descriptor read/64, error -71 [ 24.304173][ T10] usb 4-1: device descriptor read/64, error -71 [ 24.319772][ T406] tipc: Started in network mode [ 24.324707][ T406] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 24.333690][ T406] tipc: New replicast peer: fc01:0000:0000:0000:0000:0000:0000:0001 [ 24.341812][ T406] tipc: Enabled bearer , priority 10 [ 24.373927][ T412] incfs: Error accessing: ./file0. [ 24.379125][ T412] incfs: mount failed -20 [ 24.386688][ T412] overlay: ./file0 is not a directory [ 24.401816][ T414] rust_binder: Write failure EFAULT in pid:27 [ 24.412628][ T10] usb usb4-port1: attempt power cycle [ 24.487113][ T421] rust_binder: Error while translating object. [ 24.487199][ T421] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 24.493567][ T421] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:18 [ 24.513018][ T423] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 24.539075][ T425] rust_binder: Failed to allocate buffer. len:4096, is_oneway:true [ 24.547301][ T425] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 24.555324][ T425] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:22 [ 24.590886][ T427] /dev/rnullb0: Can't open blockdev [ 24.649998][ T429] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 24.658545][ T429] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 24.665940][ T429] rust_binder: Read failure Err(EAGAIN) in pid:26 [ 24.762473][ T10] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 24.793464][ T10] usb 4-1: device descriptor read/8, error -71 [ 24.923455][ T10] usb 4-1: device descriptor read/8, error -71 [ 25.172519][ T10] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 25.193447][ T10] usb 4-1: device descriptor read/8, error -71 [ 25.232040][ T36] kauditd_printk_skb: 92 callbacks suppressed [ 25.232055][ T36] audit: type=1400 audit(1761452161.220:166): avc: denied { transfer } for pid=433 comm="syz.1.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 25.296109][ T36] audit: type=1400 audit(1761452161.290:167): avc: denied { read write } for pid=435 comm="syz.1.34" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 25.321398][ T436] 9pnet_fd: Insufficient options for proto=fd [ 25.328708][ T36] audit: type=1400 audit(1761452161.320:168): avc: denied { open } for pid=435 comm="syz.1.34" path="/dev/vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 25.333507][ T10] usb 4-1: device descriptor read/8, error -71 [ 25.371847][ T36] audit: type=1400 audit(1761452161.320:169): avc: denied { map } for pid=435 comm="syz.1.34" path="pipe:[3668]" dev="pipefs" ino=3668 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 25.394388][ T36] audit: type=1400 audit(1761452161.320:170): avc: denied { execute } for pid=435 comm="syz.1.34" path="pipe:[3668]" dev="pipefs" ino=3668 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 25.452474][ T332] tipc: Node number set to 1 [ 25.472532][ T10] usb usb4-port1: unable to enumerate USB device [ 25.528253][ T36] audit: type=1400 audit(1761452161.520:171): avc: denied { ioctl } for pid=445 comm="syz.2.36" path="socket:[4517]" dev="sockfs" ino=4517 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 25.532916][ T446] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 25.552951][ T36] audit: type=1400 audit(1761452161.520:172): avc: denied { write } for pid=445 comm="syz.2.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 25.553865][ T446] rust_binder: Read failure Err(EFAULT) in pid:33 [ 25.561426][ T36] audit: type=1400 audit(1761452161.520:173): avc: denied { ioctl } for pid=445 comm="syz.2.36" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0x940f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 25.611517][ T36] audit: type=1400 audit(1761452161.580:174): avc: denied { ioctl } for pid=447 comm="syz.0.38" path="socket:[3692]" dev="sockfs" ino=3692 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.646826][ T451] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 25.655719][ T36] audit: type=1400 audit(1761452161.650:175): avc: denied { read } for pid=452 comm="syz.0.40" name="ppp" dev="devtmpfs" ino=86 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 25.714022][ T329] Bluetooth: hci0: Frame reassembly failed (-84) [ 25.720461][ T329] Bluetooth: hci0: Frame reassembly failed (-84) [ 25.762486][ T432] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 25.913481][ T432] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 25.921671][ T432] usb 2-1: config 0 has no interface number 0 [ 25.927934][ T432] usb 2-1: config 0 interface 41 has no altsetting 0 [ 25.936352][ T432] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 25.945444][ T432] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.953455][ T432] usb 2-1: Product: syz [ 25.957651][ T432] usb 2-1: Manufacturer: syz [ 25.962240][ T432] usb 2-1: SerialNumber: syz [ 25.967398][ T432] usb 2-1: config 0 descriptor?? [ 26.042431][ T45] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.172426][ T45] usb 3-1: device descriptor read/64, error -71 [ 26.379734][ T432] CoreChips 2-1:0.41: probe with driver CoreChips failed with error -32 [ 26.422439][ T45] usb 3-1: device descriptor read/64, error -71 [ 26.544886][ T478] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:17 [ 26.564378][ T481] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.584526][ T481] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.592529][ T481] __vm_enough_memory: pid: 481, comm: syz.3.49, bytes: 18014402804453376 not enough memory for the allocation [ 26.662669][ T45] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 26.737808][ T31] usb 2-1: USB disconnect, device number 2 [ 26.775436][ T485] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 26.775466][ T485] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:47 [ 26.792581][ T432] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 26.809188][ T45] usb 3-1: device descriptor read/64, error -71 [ 26.836170][ T487] netlink: 'syz.1.51': attribute type 58 has an invalid length. [ 26.972949][ T432] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 26.992429][ T432] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 27.001458][ T432] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.023807][ T432] usb 4-1: config 0 descriptor?? [ 27.062433][ T45] usb 3-1: device descriptor read/64, error -71 [ 27.172739][ T45] usb usb3-port1: attempt power cycle [ 27.231420][ T432] usbhid 4-1:0.0: can't add hid device: -71 [ 27.237524][ T432] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 27.246503][ T432] usb 4-1: USB disconnect, device number 6 [ 27.512662][ T45] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 27.533474][ T45] usb 3-1: device descriptor read/8, error -71 [ 27.663743][ T45] usb 3-1: device descriptor read/8, error -71 [ 27.700522][ T494] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:55 [ 27.700665][ T494] rust_binder: Read failure Err(EFAULT) in pid:55 [ 27.742639][ T350] Bluetooth: hci0: command 0x1003 tx timeout [ 27.744359][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 27.750687][ T498] 9pnet_fd: Insufficient options for proto=fd [ 27.912458][ T45] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 27.933416][ T45] usb 3-1: device descriptor read/8, error -71 [ 27.952452][ T332] usb 2-1: new low-speed USB device number 3 using dummy_hcd [ 28.022480][ T432] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 28.064072][ T45] usb 3-1: device descriptor read/8, error -71 [ 28.103578][ T332] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 28.112759][ T332] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.121579][ T332] usb 2-1: config 0 descriptor?? [ 28.172434][ T432] usb 4-1: Using ep0 maxpacket: 32 [ 28.177772][ T45] usb usb3-port1: unable to enumerate USB device [ 28.185349][ T432] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 28.196858][ T432] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 28.205930][ T432] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.213936][ T432] usb 4-1: Product: syz [ 28.218106][ T432] usb 4-1: Manufacturer: syz [ 28.222972][ T432] usb 4-1: SerialNumber: syz [ 28.228484][ T432] usb 4-1: config 0 descriptor?? [ 28.234252][ T432] smsc75xx v1.0.0 [ 28.237911][ T432] smsc75xx 4-1:0.0 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 28.247903][ T432] smsc75xx 4-1:0.0: probe with driver smsc75xx failed with error -22 [ 28.437918][ T432] usb 4-1: USB disconnect, device number 7 [ 28.877740][ T509] ======================================================= [ 28.877740][ T509] WARNING: The mand mount option has been deprecated and [ 28.877740][ T509] and is ignored by this kernel. Remove the mand [ 28.877740][ T509] option from the mount to silence this warning. [ 28.877740][ T509] ======================================================= [ 28.927790][ T516] rust_binder: Write failure EFAULT in pid:45 [ 28.952821][ T520] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 29.123376][ T544] raw_sendmsg: syz.3.69 forgot to set AF_INET. Fix it! [ 29.123405][ T548] binder: Unknown parameter 'defcontext01777777777777777777777' [ 29.184342][ T556] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:56 [ 29.195436][ T332] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 29.212442][ T432] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 29.215309][ T332] asix 2-1:0.0: probe with driver asix failed with error -71 [ 29.231406][ T332] usb 2-1: USB disconnect, device number 3 [ 29.362464][ T432] usb 3-1: Using ep0 maxpacket: 8 [ 29.368712][ T432] usb 3-1: too many endpoints for config 1 interface 0 altsetting 1: 255, using maximum allowed: 30 [ 29.379542][ T432] usb 3-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 139, changing to 11 [ 29.390714][ T432] usb 3-1: config 1 interface 0 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 29.401623][ T432] usb 3-1: config 1 interface 0 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 8 [ 29.411285][ T432] usb 3-1: config 1 interface 0 altsetting 1 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 29.424365][ T432] usb 3-1: config 1 interface 0 has no altsetting 0 [ 29.431660][ T432] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 29.440727][ T432] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 29.448734][ T432] usb 3-1: SerialNumber: syz [ 29.454949][ T511] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 29.671891][ T432] cdc_acm 3-1:1.0: Control and data interfaces are not separated! [ 29.676543][ T567] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 29.685805][ T432] usb 3-1: USB disconnect, device number 6 [ 29.720020][ T572] netlink: 'syz.3.76': attribute type 4 has an invalid length. [ 29.726934][ T575] SELinux: security_context_str_to_sid () failed with errno=-22 [ 29.739479][ T578] rust_binder: 53: no such ref 3 [ 29.746118][ T579] netlink: 'syz.3.76': attribute type 17 has an invalid length. [ 29.746495][ T578] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 29.755473][ T572] netlink: 'syz.3.76': attribute type 4 has an invalid length. [ 29.774936][ T578] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 29.782065][ T578] rust_binder: Write failure EFAULT in pid:53 [ 29.785966][ T581] rust_binder: Write failure EINVAL in pid:61 [ 29.812739][ T584] netlink: 76 bytes leftover after parsing attributes in process `syz.2.80'. [ 29.827990][ T584] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 29.842685][ T588] SELinux: security_context_str_to_sid (sytem_uGй) failed with errno=-22 [ 29.865275][ T586] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 29.865374][ T586] rust_binder: Failed to allocate buffer. len:1160, is_oneway:false [ 29.941535][ T610] rust_binder: Error while translating object. [ 29.949727][ T610] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 29.955959][ T610] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:63 [ 29.967177][ T612] rust_binder: validate_parent_fixup: new_min_offset=37, sg_entry.length=0 [ 29.981021][ T612] rust_binder: Error while translating object. [ 29.994080][ T612] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 30.000351][ T612] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:89 [ 30.030450][ T617] loop2: detected capacity change from 0 to 7 [ 30.047124][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 30.056279][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 30.064486][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 30.073627][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 30.081469][ T617] loop2: unable to read partition table [ 30.088034][ T617] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 30.088709][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 30.110653][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 30.119111][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 30.128256][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 30.136545][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 30.145701][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 30.154510][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 30.163656][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 30.171656][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 30.180817][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 30.182009][ T623] binder: Bad value for 'max' [ 30.193474][ T623] binder: Bad value for 'max' [ 30.198208][ T623] binder: Bad value for 'max' [ 30.203048][ T623] binder: Bad value for 'max' [ 30.206613][ T625] Zero length message leads to an empty skb [ 30.207845][ T623] binder: Bad value for 'max' [ 30.218687][ T623] binder: Bad value for 'max' [ 30.223585][ T623] binder: Bad value for 'max' [ 30.228377][ T623] binder: Bad value for 'max' [ 30.233218][ T623] binder: Bad value for 'max' [ 30.243138][ T623] binder: Bad value for 'max' [ 30.247974][ T623] binder: Bad value for 'max' [ 30.252862][ T623] binder: Bad value for 'max' [ 30.257645][ T623] binder: Bad value for 'max' [ 30.262428][ T623] binder: Bad value for 'max' [ 30.267212][ T623] binder: Bad value for 'max' [ 30.271970][ T623] binder: Bad value for 'max' [ 30.276764][ T623] binder: Bad value for 'max' [ 30.281534][ T623] binder: Bad value for 'max' [ 30.286310][ T623] binder: Bad value for 'max' [ 30.291101][ T623] binder: Bad value for 'max' [ 30.294009][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 30.295987][ T623] binder: Bad value for 'max' [ 30.308753][ T623] binder: Bad value for 'max' [ 30.313536][ T623] binder: Bad value for 'max' [ 30.318279][ T623] binder: Bad value for 'max' [ 30.323184][ T623] binder: Bad value for 'max' [ 30.327970][ T623] binder: Bad value for 'max' [ 30.332769][ T623] binder: Bad value for 'max' [ 30.337557][ T623] binder: Bad value for 'max' [ 30.342283][ T623] binder: Bad value for 'max' [ 30.347358][ T623] binder: Bad value for 'max' [ 30.352114][ T623] binder: Bad value for 'max' [ 30.356972][ T623] binder: Bad value for 'max' [ 30.361809][ T623] binder: Bad value for 'max' [ 30.366643][ T623] binder: Bad value for 'max' [ 30.371392][ T623] binder: Bad value for 'max' [ 30.376175][ T623] binder: Bad value for 'max' [ 30.380923][ T623] binder: Bad value for 'max' [ 30.385683][ T623] binder: Bad value for 'max' [ 30.390432][ T623] binder: Bad value for 'max' [ 30.395174][ T623] binder: Bad value for 'max' [ 30.399947][ T623] binder: Bad value for 'max' [ 30.404816][ T623] binder: Bad value for 'max' [ 30.409633][ T623] binder: Bad value for 'max' [ 30.414434][ T623] binder: Bad value for 'max' [ 30.419241][ T623] binder: Bad value for 'max' [ 30.424011][ T623] binder: Bad value for 'max' [ 30.428792][ T623] binder: Bad value for 'max' [ 30.433583][ T623] binder: Bad value for 'max' [ 30.438326][ T623] binder: Bad value for 'max' [ 30.443220][ T623] binder: Bad value for 'max' [ 30.448015][ T623] binder: Bad value for 'max' [ 30.452772][ T623] binder: Bad value for 'max' [ 30.457515][ T623] binder: Bad value for 'max' [ 30.462256][ T623] binder: Bad value for 'max' [ 30.467018][ T623] binder: Bad value for 'max' [ 30.471736][ T623] binder: Bad value for 'max' [ 30.476479][ T623] binder: Bad value for 'max' [ 30.481197][ T623] binder: Bad value for 'max' [ 30.485935][ T623] binder: Bad value for 'max' [ 30.490682][ T623] binder: Bad value for 'max' [ 30.495452][ T623] binder: Bad value for 'max' [ 30.500174][ T623] binder: Bad value for 'max' [ 30.504945][ T623] binder: Bad value for 'max' [ 30.509689][ T623] binder: Bad value for 'max' [ 30.514455][ T623] binder: Bad value for 'max' [ 30.739016][ T36] kauditd_printk_skb: 59 callbacks suppressed [ 30.739031][ T36] audit: type=1400 audit(1761452166.730:235): avc: denied { write } for pid=645 comm="syz.2.99" name="001" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 30.789022][ T36] audit: type=1400 audit(1761452166.780:236): avc: denied { execute } for pid=652 comm="syz.3.102" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 30.812947][ T653] netlink: 24 bytes leftover after parsing attributes in process `syz.2.103'. [ 30.822486][ T36] audit: type=1400 audit(1761452166.820:237): avc: denied { create } for pid=651 comm="syz.2.103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 30.841861][ T36] audit: type=1400 audit(1761452166.820:238): avc: denied { ioctl } for pid=651 comm="syz.2.103" path="socket:[6214]" dev="sockfs" ino=6214 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 31.064238][ T663] rust_binder: Error while translating object. [ 31.064276][ T663] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 31.070500][ T663] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:85 [ 31.101437][ T36] audit: type=1400 audit(1761452167.090:239): avc: denied { write } for pid=667 comm="syz.2.107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 31.101497][ T668] netlink: 68 bytes leftover after parsing attributes in process `syz.2.107'. [ 31.110648][ T36] audit: type=1400 audit(1761452167.090:240): avc: denied { nlmsg_write } for pid=667 comm="syz.2.107" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 31.159780][ T31] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 31.312437][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 31.318624][ T31] usb 4-1: config 0 interface 0 has no altsetting 0 [ 31.325268][ T31] usb 4-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 31.334332][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.343112][ T31] usb 4-1: config 0 descriptor?? [ 31.848722][ T36] audit: type=1400 audit(1761452167.840:241): avc: denied { append } for pid=683 comm="syz.2.113" name="binder1" dev="binder" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 31.860083][ T684] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 31.871440][ T684] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:106 [ 31.895283][ T686] rust_binder: Error while translating object. [ 31.904473][ T686] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 31.910648][ T686] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:108 [ 32.027807][ T693] rust_binder: Error while translating object. [ 32.036909][ T693] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 32.043102][ T693] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:115 [ 32.104995][ T695] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 32.114214][ T695] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 32.122239][ T695] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:117 [ 32.142990][ T698] rust_binder: Write failure EINVAL in pid:120 [ 32.228068][ T712] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 32.247706][ T36] audit: type=1400 audit(1761452168.250:242): avc: denied { read } for pid=711 comm="syz.2.123" path="socket:[6417]" dev="sockfs" ino=6417 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 32.300809][ T36] audit: type=1400 audit(1761452168.290:243): avc: denied { setopt } for pid=711 comm="syz.2.123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 32.302468][ T350] Bluetooth: hci0: command 0x1003 tx timeout [ 32.326010][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 32.336916][ T36] audit: type=1400 audit(1761452168.330:244): avc: denied { bind } for pid=711 comm="syz.2.123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 32.580058][ T729] rust_binder: 78: no such ref 3 [ 32.585077][ T729] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 32.592138][ T729] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 32.599198][ T729] rust_binder: Write failure EFAULT in pid:78 [ 32.622503][ T331] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 32.658714][ T744] __vm_enough_memory: pid: 744, comm: syz.1.132, bytes: 18014402804453376 not enough memory for the allocation [ 32.713262][ T748] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4274882444 (136796238208 ns) > initial count (11109752672 ns). Using initial count to start timer. [ 32.753222][ T748] kvm: vcpu 1: requested lapic timer restore with starting count register 0x390=4274882444 (136796238208 ns) > initial count (11109752672 ns). Using initial count to start timer. [ 32.782643][ T331] usb 1-1: Using ep0 maxpacket: 32 [ 32.788833][ T331] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 32.800168][ T331] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 32.809969][ T331] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0003, bcdDevice= 0.00 [ 32.819029][ T331] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.827643][ T331] usb 1-1: config 0 descriptor?? [ 33.050498][ T756] SELinux: failed to load policy [ 33.094019][ T764] overlay: Unknown parameter './file0' [ 33.243508][ T331] pantherlord 0003:0E8F:0003.0001: item fetching failed at offset 0/2 [ 33.251831][ T331] pantherlord 0003:0E8F:0003.0001: parse failed [ 33.258171][ T331] pantherlord 0003:0E8F:0003.0001: probe with driver pantherlord failed with error -22 [ 33.438462][ T45] usb 1-1: USB disconnect, device number 2 [ 33.797316][ T31] usbhid 4-1:0.0: can't add hid device: -71 [ 33.803676][ T31] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 33.814432][ T31] usb 4-1: USB disconnect, device number 8 [ 33.967817][ T786] netlink: 4 bytes leftover after parsing attributes in process `syz.0.144'. [ 34.039466][ T790] rust_binder: Failed to allocate buffer. len:4096, is_oneway:false [ 34.058753][ T792] binder: Unknown parameter '' [ 34.059125][ T794] /dev/rnullb0: Can't open blockdev [ 34.092443][ T331] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 34.105098][ T800] binder: Binderfs stats mode cannot be changed during a remount [ 34.146146][ T802] capability: warning: `syz.3.151' uses deprecated v2 capabilities in a way that may be insecure [ 34.159344][ T802] binder: Unknown parameter 'maxile0' [ 34.228834][ T812] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:130 [ 34.240848][ T814] binder: Bad value for 'max' [ 34.390520][ T821] rust_binder: Error while translating object. [ 34.390568][ T821] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 34.396885][ T821] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:136 [ 34.507619][ T826] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=826 comm=syz.0.161 [ 34.576538][ T835] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 34.576601][ T835] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:91 [ 34.689543][ T849] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 34.767773][ T853] capability: warning: `syz.0.170' uses 32-bit capabilities (legacy support in use) [ 35.025056][ T860] rust_binder: Error while translating object. [ 35.025088][ T860] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 35.049397][ T860] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:98 [ 35.059935][ T858] exFAT-fs (rnullb0): invalid boot record signature [ 35.082434][ T858] exFAT-fs (rnullb0): failed to read boot sector [ 35.092320][ T858] exFAT-fs (rnullb0): failed to recognize exfat type [ 35.252523][ T868] netlink: 12 bytes leftover after parsing attributes in process `syz.3.174'. [ 35.340684][ T873] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 35.787882][ T36] kauditd_printk_skb: 21 callbacks suppressed [ 35.787900][ T36] audit: type=1400 audit(1761452171.780:266): avc: denied { map } for pid=876 comm="syz.2.178" path="/proc/166/net/tcp6" dev="proc" ino=4026532512 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 35.828176][ T36] audit: type=1400 audit(1761452171.780:267): avc: denied { execute } for pid=876 comm="syz.2.178" path="/proc/166/net/tcp6" dev="proc" ino=4026532512 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 36.146645][ T900] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 36.146671][ T900] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 36.176815][ T905] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 224, size: 226) [ 36.183321][ T45] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 36.201393][ T905] rust_binder: Error while translating object. [ 36.201417][ T905] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 36.207882][ T905] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:163 [ 36.362435][ T45] usb 1-1: Using ep0 maxpacket: 16 [ 36.377815][ T45] usb 1-1: config 0 has an invalid interface number: 126 but max is 0 [ 36.386684][ T45] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 36.396900][ T45] usb 1-1: config 0 has no interface number 0 [ 36.403086][ T45] usb 1-1: config 0 interface 126 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 36.415125][ T45] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0x87 has invalid maxpacket 34328, setting to 1024 [ 36.426578][ T45] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 36.438671][ T924] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 36.447442][ T36] audit: type=1400 audit(1761452172.450:268): avc: denied { create } for pid=911 comm="syz.1.186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 36.468627][ T45] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 36.504253][ T45] usb 1-1: config 0 interface 126 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 36.538638][ T45] usb 1-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=56.88 [ 36.547902][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.556553][ T45] usb 1-1: config 0 descriptor?? [ 36.561750][ T887] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 36.568969][ T65] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 36.576608][ T31] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 36.733625][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 36.744569][ T65] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 36.754328][ T31] usb 4-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 36.763410][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 36.772152][ T31] usb 4-1: config 0 descriptor?? [ 36.777246][ T65] usb 3-1: New USB device found, idVendor=df5e, idProduct=ecf1, bcdDevice=f6.27 [ 36.782313][ T9] usb 1-1: USB disconnect, device number 3 [ 36.786392][ T65] usb 3-1: New USB device strings: Mfr=121, Product=98, SerialNumber=0 [ 36.801460][ T65] usb 3-1: Product: syz [ 36.805668][ T65] usb 3-1: Manufacturer: syz [ 36.810843][ T65] usb 3-1: config 0 descriptor?? [ 36.817083][ T65] usbhid 3-1:0.0: can't add hid device: -22 [ 36.823062][ T65] usbhid 3-1:0.0: probe with driver usbhid failed with error -22 [ 37.082336][ T930] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:134 [ 37.082843][ T36] audit: type=1400 audit(1761452173.080:269): avc: denied { setopt } for pid=929 comm="syz.1.194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 37.132192][ T933] rust_binder: Failed to allocate buffer. len:8, is_oneway:true [ 37.132335][ T933] rust_binder: Write failure EINVAL in pid:137 [ 37.202081][ T31] kye 0003:0458:5011.0002: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 37.218952][ T31] kye 0003:0458:5011.0002: unknown main item tag 0x0 [ 37.225671][ T31] kye 0003:0458:5011.0002: unknown main item tag 0x1 [ 37.232359][ T31] kye 0003:0458:5011.0002: item fetching failed at offset 5/7 [ 37.239990][ T31] kye 0003:0458:5011.0002: parse failed [ 37.245563][ T31] kye 0003:0458:5011.0002: probe with driver kye failed with error -22 [ 37.403339][ T65] usb 4-1: USB disconnect, device number 9 [ 37.431072][ T36] audit: type=1400 audit(1761452173.420:270): avc: denied { getopt } for pid=944 comm="syz.0.199" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 37.721202][ T953] rust_binder: Error while translating object. [ 37.721247][ T953] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 37.732507][ T953] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:175 [ 37.863811][ T36] audit: type=1400 audit(1761452173.860:271): avc: denied { setopt } for pid=962 comm="syz.1.203" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 38.172441][ T65] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 38.322456][ T65] usb 4-1: Using ep0 maxpacket: 32 [ 38.328625][ T65] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 38.336982][ T65] usb 4-1: config 0 has no interface number 0 [ 38.343220][ T65] usb 4-1: config 0 interface 184 has no altsetting 0 [ 38.351443][ T65] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 38.360627][ T65] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.368654][ T65] usb 4-1: Product: syz [ 38.372918][ T65] usb 4-1: Manufacturer: syz [ 38.377524][ T65] usb 4-1: SerialNumber: syz [ 38.382981][ T65] usb 4-1: config 0 descriptor?? [ 38.389006][ T65] smsc75xx v1.0.0 [ 38.754417][ T983] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:167 [ 38.754736][ T983] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 38.764375][ T983] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 128, size: 18446744073709551507) [ 38.770822][ T983] rust_binder: Error while translating object. [ 38.783069][ T983] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 38.789288][ T983] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:167 [ 38.790093][ T965] rust_binder: Error while translating object. [ 38.807978][ T965] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 38.814434][ T965] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:176 [ 38.825811][ T65] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 38.855272][ T65] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 38.865024][ T65] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 38.878425][ T65] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 38.892494][ T65] usb 4-1: USB disconnect, device number 10 [ 38.906867][ T36] audit: type=1400 audit(1761452174.900:272): avc: denied { checkpoint_restore } for pid=984 comm="syz.1.210" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 38.929625][ T36] audit: type=1400 audit(1761452174.930:273): avc: denied { create } for pid=984 comm="syz.1.210" name="file2" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 38.950429][ T36] audit: type=1400 audit(1761452174.930:274): avc: denied { write } for pid=984 comm="syz.1.210" name="file2" dev="tmpfs" ino=313 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 38.973054][ T36] audit: type=1400 audit(1761452174.930:275): avc: denied { open } for pid=984 comm="syz.1.210" path="/55/file2" dev="tmpfs" ino=313 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 38.995482][ T987] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 38.995500][ T987] rust_binder: Read failure Err(EFAULT) in pid:171 [ 39.021429][ T989] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 39.036900][ T989] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 39.306451][ T65] usb 3-1: USB disconnect, device number 7 [ 39.772439][ T65] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 39.902445][ T65] usb 3-1: device descriptor read/64, error -71 [ 40.113990][ T45] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 40.128803][ T1029] rust_binder: Write failure EFAULT in pid:191 [ 40.141352][ T1032] rust_binder: 193: no such ref 2 [ 40.142451][ T65] usb 3-1: device descriptor read/64, error -71 [ 40.147563][ T1032] rust_binder: 193: no such ref 0 [ 40.163860][ T1032] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:193 [ 40.263503][ T1052] rust_binder: validate_parent_fixup: fixup_min_offset=46, parent_offset=35 [ 40.272445][ T45] usb 4-1: Using ep0 maxpacket: 16 [ 40.272718][ T1052] rust_binder: Error while translating object. [ 40.282612][ T45] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 40.286506][ T1052] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 40.292836][ T45] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 40.304810][ T1053] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 40.313641][ T45] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid wMaxPacketSize 0 [ 40.324594][ T1052] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:145 [ 40.334197][ T1053] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:197 [ 40.353703][ T45] usb 4-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 40.368395][ T1055] netlink: 'syz.0.236': attribute type 28 has an invalid length. [ 40.374307][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.387877][ T45] usb 4-1: Product: syz [ 40.392083][ T45] usb 4-1: Manufacturer: syz [ 40.396754][ T65] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 40.398651][ T1056] netlink: 'syz.0.236': attribute type 27 has an invalid length. [ 40.404382][ T45] usb 4-1: SerialNumber: syz [ 40.421999][ T45] usb 4-1: config 0 descriptor?? [ 40.429119][ T1055] rust_binder: 147: no such ref 0 [ 40.434454][ T1056] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 40.441728][ T1056] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 40.448866][ T1055] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 40.457666][ T1055] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 40.542744][ T65] usb 3-1: device descriptor read/64, error -71 [ 40.782455][ T65] usb 3-1: device descriptor read/64, error -71 [ 40.812431][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 40.883573][ T491] usb 4-1: USB disconnect, device number 11 [ 40.892558][ T65] usb usb3-port1: attempt power cycle [ 40.962457][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 40.968634][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=c298, bcdDevice= 0.00 [ 40.977711][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.986722][ T9] usb 1-1: config 0 descriptor?? [ 41.037721][ T1070] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 41.135776][ T1070] tipc: Enabled bearer , priority 0 [ 41.183219][ T1069] tipc: Resetting bearer [ 41.195804][ T1069] tipc: Disabling bearer [ 41.232598][ T65] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 41.254541][ T65] usb 3-1: device descriptor read/8, error -71 [ 41.285271][ T1074] SELinux: Context system_u:object_r:crond_var_run_t:s0 is not valid (left unmapped). [ 41.295426][ T36] kauditd_printk_skb: 12 callbacks suppressed [ 41.295440][ T36] audit: type=1400 audit(1761452177.290:288): avc: denied { relabelto } for pid=1073 comm="syz.1.241" name="68" dev="tmpfs" ino=378 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:crond_var_run_t:s0" [ 41.342674][ T36] audit: type=1400 audit(1761452177.290:289): avc: denied { associate } for pid=1073 comm="syz.1.241" name="68" dev="tmpfs" ino=378 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:crond_var_run_t:s0" [ 41.372882][ T36] audit: type=1400 audit(1761452177.360:290): avc: denied { write } for pid=1073 comm="syz.1.241" name="68" dev="tmpfs" ino=378 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:crond_var_run_t:s0" [ 41.394009][ T9] logitech 0003:046D:C298.0003: unknown main item tag 0x0 [ 41.399387][ T36] audit: type=1400 audit(1761452177.360:291): avc: denied { add_name } for pid=1073 comm="syz.1.241" name="cpuacct.usage_percpu" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:crond_var_run_t:s0" [ 41.416086][ T9] logitech 0003:046D:C298.0003: item fetching failed at offset 3/5 [ 41.446233][ T65] usb 3-1: device descriptor read/8, error -71 [ 41.449920][ T9] logitech 0003:046D:C298.0003: parse failed [ 41.458657][ T9] logitech 0003:046D:C298.0003: probe with driver logitech failed with error -22 [ 41.468469][ T36] audit: type=1400 audit(1761452177.360:292): avc: denied { create } for pid=1073 comm="syz.1.241" name="cpuacct.usage_percpu" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 41.490598][ T36] audit: type=1400 audit(1761452177.360:293): avc: denied { associate } for pid=1073 comm="syz.1.241" name="cpuacct.usage_percpu" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 41.499558][ T1084] process 'syz.3.244' launched './file0' with NULL argv: empty string added [ 41.513602][ T36] audit: type=1400 audit(1761452177.360:294): avc: denied { read append open } for pid=1073 comm="syz.1.241" path="/68/cpuacct.usage_percpu" dev="tmpfs" ino=383 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 41.547833][ T1084] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 41.548134][ T36] audit: type=1400 audit(1761452177.360:295): avc: denied { map } for pid=1073 comm="syz.1.241" path="/68/cpuacct.usage_percpu" dev="tmpfs" ino=383 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 41.564942][ T1084] rust_binder: Write failure EINVAL in pid:185 [ 41.579008][ T36] audit: type=1400 audit(1761452177.360:296): avc: denied { execute } for pid=1073 comm="syz.1.241" path="/68/cpuacct.usage_percpu" dev="tmpfs" ino=383 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 41.619781][ T1067] rust_binder: Write failure EFAULT in pid:159 [ 41.622193][ T331] usb 1-1: USB disconnect, device number 4 [ 41.642095][ T36] audit: type=1400 audit(1761452177.360:297): avc: denied { ioctl } for pid=1073 comm="syz.1.241" path="/68/cpuacct.usage_percpu" dev="tmpfs" ino=383 ioctlcmd=0xae9c scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 41.692534][ T65] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 41.713995][ T65] usb 3-1: device descriptor read/8, error -71 [ 41.792141][ T1100] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 41.792155][ T1100] rust_binder: Read failure Err(EFAULT) in pid:193 [ 41.834968][ T1107] rust_binder: 200: no such ref 0 [ 41.846664][ T1107] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 41.853786][ T1107] rust_binder: Failed to allocate buffer. len:1128, is_oneway:false [ 41.854581][ T65] usb 3-1: device descriptor read/8, error -71 [ 41.902946][ T9] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 41.972569][ T65] usb usb3-port1: unable to enumerate USB device [ 42.053629][ T9] usb 2-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 42.062858][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.071606][ T9] usb 2-1: config 0 descriptor?? [ 42.122009][ T1140] rust_binder: Write failure EFAULT in pid:233 [ 42.260167][ T1155] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 42.463448][ T1168] binder: Unknown parameter 'rw'' [ 42.483745][ T9] samsung 0003:0419:0001.0004: unknown main item tag 0x0 [ 42.500989][ T9] samsung 0003:0419:0001.0004: item fetching failed at offset 4/5 [ 42.519167][ T9] samsung 0003:0419:0001.0004: parse failed [ 42.525165][ T9] samsung 0003:0419:0001.0004: probe with driver samsung failed with error -22 [ 42.563489][ T1180] rust_binder: 191: no such ref 3 [ 42.580268][ T1180] rust_binder: 191: no such ref 1 [ 42.585369][ T1180] rust_binder: Write failure EFAULT in pid:191 [ 42.628941][ T1182] netlink: 'syz.2.277': attribute type 15 has an invalid length. [ 42.791886][ T1184] rust_binder: Error while translating object. [ 42.791936][ T1184] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 42.813083][ T1184] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:183 [ 42.934514][ T432] usb 2-1: USB disconnect, device number 5 [ 43.082611][ T331] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 43.232429][ T331] usb 3-1: Using ep0 maxpacket: 16 [ 43.240827][ T331] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 43.242659][ T1208] netlink: 'syz.3.285': attribute type 29 has an invalid length. [ 43.251824][ T331] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 43.269244][ T331] usb 3-1: New USB device found, idVendor=17ef, idProduct=7309, bcdDevice= 0.00 [ 43.278315][ T331] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.287170][ T331] usb 3-1: config 0 descriptor?? [ 43.297503][ T331] hub 3-1:0.0: USB hub found [ 43.504649][ T331] hub 3-1:0.0: 7 ports detected [ 43.511196][ T331] hub 3-1:0.0: insufficient power available to use all downstream ports [ 43.763277][ T331] hub 3-1:0.0: hub_hub_status failed (err = -71) [ 43.778338][ T331] hub 3-1:0.0: config failed, can't get hub status (err -71) [ 43.802970][ T65] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 43.813072][ T65] hid-generic 0000:0000:0000.0005: hidraw0: HID v0.00 Device [syz1] on syz0 [ 43.813582][ T331] usb 3-1: USB disconnect, device number 12 [ 43.867786][ T1221] fido_id[1221]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 43.921954][ T1236] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.940113][ T1236] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.948636][ T1236] binder: Unknown parameter 'context[7' [ 43.957497][ T1240] binder: Unknown parameter 'context[7' [ 44.152430][ T65] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 44.161012][ T1245] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 44.161048][ T1247] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:261 [ 44.224007][ T1264] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 44.233218][ T1264] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:229 [ 44.255423][ T1268] 9pnet_fd: Insufficient options for proto=fd [ 44.285696][ T1271] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 44.292882][ T1271] rust_binder: Write failure EINVAL in pid:235 [ 44.323481][ T65] usb 1-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 44.345340][ T65] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 44.360622][ T65] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 44.371914][ T65] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 44.380974][ T65] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.390295][ T1235] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 44.598765][ T65] aiptek 1-1:17.0: Aiptek using 400 ms programming speed [ 44.606981][ T65] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:17.0/input/input11 [ 44.620118][ T65] usb 1-1: USB disconnect, device number 5 [ 44.620153][ C0] aiptek 1-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 44.701270][ T1298] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 44.817356][ T1309] rust_binder: Write failure EFAULT in pid:289 [ 44.852344][ T1307] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 44.858718][ T1307] rust_binder: Read failure Err(EFAULT) in pid:250 [ 44.897049][ T1315] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 45.008847][ T1324] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 112, limit: 112, size: 4080) [ 45.008864][ T1324] rust_binder: Error while translating object. [ 45.019648][ T1324] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 45.025877][ T1324] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:295 [ 45.045773][ T1327] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 45.069025][ T1327] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 45.192461][ T10] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 45.230252][ T1335] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 45.230284][ T1335] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:202 [ 45.260215][ T1338] rust_binder: Write failure EFAULT in pid:204 [ 45.308231][ T1345] 9pnet: Could not find request transport: xen [ 45.321878][ T1345] 9pnet: Could not find request transport: xen [ 45.329514][ T1349] kernel profiling enabled (shift: 34) [ 45.335089][ T1349] profiling shift: 34 too large [ 45.340433][ T1350] kernel profiling enabled (shift: 34) [ 45.345996][ T1350] profiling shift: 34 too large [ 45.351152][ T1349] SELinux: security_context_str_to_sid (E) failed with errno=-22 [ 45.359130][ T1350] SELinux: security_context_str_to_sid (E) failed with errno=-22 [ 45.372436][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 45.378513][ T10] usb 3-1: config 32 has an invalid descriptor of length 0, skipping remainder of the config [ 45.389398][ T10] usb 3-1: config 32 has an invalid descriptor of length 0, skipping remainder of the config [ 45.396752][ T1353] binder: Unknown parameter 'defcontext01777777777777777777777' [ 45.400499][ T10] usb 3-1: config 32 has an invalid descriptor of length 0, skipping remainder of the config [ 45.418128][ T10] usb 3-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 45.427198][ T10] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 45.435574][ T10] usb 3-1: Manufacturer: syz [ 45.447548][ T10] hub 3-1:32.0: Invalid hub with more than one config or interface [ 45.457111][ T1357] netlink: 24 bytes leftover after parsing attributes in process `syz.0.336'. [ 45.460738][ T10] hub 3-1:32.0: probe with driver hub failed with error -22 [ 45.468271][ T1357] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 45.505377][ T1361] tipc: Trying to set illegal importance in message [ 45.582682][ T54] Bluetooth: hci0: command 0x1003 tx timeout [ 45.588732][ T350] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 45.659385][ T1369] rust_binder: Write failure EFAULT in pid:228 [ 45.708569][ T10] usb 3-1: USB disconnect, device number 13 [ 45.736389][ T946] udevd[946]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:32.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 46.002488][ T65] usb 1-1: new low-speed USB device number 6 using dummy_hcd [ 46.112211][ T1377] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 152, size: 18446744073709551507) [ 46.112229][ T1377] rust_binder: Error while translating object. [ 46.124441][ T1377] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 46.130635][ T1377] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:225 [ 46.152439][ T65] usb 1-1: Invalid ep0 maxpacket: 64 [ 46.268853][ T1389] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 224, size: 226) [ 46.268878][ T1389] rust_binder: Error while translating object. [ 46.284299][ T1391] syz.2.348 (1391): attempted to duplicate a private mapping with mremap. This is not supported. [ 46.301105][ T1389] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 46.301128][ T1389] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:232 [ 46.302565][ T65] usb 1-1: new low-speed USB device number 7 using dummy_hcd [ 46.348097][ T36] kauditd_printk_skb: 36 callbacks suppressed [ 46.348110][ T36] audit: type=1400 audit(1761452182.340:334): avc: denied { mount } for pid=1396 comm="syz.2.351" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 46.361259][ T1387] usb usb8: usbfs: process 1387 (syz.3.347) did not claim interface 0 before use [ 46.377361][ T1399] rust_binder: 235: no such ref 0 [ 46.390183][ T36] audit: type=1400 audit(1761452182.340:335): avc: denied { remount } for pid=1396 comm="syz.2.351" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 46.395659][ T1399] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 46.411175][ T36] audit: type=1400 audit(1761452182.360:336): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 46.417571][ T1399] rust_binder: 235: no such ref 2 [ 46.442983][ T1399] rust_binder: Failed to allocate buffer. len:1128, is_oneway:false [ 46.465740][ T1404] netlink: 'syz.1.353': attribute type 4 has an invalid length. [ 46.474588][ T1406] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.482197][ T1406] rust_binder: 271: no such ref 1 [ 46.486548][ T1404] netlink: 'syz.1.353': attribute type 6 has an invalid length. [ 46.488720][ T65] usb 1-1: Invalid ep0 maxpacket: 64 [ 46.494118][ T1404] netlink: 3657 bytes leftover after parsing attributes in process `syz.1.353'. [ 46.502920][ T65] usb usb1-port1: attempt power cycle [ 46.508919][ T1404] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=35 sclass=netlink_route_socket pid=1404 comm=syz.1.353 [ 46.515783][ T1406] rust_binder: 271: no such ref 2 [ 46.515798][ T1406] rust_binder: 271: no such ref 2 [ 46.515808][ T1406] rust_binder: 271: no such ref 2 [ 46.666610][ T1420] syz.1.360: vmalloc error: size 16105472, failed to allocated page array size 31456, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0 [ 46.685334][ T1420] CPU: 1 UID: 0 PID: 1420 Comm: syz.1.360 Not tainted syzkaller #0 0b5ffdee5fcd2f7749818d1ff954e9c21353764e [ 46.685360][ T1420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 46.685379][ T1420] Call Trace: [ 46.685385][ T1420] [ 46.685392][ T1420] __dump_stack+0x21/0x30 [ 46.685420][ T1420] dump_stack_lvl+0x10c/0x190 [ 46.685444][ T1420] ? __cfi_dump_stack_lvl+0x10/0x10 [ 46.685469][ T1420] ? _raw_spin_unlock_irqrestore+0x4a/0x70 [ 46.685496][ T1420] dump_stack+0x19/0x20 [ 46.685519][ T1420] warn_alloc+0x1bc/0x2a0 [ 46.685543][ T1420] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 46.685563][ T1420] ? __cfi_warn_alloc+0x10/0x10 [ 46.685588][ T1420] ? __get_vm_area_node+0x1dc/0x3a0 [ 46.685613][ T1420] ? __vcalloc_noprof+0x3a/0x50 [ 46.685631][ T1420] __vmalloc_node_range_noprof+0x68e/0x1420 [ 46.685658][ T1420] ? stack_depot_save_flags+0x38/0x800 [ 46.685681][ T1420] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 46.685702][ T1420] ? __cfi___vmalloc_node_range_noprof+0x10/0x10 [ 46.685737][ T1420] ? __vcalloc_noprof+0x3a/0x50 [ 46.685755][ T1420] __vmalloc_noprof+0xfe/0x1d0 [ 46.685774][ T1420] ? __vcalloc_noprof+0x3a/0x50 [ 46.685786][ T1420] ? __cfi___vmalloc_noprof+0x10/0x10 [ 46.685804][ T1420] ? mutex_lock+0x92/0x1c0 [ 46.685815][ T1420] ? __cfi_mutex_lock+0x10/0x10 [ 46.685827][ T1420] __vcalloc_noprof+0x3a/0x50 [ 46.685839][ T1420] kvm_set_memslot+0x4c6/0x13f0 [ 46.685859][ T1420] ? __kmalloc_cache_noprof+0x24c/0x490 [ 46.685873][ T1420] __kvm_set_memory_region+0x87c/0xb80 [ 46.685894][ T1420] kvm_set_memory_region+0x2f/0x50 [ 46.685913][ T1420] kvm_vm_ioctl+0x9ad/0xb80 [ 46.685931][ T1420] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 46.685949][ T1420] ? ioctl_has_perm+0x1aa/0x4d0 [ 46.685965][ T1420] ? __asan_memcpy+0x5a/0x80 [ 46.685977][ T1420] ? ioctl_has_perm+0x3e0/0x4d0 [ 46.685994][ T1420] ? __cfi_futex_wait+0x10/0x10 [ 46.686011][ T1420] ? selinux_file_ioctl+0x6e0/0x1360 [ 46.686026][ T1420] ? __cfi_selinux_file_ioctl+0x10/0x10 [ 46.686042][ T1420] ? kfree+0x15c/0x460 [ 46.686052][ T1420] ? do_futex+0x309/0x500 [ 46.686066][ T1420] ? __cfi_do_futex+0x10/0x10 [ 46.686078][ T1420] ? anon_inode_getfile+0xfb/0x190 [ 46.686096][ T1420] ? __fget_files+0x2c5/0x340 [ 46.686111][ T1420] ? bpf_lsm_file_ioctl+0xd/0x20 [ 46.686129][ T1420] ? security_file_ioctl+0x34/0xd0 [ 46.686144][ T1420] ? __cfi_kvm_vm_ioctl+0x10/0x10 [ 46.686161][ T1420] __se_sys_ioctl+0x135/0x1b0 [ 46.686176][ T1420] __x64_sys_ioctl+0x7f/0xa0 [ 46.686190][ T1420] x64_sys_call+0x1878/0x2ee0 [ 46.686209][ T1420] do_syscall_64+0x58/0xf0 [ 46.686226][ T1420] ? clear_bhb_loop+0x50/0xa0 [ 46.686241][ T1420] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 46.686258][ T1420] RIP: 0033:0x7f8a8db8efc9 [ 46.686273][ T1420] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 46.686283][ T1420] RSP: 002b:00007f8a8ea5c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 46.686298][ T1420] RAX: ffffffffffffffda RBX: 00007f8a8dde5fa0 RCX: 00007f8a8db8efc9 [ 46.686308][ T1420] RDX: 0000200000000080 RSI: 000000004020ae46 RDI: 0000000000000005 [ 46.686316][ T1420] RBP: 00007f8a8dc11f91 R08: 0000000000000000 R09: 0000000000000000 [ 46.686325][ T1420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 46.686332][ T1420] R13: 00007f8a8dde6038 R14: 00007f8a8dde5fa0 R15: 00007ffccd2ed308 [ 46.686344][ T1420] [ 46.686415][ T1420] Mem-Info: [ 47.026606][ T1420] active_anon:25603 inactive_anon:0 isolated_anon:0 [ 47.026606][ T1420] active_file:17917 inactive_file:2240 isolated_file:0 [ 47.026606][ T1420] unevictable:0 dirty:39 writeback:0 [ 47.026606][ T1420] slab_reclaimable:4692 slab_unreclaimable:71367 [ 47.026606][ T1420] mapped:27149 shmem:19381 pagetables:881 [ 47.026606][ T1420] sec_pagetables:0 bounce:0 [ 47.026606][ T1420] kernel_misc_reclaimable:0 [ 47.026606][ T1420] free:1510620 free_pcp:2741 free_cma:0 [ 47.071835][ T1420] Node 0 active_anon:102364kB inactive_anon:0kB active_file:71668kB inactive_file:8960kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:108656kB dirty:164kB writeback:0kB shmem:77600kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:5312kB pagetables:3568kB sec_pagetables:12kB all_unreclaimable? no [ 47.103898][ T1420] DMA32 free:2960212kB boost:0kB min:19088kB low:23860kB high:28632kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:2965936kB mlocked:0kB bounce:0kB free_pcp:5724kB local_pcp:68kB free_cma:0kB [ 47.112450][ T432] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 47.133754][ T1420] lowmem_reserve[]: 0 3921 [ 47.141264][ T65] usb 1-1: new low-speed USB device number 8 using dummy_hcd [ 47.153137][ T1420] 3921 [ 47.156708][ T1420] Normal free:3085148kB boost:0kB min:25964kB low:32452kB high:38940kB reserved_highatomic:0KB free_highatomic:0KB active_anon:102304kB inactive_anon:0kB active_file:71668kB inactive_file:8960kB unevictable:0kB writepending:168kB present:5242880kB managed:4016120kB mlocked:0kB bounce:0kB free_pcp:3532kB local_pcp:200kB free_cma:0kB [ 47.162801][ T65] usb 1-1: Invalid ep0 maxpacket: 64 [ 47.188141][ T1420] lowmem_reserve[]: 0 0 0 [ 47.197574][ T1420] DMA32: 5*4kB (M) 2*8kB (M) 3*16kB (M) 4*32kB (M) 4*64kB (M) 3*128kB (M) 4*256kB (M) 4*512kB (M) 5*1024kB (UM) 5*2048kB (M) 718*4096kB (M) = 2960212kB [ 47.213027][ T1420] Normal: 367*4kB (UME) 416*8kB (UME) 98*16kB (UME) 80*32kB (UME) 498*64kB (UME) 132*128kB (UME) 38*256kB (UME) 24*512kB (UME) 23*1024kB (ME) 20*2048kB (UME) 718*4096kB (UM) = 3085148kB [ 47.231578][ T1420] 39576 total pagecache pages [ 47.236423][ T1420] 1 pages in swap cache [ 47.240590][ T1420] Free swap = 124436kB [ 47.244893][ T1420] Total swap = 124996kB [ 47.249106][ T1420] 2097051 pages RAM [ 47.253061][ T1420] 0 pages HighMem/MovableOnly [ 47.257735][ T1420] 351537 pages reserved [ 47.261942][ T1420] 0 pages cma reserved [ 47.272757][ T1420] Memory allocations: [ 47.276747][ T1420] 0 B 0 init/main.c:1370 func:do_initcalls [ 47.284832][ T1420] 0 B 0 init/do_mounts.c:186 func:mount_root_generic [ 47.293196][ T1420] 0 B 0 init/do_mounts.c:158 func:do_mount_root [ 47.301004][ T1420] 0 B 0 init/do_mounts.c:352 func:mount_nodev_root [ 47.308973][ T1420] 0 B 0 init/do_mounts_rd.c:241 func:rd_load_image [ 47.310102][ T432] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 47.322498][ T1420] 0 B 0 init/do_mounts_rd.c:72 func:identify_ramdisk_image [ 47.326764][ T65] usb 1-1: new low-speed USB device number 9 using dummy_hcd [ 47.335413][ T1420] 0 B 0 init/initramfs.c:507 func:unpack_to_rootfs [ 47.342677][ T432] usb 3-1: New USB device found, idVendor=056e, idProduct=011c, bcdDevice= 0.00 [ 47.350592][ T1420] 0 B 0 init/initramfs.c:508 func:unpack_to_rootfs [ 47.359574][ T432] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 47.367702][ T1420] 0 B 0 init/initramfs.c:509 func:unpack_to_rootfs [ 47.376278][ T432] usb 3-1: config 0 descriptor?? [ 47.383518][ T1420] 0 B 0 init/initramfs.c:101 func:find_link [ 47.393828][ T65] usb 1-1: Invalid ep0 maxpacket: 64 [ 47.400964][ T65] usb usb1-port1: unable to enumerate USB device [ 47.522424][ T491] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 47.594241][ T432] elecom 0003:056E:011C.0006: global environment stack underflow [ 47.602042][ T432] elecom 0003:056E:011C.0006: item 0 4 1 11 parsing failed [ 47.609450][ T432] elecom 0003:056E:011C.0006: probe with driver elecom failed with error -22 [ 47.673459][ T491] usb 4-1: config index 0 descriptor too short (expected 2075, got 27) [ 47.681732][ T491] usb 4-1: config 0 has an invalid interface number: 200 but max is 0 [ 47.689916][ T491] usb 4-1: config 0 has no interface number 0 [ 47.696015][ T491] usb 4-1: config 0 interface 200 altsetting 2 endpoint 0x4 has invalid wMaxPacketSize 0 [ 47.705850][ T491] usb 4-1: config 0 interface 200 has no altsetting 0 [ 47.713985][ T491] usb 4-1: New USB device found, idVendor=0b57, idProduct=852a, bcdDevice=6d.39 [ 47.723060][ T491] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.731045][ T491] usb 4-1: Product: syz [ 47.735217][ T491] usb 4-1: Manufacturer: syz [ 47.739813][ T491] usb 4-1: SerialNumber: syz [ 47.744980][ T491] usb 4-1: config 0 descriptor?? [ 47.792887][ T432] usb 3-1: USB disconnect, device number 14 [ 47.986873][ T329] Bluetooth: hci0: Frame reassembly failed (-84) [ 48.026446][ T1443] rust_binder: Got transaction with invalid offset. [ 48.026473][ T1443] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 48.033177][ T1443] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:264 [ 48.059064][ T1445] netlink: 'syz.1.368': attribute type 27 has an invalid length. [ 48.094171][ T1445] 9pnet_fd: Insufficient options for proto=fd [ 48.552455][ T65] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 48.686188][ T36] audit: type=1400 audit(1761452184.680:337): avc: denied { connect } for pid=1452 comm="syz.1.372" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 48.692756][ T1453] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 48.706200][ T36] audit: type=1400 audit(1761452184.680:338): avc: denied { getopt } for pid=1452 comm="syz.1.372" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 48.714727][ T65] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 48.740822][ T65] usb 3-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 48.749698][ T65] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 48.759995][ T65] usb 3-1: config 220 has no interface number 2 [ 48.766326][ T65] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 48.779497][ T65] usb 3-1: config 220 interface 0 has no altsetting 0 [ 48.792450][ T65] usb 3-1: config 220 interface 76 has no altsetting 0 [ 48.799400][ T65] usb 3-1: config 220 interface 1 has no altsetting 0 [ 48.808574][ T65] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 48.817677][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 48.825863][ T65] usb 3-1: Product: syz [ 48.830051][ T65] usb 3-1: Manufacturer: syz [ 48.839858][ T65] usb 3-1: SerialNumber: syz [ 48.844231][ T1461] ptm ptm13: ldisc open failed (-12), clearing slot 13 [ 48.871668][ T1466] netlink: 8 bytes leftover after parsing attributes in process `syz.0.375'. [ 49.054120][ T65] uvcvideo 3-1:220.1: Unknown video format 05090800-0381-0200-5805-080904010000 [ 49.063261][ T65] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 49.069636][ T65] usb 3-1: No valid video chain found. [ 49.075148][ T65] usb 3-1: selecting invalid altsetting 0 [ 49.084162][ T65] usb 3-1: USB disconnect, device number 15 [ 49.668780][ T1491] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 49.877368][ T330] Bluetooth: hci2: Frame reassembly failed (-84) [ 50.062921][ T350] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 50.063271][ T1471] Bluetooth: hci0: command 0x1003 tx timeout [ 50.080296][ T491] input: Hanwang Art Master III 1308 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.200/input/input12 [ 50.100392][ T491] usb 4-1: USB disconnect, device number 12 [ 50.679471][ T1512] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 50.728945][ T1517] rust_binder: Error while translating object. [ 50.736997][ T1517] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 50.743365][ T1517] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:293 [ 50.942426][ T54] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 51.115129][ T1542] netlink: 'syz.0.400': attribute type 12 has an invalid length. [ 51.123225][ T1542] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 51.132551][ T331] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 51.149142][ T1544] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 51.283679][ T331] usb 4-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 51.296557][ T331] usb 4-1: config 0 interface 0 has no altsetting 0 [ 51.303210][ T331] usb 4-1: New USB device found, idVendor=0458, idProduct=0153, bcdDevice= 0.00 [ 51.312261][ T331] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.320975][ T331] usb 4-1: config 0 descriptor?? [ 51.660727][ T1553] netlink: 'syz.1.405': attribute type 28 has an invalid length. [ 51.729854][ T331] kye 0003:0458:0153.0007: hidraw0: USB HID v1.01 Device [HID 0458:0153] on usb-dummy_hcd.3-1/input0 [ 51.761570][ T1562] rust_binder: Error while translating object. [ 51.761618][ T1562] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 51.767850][ T1562] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:308 [ 51.902435][ T351] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 51.902548][ T54] Bluetooth: hci2: command 0x1003 tx timeout [ 51.929045][ T491] usb 4-1: USB disconnect, device number 13 [ 52.022443][ T332] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 52.172433][ T332] usb 2-1: Using ep0 maxpacket: 16 [ 52.178969][ T332] usb 2-1: unable to get BOS descriptor or descriptor too short [ 52.187385][ T332] usb 2-1: config 1 interface 0 has no altsetting 0 [ 52.195401][ T332] usb 2-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 52.204484][ T332] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.212603][ T332] usb 2-1: Product: syz [ 52.216776][ T332] usb 2-1: Manufacturer: syz [ 52.221393][ T332] usb 2-1: SerialNumber: syz [ 52.243611][ T1566] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 52.243645][ T1566] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:277 [ 52.286150][ T1568] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 52.310663][ T36] audit: type=1400 audit(1761452188.300:339): avc: denied { attach_queue } for pid=1569 comm="syz.0.412" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 52.432281][ T332] usblp0: Disabling reads from problematic bidirectional printer [ 52.441076][ T332] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 6 if 0 alt 32 proto 2 vid 0x03F0 pid 0x0004 [ 52.463005][ T332] usb 2-1: USB disconnect, device number 6 [ 52.476567][ T332] usblp0: removed [ 52.479236][ T1577] rust_binder: Error while translating object. [ 52.480243][ T1577] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 52.493270][ T1577] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:296 [ 52.616098][ T1589] SELinux: failed to load policy [ 52.645102][ T1593] loop2: detected capacity change from 0 to 8388607 [ 52.667520][ T946] Buffer I/O error on dev loop2, logical block 1048575, async page read [ 52.676479][ T1596] binder: Bad value for 'max' [ 52.732434][ T331] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 52.903554][ T331] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 52.913403][ T331] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 52.930901][ T331] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 52.950390][ T331] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.969440][ T331] usb 1-1: Product: syz [ 52.973785][ T331] usb 1-1: Manufacturer: syz [ 52.978396][ T331] usb 1-1: SerialNumber: syz [ 52.993285][ T331] usb 1-1: config 0 descriptor?? [ 53.003023][ T1579] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 53.010208][ T1579] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 53.018967][ T1619] __vm_enough_memory: pid: 1619, comm: syz.1.428, bytes: 18014402804453376 not enough memory for the allocation [ 53.034803][ T1619] __vm_enough_memory: pid: 1619, comm: syz.1.428, bytes: 18014402804453376 not enough memory for the allocation [ 53.231827][ T1579] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 53.239219][ T1579] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 53.273025][ T9] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 53.302469][ T491] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 53.433889][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 53.444082][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 53.452437][ T491] usb 2-1: Using ep0 maxpacket: 8 [ 53.454716][ T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 53.459469][ T491] usb 2-1: unable to get BOS descriptor or descriptor too short [ 53.467222][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.475469][ T491] usb 2-1: config 6 has an invalid interface number: 194 but max is 0 [ 53.482840][ T9] usb 4-1: Product: syz [ 53.490947][ T491] usb 2-1: config 6 has no interface number 0 [ 53.495175][ T9] usb 4-1: Manufacturer: syz [ 53.501151][ T491] usb 2-1: config 6 interface 194 has no altsetting 0 [ 53.505812][ T9] usb 4-1: SerialNumber: syz [ 53.514088][ T491] usb 2-1: New USB device found, idVendor=0403, idProduct=d578, bcdDevice=32.00 [ 53.526369][ T491] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.534538][ T491] usb 2-1: Product: syz [ 53.538753][ T491] usb 2-1: Manufacturer: syz [ 53.543381][ T491] usb 2-1: SerialNumber: syz [ 53.730542][ T9] usb 4-1: 0:2 : does not exist [ 53.737962][ T9] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 53.752874][ T1623] __vm_enough_memory: pid: 1623, comm: syz.1.429, bytes: 18014402804453376 not enough memory for the allocation [ 53.764966][ T9] usb 4-1: USB disconnect, device number 14 [ 53.775614][ T491] ftdi_sio 2-1:6.194: FTDI USB Serial Device converter detected [ 53.784908][ T491] usb 2-1: Detected FT233HP [ 53.789697][ T491] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 53.798126][ T491] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 53.805553][ T491] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 53.815319][ T491] usb 2-1: USB disconnect, device number 7 [ 53.821860][ T491] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 53.831609][ T491] ftdi_sio 2-1:6.194: device disconnected [ 53.882434][ T65] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 54.033785][ T65] usb 3-1: unable to get BOS descriptor or descriptor too short [ 54.041801][ T65] usb 3-1: not running at top speed; connect to a high speed hub [ 54.050233][ T65] usb 3-1: config 36 contains an unexpected descriptor of type 0x2, skipping [ 54.059032][ T65] usb 3-1: config 36 has an invalid descriptor of length 0, skipping remainder of the config [ 54.069249][ T65] usb 3-1: config 36 has 0 interfaces, different from the descriptor's value: 10 [ 54.070232][ T1579] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:283 [ 54.079874][ T331] dm9601 1-1:0.0 (unnamed net_device) (uninitialized): Error reading MODE_CTRL [ 54.085110][ T65] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0121, bcdDevice= 0.40 [ 54.091434][ T331] usb 1-1: USB disconnect, device number 10 [ 54.098439][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.120869][ T65] usb 3-1: Product: syz [ 54.125034][ T65] usb 3-1: Manufacturer: syz [ 54.129625][ T65] usb 3-1: SerialNumber: syz [ 54.299043][ T1633] netlink: 20 bytes leftover after parsing attributes in process `syz.1.433'. [ 54.335716][ T1629] rust_binder: Read failure Err(EAGAIN) in pid:312 [ 54.337855][ T65] usb 3-1: USB disconnect, device number 16 [ 54.377604][ T36] audit: type=1400 audit(1761452190.370:340): avc: denied { read } for pid=1644 comm="syz.3.437" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 54.378828][ T1645] rust_binder: Error while translating object. [ 54.396990][ T1645] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 54.403202][ T1645] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:365 [ 54.423264][ T1648] binder: Unknown parameter 'context[7' [ 54.450396][ T1650] overlayfs: missing 'lowerdir' [ 54.456101][ T1650] SELinux: Context system_u:object_r:boot_t:s0 is not valid (left unmapped). [ 54.465569][ T36] audit: type=1400 audit(1761452190.470:341): avc: denied { relabelto } for pid=1649 comm="syz.3.439" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0" [ 54.492081][ T36] audit: type=1400 audit(1761452190.470:342): avc: denied { associate } for pid=1649 comm="syz.3.439" name="rnullb0" dev="devtmpfs" ino=31 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 srawcon="system_u:object_r:boot_t:s0" [ 54.519340][ T36] audit: type=1400 audit(1761452190.470:343): avc: denied { ioctl } for pid=1649 comm="syz.3.439" path="/122/bus/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x6725 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 54.553487][ T36] audit: type=1400 audit(1761452190.550:344): avc: denied { read write } for pid=1653 comm="syz.1.440" name="rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0" [ 54.580114][ T36] audit: type=1400 audit(1761452190.550:345): avc: denied { open } for pid=1653 comm="syz.1.440" path="/dev/rnullb0" dev="devtmpfs" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=blk_file permissive=1 trawcon="system_u:object_r:boot_t:s0" [ 54.638576][ T36] audit: type=1326 audit(1761452190.630:346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1663 comm="syz.1.443" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a8db8efc9 code=0x7ffc0000 [ 54.667466][ T36] audit: type=1326 audit(1761452190.630:347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1663 comm="syz.1.443" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8a8db8efc9 code=0x7ffc0000 [ 54.690806][ T36] audit: type=1326 audit(1761452190.650:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1663 comm="syz.1.443" exe="/root/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f8a8db8efc9 code=0x7ffc0000 [ 54.796928][ T1684] SELinux: ebitmap: truncated map [ 54.807793][ T1684] SELinux: failed to load policy [ 54.876675][ T1691] netlink: 'syz.2.452': attribute type 11 has an invalid length. [ 54.943959][ T1700] loop5: detected capacity change from 0 to 7 [ 54.994755][ T51] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 55.003996][ T51] Buffer I/O error on dev loop5, logical block 0, async page read [ 55.012231][ T1700] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 55.029701][ T1700] Buffer I/O error on dev loop5, logical block 0, async page read [ 55.033348][ T1705] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI [ 55.050109][ T1705] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 55.052482][ T1700] loop5: unable to read partition table [ 55.058524][ T1705] CPU: 1 UID: 0 PID: 1705 Comm: syz.3.457 Not tainted syzkaller #0 0b5ffdee5fcd2f7749818d1ff954e9c21353764e [ 55.058553][ T1705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 55.085666][ T1705] RIP: 0010:iter_file_splice_write+0xace/0x11b0 [ 55.085977][ T1700] loop_reread_partitions: partition scan of loop5 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 55.091941][ T1705] Code: 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 67 d6 e6 ff 49 8b 1e 49 c7 06 00 00 00 00 48 83 c3 08 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 43 d6 e6 ff 4c 8b 1b 48 8b 3c 24 [ 55.091966][ T1705] RSP: 0018:ffffc9000e5ff820 EFLAGS: 00010202 [ 55.131577][ T1705] RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff888102b3cc00 [ 55.139556][ T1705] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 7fffffffffff8fff [ 55.147542][ T1705] RBP: ffffc9000e5ffa40 R08: ffff8881f6f72240 R09: 1ffff1103edee448 [ 55.155522][ T1705] R10: 1ffff1103edee44b R11: 0000000000000fd8 R12: dffffc0000000000 [ 55.163493][ T1705] R13: 7fffffffffff8fff R14: ffff88811bc54128 R15: ffff88811bc54118 [ 55.171462][ T1705] FS: 00007f4c8ae8c6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 55.180404][ T1705] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 55.186985][ T1705] CR2: 000000110c33b0a5 CR3: 00000001193ee000 CR4: 00000000003526b0 [ 55.194963][ T1705] Call Trace: [ 55.198235][ T1705] [ 55.201166][ T1705] ? __cfi_iter_file_splice_write+0x10/0x10 [ 55.207071][ T1705] ? __kmalloc_noprof+0x271/0x530 [ 55.212093][ T1705] ? activate_task+0x38b/0x3d0 [ 55.216859][ T1705] ? __kasan_check_write+0x18/0x20 [ 55.221973][ T1705] ? __cfi_iter_file_splice_write+0x10/0x10 [ 55.227899][ T1705] direct_splice_actor+0x279/0x4b0 [ 55.233012][ T1705] splice_direct_to_actor+0x4fb/0xbc0 [ 55.238383][ T1705] ? __cfi_direct_splice_actor+0x10/0x10 [ 55.244011][ T1705] ? __cfi_splice_direct_to_actor+0x10/0x10 [ 55.249902][ T1705] do_splice_direct+0x182/0x270 [ 55.254756][ T1705] ? __cfi_do_splice_direct+0x10/0x10 [ 55.260122][ T1705] ? __cfi_direct_file_splice_eof+0x10/0x10 [ 55.266016][ T1705] ? security_file_permission+0x2e/0xc0 [ 55.271561][ T1705] ? rw_verify_area+0xac/0x230 [ 55.276326][ T1705] do_sendfile+0x5c8/0xfb0 [ 55.280740][ T1705] ? vfs_writev+0xcf0/0xcf0 [ 55.285243][ T1705] ? __se_sys_futex+0x28f/0x300 [ 55.290092][ T1705] __x64_sys_sendfile64+0x193/0x1f0 [ 55.295291][ T1705] ? __cfi___x64_sys_sendfile64+0x10/0x10 [ 55.301010][ T1705] ? switch_fpu_return+0x12/0x20 [ 55.305946][ T1705] x64_sys_call+0xa26/0x2ee0 [ 55.310536][ T1705] do_syscall_64+0x58/0xf0 [ 55.314951][ T1705] ? clear_bhb_loop+0x50/0xa0 [ 55.319623][ T1705] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 55.325511][ T1705] RIP: 0033:0x7f4c89f8efc9 [ 55.329924][ T1705] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 55.349530][ T1705] RSP: 002b:00007f4c8ae8c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 55.357944][ T1705] RAX: ffffffffffffffda RBX: 00007f4c8a1e5fa0 RCX: 00007f4c89f8efc9 [ 55.365933][ T1705] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000008 [ 55.373896][ T1705] RBP: 00007f4c8a011f91 R08: 0000000000000000 R09: 0000000000000000 [ 55.381870][ T1705] R10: 000000007a680000 R11: 0000000000000246 R12: 0000000000000000 [ 55.389837][ T1705] R13: 00007f4c8a1e6038 R14: 00007f4c8a1e5fa0 R15: 00007ffec73cfb58 [ 55.397809][ T1705] [ 55.400825][ T1705] Modules linked in: [ 55.404981][ T1705] ---[ end trace 0000000000000000 ]--- [ 55.412993][ T1705] RIP: 0010:iter_file_splice_write+0xace/0x11b0 [ 55.423479][ T1705] Code: 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 67 d6 e6 ff 49 8b 1e 49 c7 06 00 00 00 00 48 83 c3 08 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 43 d6 e6 ff 4c 8b 1b 48 8b 3c 24 [ 55.443313][ T1705] RSP: 0018:ffffc9000e5ff820 EFLAGS: 00010202 [ 55.449465][ T1705] RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff888102b3cc00 [ 55.457522][ T1705] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 7fffffffffff8fff [ 55.465599][ T1705] RBP: ffffc9000e5ffa40 R08: ffff8881f6f72240 R09: 1ffff1103edee448 [ 55.473651][ T1705] R10: 1ffff1103edee44b R11: 0000000000000fd8 R12: dffffc0000000000 [ 55.481645][ T1705] R13: 7fffffffffff8fff R14: ffff88811bc54128 R15: ffff88811bc54118 [ 55.489654][ T1705] FS: 00007f4c8ae8c6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 55.498611][ T1705] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 55.505214][ T1705] CR2: 00007f8a8ddb4198 CR3: 00000001193ee000 CR4: 00000000003526b0 [ 55.513216][ T1705] Kernel panic - not syncing: Fatal exception [ 55.519574][ T1705] Kernel Offset: disabled [ 55.523908][ T1705] Rebooting in 86400 seconds..