last executing test programs: 48.266785544s ago: executing program 1 (id=237): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xa4, 0x0, &(0x7f0000000200)=[@acquire_done={0x40106309, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fda={0x66646185, 0x5, 0x0, 0x2a}, @flat=@handle={0x73682a85, 0xa, 0x2}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000080)={0x0, 0x20, 0x38}}, 0x1000}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000140)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x100, 0x3}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}}], 0x9d, 0x0, &(0x7f0000000380)="05edaee62a86969ccf975c5121981115e142506721818ddc6ae780738a5242dc460d632c09e5246f7ed2e62860eddec9c93d2aa2e90db6ea92fefa05be23704c1806c7b185bc399af150b1eaa46c15bb6462ee7d48a252affcb67a8861c1ebea3d5cdd0aefae73390c04fedb7a7f0953780a6bebd89503296e7cab84737c5d3cf73e84effcc8c5a561ecf880051616fa8db0a30aa19b8ac219a0b831df"}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) sendfile(r2, r1, &(0x7f0000000440)=0xff, 0x2978) 48.264372764s ago: executing program 1 (id=241): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000000080), 0x0, 0x0, 0x0) (async) keyctl$revoke(0x3, 0x0) r2 = request_key(&(0x7f0000000000)='trusted\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)='./binderfs/binder1\x00', 0x0) r3 = add_key$fscrypt_v1(&(0x7f0000000100), &(0x7f0000000140)={'fscrypt:', @desc3}, &(0x7f0000000200)={0x0, "5d1f97b157c2d1ed57ca0ed1bc7cd49d9b4b000427f3357550a13330b61ddd37bd4d5bfc89da3c8c266bf25457ec6950a711b53040e642383c44e0fe18d43ac5", 0x2d}, 0x48, r2) keyctl$read(0xb, r3, 0x0, 0xfffffffffffffef4) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x2482, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) (async) ioctl$TCFLSH(r4, 0x400455c8, 0x0) syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f0000000440)=ANY=[@ANYBLOB="12010102020000ff2505a1a440000102030109025c0002018010060904000001020d000005240600010524002a9c72240f0105000000ff0f0800a906241a0400020905810310007981010904010000020d00000904010102020d0000090582020002070023090503020002060909"], 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 47.743949435s ago: executing program 1 (id=242): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000180)=0x4, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0xa0800, 0x0) close(r1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x4, &(0x7f0000000000)=0x1fc, 0x4) (async) r4 = syz_open_dev$evdev(&(0x7f0000000240), 0x20000, 0x0) ioctl$EVIOCGLED(r4, 0x80284504, &(0x7f0000000000)=""/52) (async) r5 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f00000001c0)=ANY=[@ANYBLOB="0100000000000009004d564b", @ANYRESHEX=r2]) ioctl$KVM_IRQ_LINE_STATUS(r5, 0xc008ae67, &(0x7f00000000c0)={0x6, 0x7}) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$netlink(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000), 0x21, 0x0, 0x0, 0x4008054}, 0x8850) (async) syz_open_procfs(0x0, &(0x7f0000000100)='net/fib_triestat\x00') (async) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r1, 0x80089419, &(0x7f0000000140)) (async) fchdir(r0) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r0, 0x942e, 0x0) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='exfat\x00', 0x200000, 0x0) 47.665351403s ago: executing program 1 (id=243): mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='mountinfo\x00') r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="020a00030700000026bd7000fbdbdf2505001a00ffffffff000000000000000000000000e000000200000000000000eb2a06192aa5806fd3"], 0x38}}, 0x20000000) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000013c0)=0xc) sendmmsg$unix(r3, &(0x7f0000000300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000010c0)=[@cred={{0x18, 0x1, 0x2, {r4, r5, r6}}}], 0x18, 0x40804}}], 0x1, 0x14008004) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace$setregs(0xf, r7, 0x0, 0x0) fstat(r0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet_udplite(0x2, 0x2, 0x88) r9 = syz_open_dev$usbfs(&(0x7f0000000000), 0x76, 0x183281) ioctl$USBDEVFS_RESET(r9, 0x5514) openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000007c0), 0x1, 0x0) r10 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r10, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x80, 0x0}, 0x5b4}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="080100", @ANYRES64=r10], 0x108}}], 0x2, 0xc040) r11 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r11}, &(0x7f0000bbdffc)) r12 = getuid() read$FUSE(r0, &(0x7f0000000800)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmsg$netlink(r0, &(0x7f0000002980)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)=[{&(0x7f0000000100)={0x10, 0x17, 0x200, 0x70bd2d, 0x25dfdbfd}, 0x10}], 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="1c000000000000000100000002000000b1d389e401d790314a1026bcc06f9c6ddf2578ceec13a996f9af94292acbcd4a2a735ab6cf9ed3279393613fd8e0d184b45c11a3226bc02547e1d6f8ef508c4cdc8a8918a0b6ee099201ac434cfa30d53c5aee122105b38604fb3c2b2cec20482c824505e36e5d47498bca79ef6f8090e7a1bf467159e53923dc81aa6c45552c471184e3aff45e98af964f6804cf5e89bcf92bb162b9cab692e8d0e741df754f5a74904cf159ab626d7a90aecbba4639c120357319addc48e3b74a179c99cf4617c0fc96b4458961470cf3a9fee7cc95b291c42cf5fec311960cf7c4acfa3b9f72b4694d9d0007d0617c8800139ac11de8959a9e", @ANYRES32=r2, @ANYRES32=r13, @ANYRES32=r6, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r2, @ANYRES32, @ANYRES32=r6, @ANYBLOB="0000000014000000000000000100000001000000", @ANYRES32=r0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r7, @ANYRES32=r8, @ANYRES32=r6, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r2, @ANYRES32=0x0, @ANYRES32=r14, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r11, @ANYRES32=r12, @ANYRES32=r14, @ANYBLOB='\x00\x00\x00\x00'], 0x120, 0x88c0}, 0x40d0) r15 = open(&(0x7f0000000200)='./bus\x00', 0x141a42, 0x0) sendfile(r15, r0, 0x0, 0xffffffff) 47.602371649s ago: executing program 1 (id=244): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/custom1\x00', 0x800, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) getsockopt$sock_int(r1, 0x1, 0x31, 0x0, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x138a, 0x1000000003}) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') lseek(r2, 0x1, 0x1) getdents64(r2, &(0x7f0000000a00)=""/66, 0x42) prctl$PR_SET_MM_AUXV(0x49, 0xc, 0x0, 0x0) add_key(&(0x7f0000000000)='rxrpc_s\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x6000, 0x0) r3 = open(&(0x7f00000003c0)='./file2\x00', 0x81, 0x0) ioctl$BTRFS_IOC_DEFRAG(r3, 0x40101283, 0x3) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) setsockopt$CAN_RAW_ERR_FILTER(0xffffffffffffffff, 0x65, 0x7, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000700)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x1100, 0x1}, @ptr={0x70742a85, 0xfffffffc, &(0x7f00000029c0)=""/193, 0xc1, 0x1, 0x14}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0x1d}}, &(0x7f0000000180)={0x0, 0x18, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) fcntl$F_SET_FILE_RW_HINT(r4, 0x40e, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r5, 0x0, 0x60, &(0x7f0000000a80)={'filter\x00', 0x10, 0x4, 0x3c8, 0x110, 0x110, 0x110, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@arp={@private=0xfffffffe, @rand_addr=0x64010102, 0x0, 0x0, 0x0, 0x0, {@empty, {[0x0, 0x0, 0x0, 0xff]}}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_virt_wifi\x00', 'veth1_to_bridge\x00', {}, {0xff}}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x4, {@empty, @mac=@dev, @dev={0xac, 0x14, 0x14, 0x20}, @broadcast}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28}}, {{@arp={@empty, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'tunl0\x00', {}, {}, 0x0, 0x101}, 0xc0, 0xe8}, @unspec=@MARK={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) r6 = socket(0x10, 0x803, 0x0) connect$unix(r6, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) madvise(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000440)=@abs, 0x6e, 0x0, 0x0, &(0x7f00000008c0)=[@rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}], 0x48}, 0x40002022) ioctl$FS_IOC_GETFSUUID(r5, 0x80111500, &(0x7f0000000540)) r7 = socket(0x10, 0x803, 0x0) sendto(0xffffffffffffffff, &(0x7f0000000080)="120000001200e7ef007b00000000000000a148e9d00bf9e6a91c218c2d8eb0667a937477be5b6941db5815d278cfb174b8ca6f27f0f32146495f219db61577fdac0492fbca0aec7b75c967436435e38a7ad5e3", 0x53, 0x4040094, 0x0, 0x0) recvmmsg(r7, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x96}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000000)) 47.59144227s ago: executing program 1 (id=245): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) (async) mlock(&(0x7f0000314000/0x1000)=nil, 0x1000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 47.542644205s ago: executing program 32 (id=245): openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) (async) mlock(&(0x7f0000314000/0x1000)=nil, 0x1000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 33.982463301s ago: executing program 3 (id=490): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x165142, 0x0) ioctl$HIDIOCGRAWINFO(0xffffffffffffffff, 0x80084803, &(0x7f0000000080)=""/239) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000840), 0x0, 0x0, 0x1) setxattr$incfs_metadata(&(0x7f0000000080)='./cgroup\x00', &(0x7f0000000280), 0x0, 0x0, 0x0) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='cramfs\x00', 0x2a00000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f0000247000/0x1000)=nil, 0x1000, 0x0) munlockall() madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x19) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) write(r0, &(0x7f0000000400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a4", 0xfffffcf1) 33.885213241s ago: executing program 3 (id=491): prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) sendfile(r0, r0, 0x0, 0x7ffff000) 33.877298142s ago: executing program 3 (id=492): mkdir(&(0x7f0000000980)='./file0\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x8042, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180), 0x802, 0x0) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x14) write$UHID_CREATE2(r0, &(0x7f0000000640)=ANY=[@ANYBLOB="0b00000073797a310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a31eca1a892f0230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030001000080a60d0000ff0153dee10e8916cfaa31d1aaf055d5ceee7009c3cc4305cb698566a8d4ea49cbbe10f730ed9d374f8e7d6ab973f0c075a6c3a57198e23c0efd7ed095ce5c2201c7f05ae7e0827757ff3aafa2d5c08cd14b6e3b4ee83b3e6468222c322bfbfa44166400b269552b4926a7f19b66c7bda0f056a4db37bbb64857b83ffc911b"], 0x118) r2 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x80002, 0x0) ioctl$TCSETAW(r2, 0x5407, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000580)={'bridge_slave_0\x00', 0x0}) open(0x0, 0x40080, 0x1a8) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000380)={'team_slave_0\x00', &(0x7f0000000200)=@ethtool_sset_info={0x1e, 0x0, 0x101}}) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000000)={0xfff}, 0x10) write(r4, &(0x7f0000000180), 0x0) ioctl$KVM_SET_NESTED_STATE(0xffffffffffffffff, 0x4080aebf, &(0x7f0000000440)={{0x0, 0x0, 0x80, {0x1000, 0x8087004, 0x2}}, "cb31455c9ea4288a70a2a6bb8068fd95dd041cf5b177a3bffe992dfbbdf959487337b92336ce1de32e7695c411c0bf9f852d2d71192f33001fd51f5b396a55cb98699a09d21648c4cb30d9d7e3e397c7a3c041c76c72385a46c48c5302848c3696facce956952c2a85822ddf20434ccee5806294ed563ff3a972cddf6ef16ddace933d8a5adea40cd3ad40c9873c29368838e815ff59723519154856b2d5cd9cd79a97dc2fa08dada1175817886e5f9e7aa3dca783a44c667a4806826570ec6acb57d65efc313a384e11fb633dee17ee600145f2cb3103384606140021be766fcb7fa029f0513bbb466177ca1068192550bbf4e6f5694aec747a16e27688a988fa595bca1761b8e88a7dbcaeaf97a8b7b53058b1faf880dd6f1b6eb4c7beb0582b4007f1a67db1352407adbe1456bf762c94fd825b9419d74f63cdeb6c6976de1890d773f0c8088d2bd48a838cf5b87f5ddf926352960fb978874b0f175acfa55ddfe84de3fc9f75b58bf7a35f33d3c43ed5e3224e92751fa1b43f94f64b681163ef1360a3f3bb7403afc67a188b2104b45c5814aaa9e218552498bf85f4b221d9acc32a331f5f8c109cc9f335ff4e418ab30b54b99d5376cd928c431fc8211fcbaf64716afdc4b6d0417e04d5723e4675d282b36bef3a3a19e855029ec7c33830a6df19332b63e9d8a0f22d96ac230c67657a4e7f7afab91dc0ce751b68980e5a4f6d9d6d9b98802ba9d8576640eea61b8c308a1745df61560e56108bececa3016d93246fdc8b768634e8319b1ffde103c07378f8f4927baba05e992a4b5af0958a7e495e7ce53f7917451d15a963ca14f5cdc4563775688b6533a4b97e0f84b0a33c30077b20805c1f42cc7815efada97ad59ac486bc9e0ee386b49cb97b47fbf8f919f06c75a49636795054b5ebee3e91602c90d7f4db49220affe56d56b96e4f662b2bf36dae482ffc7ba21cbc55e21b73309d6b7aa5509defcb77c236e43b579c61eae5c8d8f8fa71ad876b96069f2e4352c8aaf16e299d21edf5434c0cd9b25cdc9210fb0de759b1dd3fc7fe4c7118bbde72a5617dff21f7a5036448fba7fe41aaee0c289cd076d757e47b0713b236f6f141ba0112c9312b3ec853aabafdf1eb2cbb517d2d7352725f557214d27d9a340af0128fc960a4ea64c933b0d8dd226b6e024471aaac8a7074b2a8695ab990fabba5bf315d246fbfe4260f1fffe54814e33b6235c5b4095437298858909bcbd40a8a286d1bedb06b7b1775bce0a5bca19b0a5c2fa8dbf87b55ae0a43c5086422e5bacb94047e150451f5996420b0d4a697f59decb49900b2b9c13aade536933e14d672c21a35cb68572c3de02f3147414eff4b8674b91f7aebf35f056a8d388f67f8ef7cfaf6b28fe745831ef41def1839791647016932c70685752851327f1837d2f1e9d8f93443eefed2317119c8152ca451a5d3aeb253fb484283f52e5db9f61f059ad3c217a860ee0571d254483501b00699208c7fa5571cf58b9715c954115bc2db0af28361938bb95ced7370c8cbb6141ef62fdbf369dfc4eccd98ab9886d79a52cbf91a27dd0f4b29940492e860fb94654dea54fad6290570760e3b59a0cf28053732472dc313b5fedfc583fc702a880971dc61286370aaf167810455cce7654dc4325a41d9d1944abcdc4d81378f1e96a8f94cd95b886a01f086e379601504219d57d531ba34e1ba0905785fb629c61f6b940a652cdee9dbef12b7fcde087b92816db3386a5769049ba00788e31de4ddbb8b56de1fbe3a5e671728effda7cfd0b650cf5df2faf22470812efbbb548e47cbf36c64e05a7877820f08948ceedb35e12a4a143ee0101a7bf0a00a4062b50c39020669700adf739a6f75352a45fd1373d3e85c3867170373f0c7a794d8590f4c22ae62d438ec365b076a15cb2ffe0fc6f57185e1760761bd4370027c01dfad0502f00b6898115df3c530d0b0b4a64e623fd580b528a733e4c881cf5843a975a97f92a7833527887c79fa8eec82b9526a15c6c5f2972083ce8aec735810580ffa4ea2cef4823aee044dd70927f7c07bba18b930006aa86ae7399ac6b4c24bc9d6a6ab0c5b428d7255d4d983eadf97e10c1b00867da29ac981acb453073a37236e7ae808e7759b2e0cffc3ec43afb1e95cd090a7d4b9225a0e3cbebfe49b93846ab603891e2da7d85a04bf42d12d16a97c965bc4911d3ba7a9ca505794d8744fef00a436089de67aa8b480070230dfb002eb91edaff428d4908a87afae418dff7ca59aefe1ad8f6935f309fe7985c2310881659c60a66a5e50242497ba1cd5d2bd79496ccd23f9fd901afc6622829cb3701caa50f96e09e3b23bfa3181b74ec7dae2e42c9caab43e49ae1d922a1a1eb3682de026323d9215fcec42c54401a1af81450830a4b784ed1c7922734bf3632409147680dd3fabcef296353705bb5c0e650e12905a05db1e7923923a96ddc783fc1ed46e2010416c37d9d149ad73e808bd6e4464f62893024a8501803b6c88fc55c8bbc1da7cbf580b5a81fb7c61455ae3a8aaec303fba12e0f2b51ed5e8bd31db40e8bdbd00e7b1ddd364766c974d813d86fc88a27bf82bba60c62e5f0f6af6bda3390f8e72a2811baf3d6325e70d9a3b59cab1abe95290ecb87985567e1243504c038de9d4d100ea64eec45208cd8d2474e646f7d81eed6d59b8b0859552b6fc088d874cde3e75ee30243dc9d88ed5b577851a5bd9e2a453287025777fcac19ac33e1c94b4ad272f1055b16b842a6bd6168fb45f1f74ed2467020df5431068a5f2cbeaa6ac1841308c7c9f752aa06927f91fdf18ef9d9e942367e5ecac0abf4d3b8fc7b80238c0e7faf2ea7d3f5271028fc558a44799bde63168becc67c5531e843336fb16ab618d37f95a91937b824bf896b044146bc3a5e264a8f23ddd00729cd9aa56d9a9a24b7ab96ae021b193d8874d43ff4b723d86b7564e550378599c3e0c7a2b3d447ad76eb4cd699733d970a5ab218429a1af81df9c8013d6d16a6bcb019f6ace4461cdaa785d20ea027cfa53d521bb91ad2c04aaa6c0f268b14924803977633280c7b7beb14c88fae542b7a13e96253259e7296e37276da88891c14664340e84ae732edbd71e67047e476735b220ca231de31a380ece372db632ec3cb3ef5ac97ec41148febd2acb15cde1ee5e990ea0aaa95c2df39e2111dd1185d14a194e22d34fda8f54e99d3a73e5a231682c726d40816e048c1d059bf3bb9ee2b5f895365d95aa28f6adbf6e16469926b4d8ee7f04c7dbafaa444df5b88596c17874f0efe35e5ada1a69634f4b430f852d33b032f823c5deb54f47a7a4adb1adf56d5440b7a917580004c13e0b36c8e0a203a2be3f8fffd9efef3af19389a12c67859d4381ac0a02da18e25931b41216b731de25e1245482c84d45de1cddbce2109322a3428bff692012573fe9efd02109dbf35c5d3a287dec105cf3f1a2e5f0b1cc08c7b4759766d25d0f7b42c3ea8bf8101e61159a2ba7602e9c7947cf936ac39bf59b24084709fd61d704bbdba7d282aac778b7ec1dcaf984527c8112d56e75ab774d1598d9816abc77b0e693880beca5f330c626774ab5cb6967fb0ea8e14efce120947092c3b6f8a22f07cad22e971418092481fcad36ecf0cfd6bc3864115b8507c13554584f1f6fee5ee07eb6a091638d8e7781c1c006166e0f987f9f4de535e9f3df1db8c9328e9a19a73c76059ab4edfe9eda7f16cc6b869229bafb179d194e20ccc6f9338183b673de8138ddab9a0907278f6eaacc55bf59a450ebc10e0b88c82d9f0deca86ff771f46509250fde94e0c94256b77616d099862ddc9b341838d634a9dc4b55a88fcc6248901135f6aa76365433e7e534e0e5ae8eec2a63df62c3e244a40481189ff54122698c7e2da2c829b2eec9efc9894ee05be04ae6dd48406eaace17827e38bf38b414059aded0343e0711a8d864ff41a8d9ed40fb2aa1a3f4014f691cd0e8af62445a021820ff03afa8a192ee255862f306851df1de96ce36cafb6a60b7069db7aa96fd1ffb2fb01e6247f770304dffe4b1c8d0eeb336dd6806d6ab5d418953b1cae7cbbf53766b61e4aad5cfce8255b78af26f9bd11283a9c7d12cd63b82cd2b506fd4061d1e16fc7c713d80763c3b0aa0faadcd9b7d676101aad80e1ca00369297e1f714003ab8d0b545c335014a522a25a767950963ef821425b79b521076166d0df3ef358c7d60d99cc85463c186e8faf16af79785680382e4cc93f6594f8c4461e0988c08717640df24a5f357db22432fcae21702dc792d201212fb3791e0164bb3d433a8268ec96df73766fdba42965e00e619246cba5d96eb853a7c22c34d2fe5e5d3f3ccf9c627d069517b743cd07f6f7b444074bb9a50269f2e03309c58930e56a9583eb00c37fbcdd391972261f41756c10c8899fcd036e2017e088ef9e6ec31f795d55b3bba214c53c98fc9318e4ade0e7e6fd259aa277fed54c27e5210787a5f6937f56fdbe1da5113f059061ca590ddf536a55cb91ac6ed41cb9c0418b115b29f5e823c1b0ee7c2b3982087763545b34e2c945d587ebce69bbe299a7f52b674f351977370fc700474bc15d7e6ef98c14258ecf401a4f3bba1a9aa76c5ab0b8819fe6efe3fba1899909e5e48554299150ee272451b56142d12ae2bb4942db430239701d494917f2c939a6fb9d98d4751a6f2c4537ec870342d223343a9bd7b8d8c99aff8cbfa298395551185f35dec120228073a1e496a58b59d9ac5986249a7c6db9398395cbf341c08ee910700e2daa042dba1846fef59c72ce872bba2046a14fcf9a47a5686d62bfba76309a9865c26e5fa41dd872fc749fdc57953105ace4978f9eb788c8d061c853ad0313e51e732c5d7bc05e752443c8e99b8e81c688befdb5b14c3cc2f96eb8ce8290303e483992fcbece1ff278d0dc036ad437b6cbc695c7741ba4556e242146d40843c73deaf8fceba40e4a4acd739b3031848b17a210a1ff0dc1908b77c4bb94543af52e1fe2a090c8f217428d02336303f7952c3ddefa7c81850676e7f4cc3d32c3937281fa5ab279c3fe39f92ba077dadb8c2c3df17cc511bd33c41cb161d24aea154f0f5902c94b56fe072d321a983668bd9f4838878e66ec44cb233d7d0ca908a794c844ff8b3ba4c57f6c5fc2f3a54db448b013f0c4998bbc6ed0409b3368391cb28c6df4a909fff90f308ff38c758ff7d8a2920bc221236d89b3b76de44e8ce649b32f5135a0217ba9036a8edddee97d7ba15f2c21fb7d3cae3eb6ef09dd03eed650489c83b5ba5dd9daf7a86cf0544fb8a58e46b860e3e42e10cd6f1c4f81179eb2c3ba611793a32abb4c0768db90e8bdd1694efaa9c2b45c89d203fdfb8b926b6a0d666d91b93065a83184fc2065961f2308056241b66f427c0f0aabc75852c90f0624cf036d537032ca8d73325d2ae2a79a7292c240c34584bb881fe5d468a051cbc0bde061f9eddfb758cd2dfba296eef549e5c4ede097111216a0ec60f90e8d6f5dd843c82e15f505f8c74e854ba9cd386249d552978eb8135a5f8c79c3ceb8dd5828b0218ffe40f375d6cf3ff2f47c276c8169ab98336582a852c1535018fb2306aca6b8c9f9e38d64c66a722762b76c69d4ca6c14bd6992549e4eec17287fce194467f972d9200c3d1ac4fd4a8f2620e2e4281d28c099946ed90789ba122705326390d3e058ceed24044e542efb36416272eadf6304f30efa0b7bc1ae5be92fe50e591ee6f725726e917ec113506920beb2aa53b39f1d76b31500", "cfb220c7d481332f3f1f8079dfe27e23185fd67a407358db7892789f96b7fa9b14daa48617a10d8a91b820ecbaa470ec0bb1f3cbce7f70ec70b19a4cad082229c2788f8611d7dc306d9a45761a97828c36ed87ebde5d4a3e1609c1422a8ae2f7cca428ebdb0dd38b90b9598a353b18a600bf35a369e6e3e5abb0a1c5c0c0e48e014e7ef1b7d768b3c5657f1adfbb7ff2985082b16c99eb83ec3660990dcf1106efa6b7f8a4798fec811c2c85faec0235c83b7093b3d02367421abc40a554e0b0d7fc1bcaece4222c594f8d20e368fe625ca433c75486fe5c94103cd17291349ee12b877602936688666f82ecd8f4f83d50bb1650e08b96cd25ad147c4c956c98649806a3736d070f8d97c6e3a46a7c18535df8d828b86662400d8e9cc861fa1dd5dc193892d3168396c499e07b279fb76c7e289f2fd955691363bc1de74536dc571817615c88b0d594a136966c129e424ccb7ef1c7c7461eac7ca5f03d72ea4c9c3d1156ee4cb1bb70e097357588b5c49f6716bbae1bd118104b42786f09a3b9f7cb80f383cadfd0c462096ff2bb637b7cf79764b6a4b7ffc5d87c1f063fb48e7f08ad5af534c70079f12f28e8921abbd4280801cdf6101ea494768b1274afd0eea5939843d56022a83590920fe446d52dfe699c33977d5592dbf7e0e236b8175d7faae06e0c50f7402174023ce4b996564e945c416fa823f2f9c3213ac50b20bd1fd55bb8d9fe70ee31ea2f404ae0fcbf857bebcc9196c8c622059fea2e248e4058905b69fb98be312d3193ea1d8ff653173e8c2371371b77a5bea45b3cd6fba19b6336f94ec04c8f86d24e9ca959874577d7ca0baf3c4ff30b554bc3ccc06df46d925373fbf7863e2cf684d3bc9603ab72b851ca4728294de87f2dec6f23ca9e43ed2e5cbba662d13137fc1ce0f6ae6aeb974f72f4b750825fafb67715e425f40c7da83b92d4249a0a4e96b789cceb7b07f38cb83f72dd093a345ab3cb8ae760fc14e40ea182a0d7fe1facc62a1ab0902349fd7e27bb0cd349fb5053f4734823abf020739b4b43bb11f5d69b00295068df31177959903c2ea1bb82d24eeaa93d0d4738d5d15b2a401e7ebe0d3cfbd45b2db2882cdb41408aaa718f8320fbb7f9da4f68d0eebeef175442e807e9908132731fe5e268582dcf6dffa4251ebb7121db8e412089fa9d8af9919799547a26b6b8e944c28f1ce5f9a3021fe30841be204c1b4b3813dccae6baeef9b53fe413cbec46bb0cd95d3793cdc9bfe6cdd96ce0c4aa4a25e1cbbee31d07b125bac68d4e1f4253bd4dc7824cf3d722c94cf2b8f61bc8155731f072fd447082b181a13ffb8c08a1d568298c5de2d969fae2bea070a9e2688f294e76b8c200dfb993ec19778eb56ae3127c1116ccc85ef8806fdcb9ee0cb66ff03fbb0fa6c52b9b101b3830fc1650efa859163a264b4059092e5dc9a415ec09bfd1460f142fe5ef00beb6aa9032bd0de97aefc6f65e8cfeea761b3d8174caf528b6627682ff4d4450cb0f34251fc000ed01dd538ef13260984f44703b89dfb511bfb538d0b1c8aded964e1bcc5ca57437468b14a31ec0000a17e4d24369c40500449c37e7dccedba3eceb59d827dace246b5c48afb6a5988e64c560b3dc4364ac8b25372b87c92bacfedc6bc8feb44098dbebc89cda03c59e4c58a31372bd574704b9e788834b9f83c6703f6709efad97c4ce499ea580dae1de282a019247cb3dce5c1906322e6d3ca5157ea6428bc42416936fac194efe136089c07faf7adf1e923003f1dc63fcbc634b389a4f351a6acee785e23c6bb04ca2f265be1e634362b87c6f9fd369bbe62a1db6b286c7ffde6370bb4d6e9e27c3ec451e1299d134726c9075e71319d3a683e91e4b900061c0e6d086481069cd32f4cde7816f8e3a0ac6428a7488f31f06ee0da10df3ed0c150d29085879d064f914407f60018bb588735663647bfeda930407d69abef3f72fd461c2b85b00988b412a180fd267fc646a86d297e7e40912607157b6fa873df6442579b1523d8117f0c06c87adf75843b8bff30a5bfb4fe1e9846b7fdd58774641baf9cc9c4e38e53ed24a9d9e9dbc7657aa9b220a8545852b0409f5c0812e953823e841967bf55059acc7a40000000000000000fae0d04a0738ac8acca133d6395a455b22cdd6f901d4cdea1cf17415f7d7895a4b65f80d2f7c5c60a0dc04b40c9ae5ffc922e074a82afd704673e1766d19db9f60eab0238fb4a3169a08aded607847e5d7a3b1c54e1a602cabac3892bcfc2076f16a7f07583f0d418b9dec03afdb2e93335a392e1b1ef2910eb2a4b6a63fe61641f3c02bef73cd7e4a77a6f30ae821598c3160511603541bea89022b54f321c2a55cdeeb19335d78a821ab6ca0f36588a9a79a41e2123905a491d658c2a1caeee998c995bb0f816c92c5dc2b862183f80b9f9786c9c5524723c944d11f6894c7f008ab8194f577e22c03631d2a5f508ea49653e7600639242dbaba704f700ac227f32dc575c559a0a1f4fe0cf6c22fbf7e1ca2ab4b1e4724e8379021e3c9a7c1509c6a413bd7d9c98938e440762eda2546d636597defa86c1ad31126a1182d365f858927d140fb0a97f80adcc5f4ed5efe11ac503453917a263f1d64692348d30f382e85e464ef7616067a42df5de1a1b622fabefe2ca4ceffa4801f7a02fdef40644cd1d079590d900727628d54b44db7ac700d8d664f7eea12837fcf347360d8e43a354fe51b4c49e8fcda3c322b738ed2b800b5cc06e22c72af2a67ee7bc8ae894e841f2cf2b0a7e381caf944bf4e91ded63b6f82f7474e4f81e986fff7e5339b8e9f60103a1af81833e120f0c88893ecabac044a4a2867cda4fdcb084459a00507aa9e5a8e761a72df3322a1ae8cd918b4994c23bdb1e459b4f21651bd7fa067a00e2a2877bf6b29f289ed8018e0a78f6fb4ded9749640e0e37f6381b320ab72da404f3d70d60152f6fa6738932387b83250cb3148141edb52f109bfd4bda8054959db01f4c550609a63c08cf01ecd110cfc6f0055638c0dde039d2ac2daafe59e561f9f08a8830c3f661e4325de63e98f4a4216ec3b83fd200201ed3f647147611424286ffc6c4a8aca64a6874743242d4feeaa9153de06e51c512d9cab7ae712c6424069f3e5db4ddebe9b48b5f6caa741162edf97674d2368e03a387f798151a4b9b9fa9e3a5838a343133158364a9fe3bb4b9a3c464c0c54a4c64ca774ad200925ac6bf59508c10a8574afde9b821741af43ec64cedc13aa220b39772195283506dfe899dd6a7b37eb21f154056a2df3564ef2bb918a928651de88c3613b84e7960bddd7b46b1304deb30f57b6fe5a3b4788629e91bcc2456a72fabb16b47da71624d2e9081de748b3387f52da4bb094782326dcfde0827e2d674e41bb375247d749cade9c704e5431785009b0e53f1b45c70b237c9432e07e4c7a8464ed11608a3d2184338dd9e6f6ef4b3d751e979667b6a3953c89aff4eead7a978071a912b3de21a85a5849c57933cf53cd74a610f3e60f699766fbc7e0bb8a891a429c77bb6f3b6f9f8eb0b1bd9588ef2ce98fdf0a0838e4b0bed807d8b673093c717feec8d697e32542274887d039db7a2daed5d52c8e9767443229f8003c5d67e907376ea2f393484fa70deee159cb56f8d097b8fe2736e95f540137e20725f0940a8d049068ead4c46bb3771a671bb00de88931e03445a55868de0c220db05cbda9f996d5fe7c1070efe5e718fed4d4cb4ecacad3d6b643bc0ffe9a71b720ba7b5adbbdefe29106ef6a6ffe4547f5d02bec312147df0abe80efb2d5e598fc7c8b268e58b59e0d75728e9a18126f013c963ddc92d251405f857fe3a5cbacf443be7772975b7bf4f6d7ed6f80dfcc47a88c6d19120942adb5385be6ef3c0d7e396bcae5affc8f9276d6cd1a0b069aed72a98cde8ea7aabe6cc091b19efcfaf9368dfeb3087a05a42e3b893dae5ffeb72e6ac06e995a2a75ea0b5f7876247bb4c38cf3f0153f1f7473b522f1c440b632270e2b1d654d3a5ae16c546c482760d34ca79c8951b29c628e21029715683a3e6f8f77c5d89ecdae37e0190f79c4c1dbc9d0160e359cd6c94d6662ed53bb01a83374ff593c823acc59241b11f020902069fc0054a9b26cb320bef4fb1f8cc5bd8ae76eb029afab731b9876bc4e8708a8315512823cff1f9375d284ce66e53d4efad6c76d17bb532fc938b8f80c13ce86b5ba3e540164bc5a5d47cd321c241d8740f453ef95bd3878d578561ad6ce20877ffbd44062dce8df1d048d8d5e4045be647886108cbb1f0b26a8b74b66858afedb830a161bb02bde4c46a688a0ea3a7018ce24666aab0f422ede2f78ea29f77e28d87c744cba0285ce33d0d9ac45774829699de6d725a9b6db6e7d03ad4ec9d075c386e68ca0bcd9e9911d741ed0168cbddb87a7918a964d206629da4e887277b0ef7d3f9c7082f3f15f29a0dfb39f3b0877a5ec3ac4343e0d808f5aee8f1869923aab6dfc3016821c013109f34aece6183994b853d0e9561375c02cdd26b1b55194757341929a8038864cedd6b5a3b8b51ade44637044c4ebddb190f173969a0ca4cf5d42153763a0b91da0110ae7a25204850927d81b00176d4568a3d444d8029bd010df784e3f673fe855601ec4f1b26b2df58841e6a65f0db66373f63cc14a8b07dfc52ac9957eb542d05ed687c79519609de96df18b63cb294b534ddf7d2e8f41bcc1e5a006191c4db057b6709f0a96f18e7e8f67b8be2a19c015b9c4b0b3f42e4de366b71f8da8888809473c3c7a02a1158e375f29997a43bc7118ca4d1abb8f8f21972fc589aaa3d73a4d40a1e1705e169ac6e56cff50d89fc45b6863c8fc67bb2b5939a7f33072539ba4c24077be5711ba368bf7efd4897931531d388eb5c2e56bee337777150dd59518652145c9594e110e41d2615196c6b197916c88cc2814e13a3a922b4ecb044bf31cc90e0bfe0ce07de29188bbcb0ec1a12b509f52582fbb948c3cbe0c6964f46991cec0704bfac08aec6ad8ddfc36dc68c7f547c5ee6af4a8d55c79e3dc1c49b045379811f81e9a185a92cd37ae4ee32c5d3c82d36d6202a6c84fd231fe467071d42072827fd77afa5d757e6f37247f783ef09bdfd7536b666e84bc4bb878001a84fdf8ec2a8fea0272dec844f4ef0e934617c08518bdc6b915ac6f3f03e4a6ab88e21c3f21f93b31d95ea3b9228e0031cb69795de5abd19c4cb4a0cf2984e53ca391cc66e33ee0d510151670331fa264753704fea5e4b1760f74890c49a74a47e0da13155c5470013d53dea0f05b5e088f1511c209f5be940232318af2757951d399e32eb862d915784713baa8ba93645caf04ba78fa3cf600ff92b9c5be58ad87438a340bac00a5ea9fb17e39478ba61fe36335e48d8c5a0b25f024cbd2ec7f217d0f260951da396dc13a2a74cd90df4b52db686e3b34d27cfa4cebd7bf59cbcfaf4007dc943a1da6e0bd1799a21ab449d7bb42935e50c839c5b567c59742436af15bc8d46095520dcd9273ae2b6f3c1cc2b4311ac9e5d297f0940b1552c5955adb302022022bb7457978998b56328629b7725dfbe3dedb37f37af0697a4471d1d6ff6bec633a38540adeba903f3eaaec5785fbb3c6a598f49dbd9ff93c67dea1ef39a614331b119fa8efccc8bac01595fb95a2a57eec9fc6c6fe82782aa89ea971866fd9a3bca4010182092ab6d1e2b49b964be9e3bb13bd6b77850e435f55bdd46e5bcb3330c7edefd31c33f61275e51600"}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, 0x0}], 0x1, 0x60, 0x0, 0x51) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a"], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e000000030000000000000405000600000000000a0000000000000400000000000000000000002100000000"], 0x70}}, 0x0) sendmmsg(r5, &(0x7f0000000180), 0x3ef, 0x0) fallocate(r0, 0x1, 0x5, 0x5) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xac000, 0x2) getdents(r6, &(0x7f0000000200)=""/71, 0x47) mknodat$null(r6, &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x8000, 0x103) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = eventfd2(0x6, 0x800) io_setup(0xf0, &(0x7f0000000080)=0x0) io_submit(r9, 0x1, &(0x7f0000000040)=[&(0x7f0000000100)={0x1802, 0x0, 0x0, 0x5, 0x44, r7, 0x0, 0x0, 0x1, 0x0, 0x1, r8}]) 33.818631217s ago: executing program 3 (id=493): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x2082, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000280)="db", 0x1}], 0x1}, 0x41) recvmsg(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x40010041) r3 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1, 0x5}, 0x1c) sendmsg(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)='+', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x20000850) read(r1, &(0x7f0000000040)=""/98, 0x3a) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f0000001240)={0x2, 0x5, 0x0, [{0x7, 0x1, 0x1, 0x3, 0x9b, 0x4, 0x0, '\x00', 0x100000001}, {0x5, 0x88, 0x2, 0xf9, 0x7, 0x7, 0x3, '\x00', 0x9}, {0x7, 0x800, 0x4, 0x1, 0x3, 0x1, 0x6, '\x00', 0x1000}, {0x2, 0x0, 0x7fffffff, 0xe, 0x8, 0xf, 0x8a, '\x00', 0x7ff}, {0x2, 0x80, 0xfffffffffffffff8, 0x7, 0x5, 0x1, 0x8, '\x00', 0x10000}]}) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_CONTINUE(r4, 0xc020aa07, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x44, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffff7fd}, 0x0) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_SIGNAL_MASK(r5, 0x4004ae8b, &(0x7f0000001140)) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="02000000010000000000f400040000000000000020"], 0x1c, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) setxattr$incfs_metadata(&(0x7f0000000180)='./file1\x00', &(0x7f0000000200), &(0x7f0000000280), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) setxattr$security_capability(&(0x7f0000000080)='./file0/file1\x00', &(0x7f00000001c0), 0x0, 0x0, 0x3) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f00000000c0), &(0x7f0000000100)=ANY=[@ANYBLOB="656e633d6f61657020686173683d7837cf6df36836340000000000000000000000000000000000000879833ff4e8ac680000000000000000000000000000000000000000004021637733da26d800"], 0x0, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) getsockname(r2, &(0x7f0000001180)=@sco={0x1f, @fixed}, &(0x7f0000001200)=0x80) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/4096, 0x1000}], 0x1) 32.98268202s ago: executing program 3 (id=496): r0 = fsopen(&(0x7f0000000180)='debugfs\x00', 0x1) r1 = fcntl$dupfd(r0, 0x406, r0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000002c0)=0x20) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$KVM_CREATE_VCPU(r2, 0x81007702, 0x2) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fchmodat(r2, &(0x7f0000000080)='./file0\x00', 0xc6) r4 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x1a34, 0x802, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x1d0, 0x5, [{{0x9, 0x4, 0x0, 0xd, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x4, 0x9, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x10, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000180)={0x24, &(0x7f00000001c0)={0x0, 0xe, 0x7, {0x7, 0x22, "c45c64d30a"}}, 0x0, 0x0, 0x0}, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r6 = fsopen(&(0x7f0000000000)='ramfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000180)='rootcontext', &(0x7f0000000040)='E\xe1\x85\x00', 0x0) close_range(r5, 0xffffffffffffffff, 0x0) 32.47021657s ago: executing program 3 (id=503): r0 = openat2(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x10040, 0x40, 0x26}, 0x18) mkdirat(r0, &(0x7f0000000080)='./file0\x00', 0x3) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f00000000c0)={{0x1, 0x3, 0xd, 0x3, 0x7}, 0x9, 0x80000001}) ioctl$BTRFS_IOC_BALANCE(0xffffffffffffffff, 0x5000940c, 0x0) r1 = openat(r0, &(0x7f0000000140)='./file0\x00', 0x109000, 0x40) ioctl$int_in(r1, 0x0, &(0x7f0000000180)=0x6) r2 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x2002, 0xc3) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r2, 0xc080661a, &(0x7f0000000200)={@desc={0x1, 0x0, @desc3}}) fcntl$getownex(r0, 0x10, &(0x7f0000000280)) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000002c0)={0x1c49, 0x4}) ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f0000000340)=@arm64_sve_vls={0x606000000015ffff, &(0x7f0000000300)=0x4}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r1) sendmsg$NL80211_CMD_GET_MPATH(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x14000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x38, r3, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x811) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f00000008c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000880)={&(0x7f0000000500)={0x378, r3, 0x300, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x1e}}}}, [@NL80211_ATTR_TX_RATES={0x318, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x58, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x3, 0x6, 0x2, 0x3e, 0xff, 0x3, 0x4664]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x7, 0xb, 0x0, 0x7, 0x7, 0x65f, 0x7ff]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xc8d, 0xfffd, 0xfff8, 0x85, 0x2, 0x6, 0x5, 0x957]}}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_2GHZ={0x88, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xb5a, 0x7, 0x8000, 0x9, 0x8, 0xfe59, 0x100, 0x7ff]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0xfff7, 0x2, 0x40, 0x2, 0x7, 0x102]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x6, 0xd85c, 0x7, 0x401, 0xfffb, 0x7, 0x2529]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x2d, 0x2, [{0x4, 0x1a}, {0x2, 0x5}, {0x6, 0xa}, {0x0, 0x8}, {0x0, 0x5}, {0x7}, {0x5, 0x4}, {0x4, 0x6}, {0x3, 0x4}, {0x4, 0x2}, {0x1, 0x6}, {0x2, 0x8}, {0x1, 0x3}, {0x2, 0x5}, {0x5, 0x4}, {0x0, 0x4}, {0x4, 0x3}, {0x2, 0x4}, {0x0, 0x2}, {0x1, 0x3}, {0x2, 0xa}, {0x1, 0x1}, {0x3, 0x8}, {0x5, 0x2}, {0x1, 0x1}, {0x0, 0x8}, {0x3, 0x9}, {0x5, 0x8}, {0x0, 0x6}, {0x1, 0xa}, {0x0, 0x8}, {0x4, 0x3}, {0x6, 0x5}, {0x1, 0x3}, {0x3, 0x9}, {0x0, 0x1}, {0x0, 0x9}, {0x5, 0x9}, {0x4, 0x7}, {0x3, 0x8}, {0x0, 0x1}]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x74, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x3, 0xd, 0x7, 0x2, 0x800, 0xffff, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x998d, 0x100, 0x238, 0x5, 0xdbb9, 0x5, 0xe]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x4, 0x0, 0x55, 0x3, 0x4, 0x6000, 0x8]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x39dc, 0x1, 0x4, 0x2, 0x400, 0x4, 0x4, 0x1]}}]}, @NL80211_BAND_60GHZ={0x40, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3db, 0x4, 0x9, 0x9, 0x0, 0x3, 0x8, 0xfffd]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x10, 0x1, [0x1b, 0x12, 0x6c, 0x6c, 0x24, 0xb, 0x16, 0x59, 0x1, 0xcdbace0506bb62eb, 0xc, 0x12]}, @NL80211_TXRATE_LEGACY={0x7, 0x1, [0x16, 0x6, 0x36]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_60GHZ={0xb8, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x13, 0x1, [0x12, 0x30, 0x9, 0x60, 0x6, 0x6, 0x1, 0x48, 0x36, 0x24, 0x48, 0x1, 0x6, 0x0, 0x10]}, @NL80211_TXRATE_HT={0x38, 0x2, [{0x7, 0x1}, {}, {0x1, 0x9}, {0x5, 0x5}, {0x4, 0x3}, {0x7}, {0x1, 0x5}, {0x0, 0x9}, {0x4, 0x3}, {0x2, 0x8}, {0x4, 0x8}, {0x7, 0x4}, {0x6}, {0x7, 0x1}, {0x4, 0x7}, {0x5}, {0x2, 0x1}, {0x0, 0x6}, {0x5, 0xa}, {0x5, 0x2}, {0x2, 0x3}, {0x2, 0x4}, {0x2, 0x3}, {0x0, 0x1}, {0x4, 0x6}, {0x1, 0xa}, {0x1, 0x4}, {0x6}, {0x4, 0x5}, {0x4, 0x6}, {0x2, 0x7}, {0x7, 0x9}, {0x1, 0x5}, {0x6}, {0x1, 0x4}, {0x2, 0x1}, {0x4, 0x7}, {0x6, 0x8}, {0x1, 0x3}, {0x1, 0x3}, {0x5, 0x8}, {0x5, 0x8}, {0x5, 0x8}, {0x4, 0x9}, {0x4, 0x6}, {0x6, 0x6}, {0x0, 0x1}, {0x7, 0x3}, {0x0, 0xa}, {0x1, 0x5}, {0x7, 0x2}, {0x0, 0x6}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0xffff, 0x4, 0x8, 0x5, 0xfc0, 0x57f, 0x6]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x0, 0xd2a7, 0x8, 0xffff, 0x3ff, 0x7fff, 0x40]}}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x48, 0x48, 0x60, 0x6, 0x16, 0xb, 0xb, 0xb, 0x5, 0x16, 0x9, 0x4, 0x24]}, @NL80211_TXRATE_HT={0x1b, 0x2, [{0x0, 0x1}, {0x3, 0x6}, {0x3, 0x9}, {0x2, 0x8}, {0x0, 0x2}, {0x7}, {0x6, 0x1}, {0x2, 0xa}, {0x2, 0x3}, {0x4, 0x9}, {0x6, 0x1}, {0x3, 0x2}, {0x1, 0x1}, {0x1, 0x6}, {0x6, 0x7}, {0x3, 0x7}, {0x1, 0x3}, {0x1, 0x1}, {0x6, 0x6}, {0x5, 0xa}, {}, {0x5, 0x2}, {0x1, 0x6}]}]}, @NL80211_BAND_5GHZ={0x58, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xfffb, 0x6, 0x6, 0x3, 0xc, 0x2, 0x1, 0x9]}}, @NL80211_TXRATE_HT={0x1c, 0x2, [{0x1, 0x2}, {0x6, 0x2}, {0x6, 0x2}, {0x3, 0x2}, {0x7, 0x12}, {}, {0x0, 0x9}, {0x6, 0x5}, {0x7, 0x1}, {0x3, 0x1}, {0x1, 0x6}, {0x3, 0x9}, {0x7, 0xa}, {0x5, 0x8}, {0x6, 0x8}, {0x1, 0x4}, {0x3, 0x7}, {0x7, 0x2}, {0x3, 0x8}, {0x3, 0x9}, {0x0, 0x5}, {0x5, 0x8}, {0x5, 0x4}, {0x6, 0x5}]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x1b, 0x16, 0x2e, 0x3, 0x0, 0x1e, 0x48, 0x36, 0x3, 0x6c, 0x36, 0x2, 0x4, 0x3, 0x6, 0x30, 0x1, 0x36, 0x48, 0x4, 0x6, 0x6c]}]}, @NL80211_BAND_2GHZ={0x28, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xc4, 0x40, 0x3, 0x7, 0x8, 0x1, 0x1, 0x7]}}]}, @NL80211_BAND_60GHZ={0x48, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0x9, 0x30, 0x24, 0xb, 0x60]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x60, 0x3, 0x36, 0x4, 0x0, 0x23, 0x3, 0x76, 0x6c, 0x3, 0x18, 0x60, 0xc]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x6, 0xc00, 0x200, 0x3, 0x200, 0x5, 0x8000]}}]}]}, @NL80211_ATTR_TX_RATES={0x40, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x3c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff8, 0xc0, 0x6, 0x48, 0x80, 0x0, 0xea, 0x9]}}, @NL80211_TXRATE_HT={0x10, 0x2, [{0x3, 0x7}, {0x1, 0x3}, {0x0, 0x3}, {0x7}, {0x1, 0x6}, {0x0, 0x9}, {0x0, 0x6}, {0x0, 0x1}, {0x2, 0x5}, {0x3}, {0x1, 0xa}, {0x3, 0x9}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xc42c, 0x357c, 0xa, 0x4, 0xa9db, 0x7ff, 0x7, 0x2]}}]}]}]}, 0x378}, 0x1, 0x0, 0x0, 0x48000}, 0x8008001) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x9) fcntl$getownex(r1, 0x10, &(0x7f0000000900)) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000980)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_OCB(r0, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x1c, r3, 0x100, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x840}, 0x48040) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_QOS_MAP(r5, &(0x7f0000000c40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000ac0)={0x120, r3, 0x800, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xfffffffb, 0x4c}}}}, [@NL80211_ATTR_QOS_MAP={0x10, 0xc7, {[{0xff, 0x4}, {0x6, 0x2}], "32d2af304a7b31b3"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0x9, 0x7}, {0x2, 0x3}, {0x6, 0x6}, {0x66, 0x3}, {0xe, 0x6}, {0x4, 0x2}, {0x2, 0x7}, {0x2, 0x7}, {0x7, 0x7}, {0x0, 0x7}, {0x4, 0x5}, {0x7f, 0x4}, {0xd, 0x3}, {0x47, 0x5}, {0x1, 0x2}, {0x4}, {0x6, 0x5}, {0xc}, {0x4, 0x7}], "9f4a6d03beaa326c"}}, @NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0x7f, 0x6}, {}, {0x4, 0x7}], "ab5226a9121330b7"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x2, 0x1}, {0x9, 0x7}, {0x0, 0x4}, {0x7, 0x2}, {0x4, 0x4}, {0x3, 0x6}, {0x9, 0x2}, {0x5, 0x8}, {0x84, 0x4}, {0x6, 0x3}, {0x7, 0x1}, {0x6, 0x1}, {0x3, 0x7}, {0x6, 0x6}], "eaa620afdb68d708"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xb}, {0x10, 0x5}, {0x6, 0x3}, {0x4, 0x5}, {0x5, 0x3}, {0x5, 0x7}, {0x0, 0x1}, {0x8, 0x3}, {0x7, 0x7}, {0x9, 0x3}, {0xc7, 0x3}, {0xdb, 0x4}, {0x8, 0x2}, {0x0, 0x3}, {0x2, 0x3}, {0x2}, {0x7, 0x3}], "797b0768cd2681ea"}}, @NL80211_ATTR_QOS_MAP={0x1e, 0xc7, {[{0x86, 0x5}, {0x30, 0x4}, {0xd, 0x4}, {0x80, 0x4}, {0x9b, 0x7}, {0x40, 0x4}, {0x60, 0x6}, {0xf7, 0x5}, {0xfa, 0x4}], "0ff4ffb9ddd14716"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x6, 0x1}, {0x7, 0x3}, {0x5, 0x5}, {0x0, 0x7}, {0x46, 0x5}, {0x8, 0x6}, {0x7, 0x1}, {0x64, 0x1}, {0x4, 0x1}, {0xda, 0x6}, {0x5, 0x1}, {0x9, 0x2}, {0x2, 0x7}, {0x1, 0x1}, {0x3, 0x4}, {0x8, 0x4}, {0xae, 0x1}], "1f33fcf58adb519c"}}]}, 0x120}, 0x1, 0x0, 0x0, 0x48880}, 0x1) getrusage(0x1, &(0x7f0000000c80)) accept4$vsock_stream(r0, &(0x7f0000000d40)={0x28, 0x0, 0xffffffff, @local}, 0x10, 0x80000) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0x541c, &(0x7f0000000d80)) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000e80)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000e40)={&(0x7f0000000e00)={0x3c, r3, 0x400, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x44}, @val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x6, 0x5b}}}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x3c}}, 0x8) ioctl$VFAT_IOCTL_READDIR_SHORT(r5, 0x82307202, &(0x7f0000000ec0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$VT_ACTIVATE(r1, 0x5606, 0x7) r6 = syz_genetlink_get_family_id$fou(&(0x7f0000001140), r1) sendmsg$FOU_CMD_GET(r5, &(0x7f0000001200)={&(0x7f0000001100), 0xc, &(0x7f00000011c0)={&(0x7f0000001180)={0x30, r6, 0x834, 0x70bd2b, 0x25dfdbfe, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x3c}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040010}, 0x4) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000001280), r1) sendmsg$DEVLINK_CMD_GET(r0, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0xa4, r7, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@pci={{0x8}, {0x11}}, @pci={{0x8}, {0x11}}, @pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4004000}, 0xc000) 17.55547589s ago: executing program 33 (id=503): r0 = openat2(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x10040, 0x40, 0x26}, 0x18) mkdirat(r0, &(0x7f0000000080)='./file0\x00', 0x3) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f00000000c0)={{0x1, 0x3, 0xd, 0x3, 0x7}, 0x9, 0x80000001}) ioctl$BTRFS_IOC_BALANCE(0xffffffffffffffff, 0x5000940c, 0x0) r1 = openat(r0, &(0x7f0000000140)='./file0\x00', 0x109000, 0x40) ioctl$int_in(r1, 0x0, &(0x7f0000000180)=0x6) r2 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x2002, 0xc3) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r2, 0xc080661a, &(0x7f0000000200)={@desc={0x1, 0x0, @desc3}}) fcntl$getownex(r0, 0x10, &(0x7f0000000280)) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000002c0)={0x1c49, 0x4}) ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f0000000340)=@arm64_sve_vls={0x606000000015ffff, &(0x7f0000000300)=0x4}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r1) sendmsg$NL80211_CMD_GET_MPATH(r1, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x14000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x38, r3, 0x400, 0x70bd25, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x811) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f00000008c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000880)={&(0x7f0000000500)={0x378, r3, 0x300, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x1e}}}}, [@NL80211_ATTR_TX_RATES={0x318, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x58, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x3, 0x6, 0x2, 0x3e, 0xff, 0x3, 0x4664]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x7, 0xb, 0x0, 0x7, 0x7, 0x65f, 0x7ff]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xc8d, 0xfffd, 0xfff8, 0x85, 0x2, 0x6, 0x5, 0x957]}}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_2GHZ={0x88, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xb5a, 0x7, 0x8000, 0x9, 0x8, 0xfe59, 0x100, 0x7ff]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0xfff7, 0x2, 0x40, 0x2, 0x7, 0x102]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x6, 0xd85c, 0x7, 0x401, 0xfffb, 0x7, 0x2529]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x2d, 0x2, [{0x4, 0x1a}, {0x2, 0x5}, {0x6, 0xa}, {0x0, 0x8}, {0x0, 0x5}, {0x7}, {0x5, 0x4}, {0x4, 0x6}, {0x3, 0x4}, {0x4, 0x2}, {0x1, 0x6}, {0x2, 0x8}, {0x1, 0x3}, {0x2, 0x5}, {0x5, 0x4}, {0x0, 0x4}, {0x4, 0x3}, {0x2, 0x4}, {0x0, 0x2}, {0x1, 0x3}, {0x2, 0xa}, {0x1, 0x1}, {0x3, 0x8}, {0x5, 0x2}, {0x1, 0x1}, {0x0, 0x8}, {0x3, 0x9}, {0x5, 0x8}, {0x0, 0x6}, {0x1, 0xa}, {0x0, 0x8}, {0x4, 0x3}, {0x6, 0x5}, {0x1, 0x3}, {0x3, 0x9}, {0x0, 0x1}, {0x0, 0x9}, {0x5, 0x9}, {0x4, 0x7}, {0x3, 0x8}, {0x0, 0x1}]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x74, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x3, 0xd, 0x7, 0x2, 0x800, 0xffff, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x998d, 0x100, 0x238, 0x5, 0xdbb9, 0x5, 0xe]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x4, 0x0, 0x55, 0x3, 0x4, 0x6000, 0x8]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x39dc, 0x1, 0x4, 0x2, 0x400, 0x4, 0x4, 0x1]}}]}, @NL80211_BAND_60GHZ={0x40, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3db, 0x4, 0x9, 0x9, 0x0, 0x3, 0x8, 0xfffd]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x10, 0x1, [0x1b, 0x12, 0x6c, 0x6c, 0x24, 0xb, 0x16, 0x59, 0x1, 0xcdbace0506bb62eb, 0xc, 0x12]}, @NL80211_TXRATE_LEGACY={0x7, 0x1, [0x16, 0x6, 0x36]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_60GHZ={0xb8, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x13, 0x1, [0x12, 0x30, 0x9, 0x60, 0x6, 0x6, 0x1, 0x48, 0x36, 0x24, 0x48, 0x1, 0x6, 0x0, 0x10]}, @NL80211_TXRATE_HT={0x38, 0x2, [{0x7, 0x1}, {}, {0x1, 0x9}, {0x5, 0x5}, {0x4, 0x3}, {0x7}, {0x1, 0x5}, {0x0, 0x9}, {0x4, 0x3}, {0x2, 0x8}, {0x4, 0x8}, {0x7, 0x4}, {0x6}, {0x7, 0x1}, {0x4, 0x7}, {0x5}, {0x2, 0x1}, {0x0, 0x6}, {0x5, 0xa}, {0x5, 0x2}, {0x2, 0x3}, {0x2, 0x4}, {0x2, 0x3}, {0x0, 0x1}, {0x4, 0x6}, {0x1, 0xa}, {0x1, 0x4}, {0x6}, {0x4, 0x5}, {0x4, 0x6}, {0x2, 0x7}, {0x7, 0x9}, {0x1, 0x5}, {0x6}, {0x1, 0x4}, {0x2, 0x1}, {0x4, 0x7}, {0x6, 0x8}, {0x1, 0x3}, {0x1, 0x3}, {0x5, 0x8}, {0x5, 0x8}, {0x5, 0x8}, {0x4, 0x9}, {0x4, 0x6}, {0x6, 0x6}, {0x0, 0x1}, {0x7, 0x3}, {0x0, 0xa}, {0x1, 0x5}, {0x7, 0x2}, {0x0, 0x6}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0xffff, 0x4, 0x8, 0x5, 0xfc0, 0x57f, 0x6]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x0, 0xd2a7, 0x8, 0xffff, 0x3ff, 0x7fff, 0x40]}}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x48, 0x48, 0x60, 0x6, 0x16, 0xb, 0xb, 0xb, 0x5, 0x16, 0x9, 0x4, 0x24]}, @NL80211_TXRATE_HT={0x1b, 0x2, [{0x0, 0x1}, {0x3, 0x6}, {0x3, 0x9}, {0x2, 0x8}, {0x0, 0x2}, {0x7}, {0x6, 0x1}, {0x2, 0xa}, {0x2, 0x3}, {0x4, 0x9}, {0x6, 0x1}, {0x3, 0x2}, {0x1, 0x1}, {0x1, 0x6}, {0x6, 0x7}, {0x3, 0x7}, {0x1, 0x3}, {0x1, 0x1}, {0x6, 0x6}, {0x5, 0xa}, {}, {0x5, 0x2}, {0x1, 0x6}]}]}, @NL80211_BAND_5GHZ={0x58, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xfffb, 0x6, 0x6, 0x3, 0xc, 0x2, 0x1, 0x9]}}, @NL80211_TXRATE_HT={0x1c, 0x2, [{0x1, 0x2}, {0x6, 0x2}, {0x6, 0x2}, {0x3, 0x2}, {0x7, 0x12}, {}, {0x0, 0x9}, {0x6, 0x5}, {0x7, 0x1}, {0x3, 0x1}, {0x1, 0x6}, {0x3, 0x9}, {0x7, 0xa}, {0x5, 0x8}, {0x6, 0x8}, {0x1, 0x4}, {0x3, 0x7}, {0x7, 0x2}, {0x3, 0x8}, {0x3, 0x9}, {0x0, 0x5}, {0x5, 0x8}, {0x5, 0x4}, {0x6, 0x5}]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x1b, 0x16, 0x2e, 0x3, 0x0, 0x1e, 0x48, 0x36, 0x3, 0x6c, 0x36, 0x2, 0x4, 0x3, 0x6, 0x30, 0x1, 0x36, 0x48, 0x4, 0x6, 0x6c]}]}, @NL80211_BAND_2GHZ={0x28, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xc4, 0x40, 0x3, 0x7, 0x8, 0x1, 0x1, 0x7]}}]}, @NL80211_BAND_60GHZ={0x48, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0x9, 0x30, 0x24, 0xb, 0x60]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x60, 0x3, 0x36, 0x4, 0x0, 0x23, 0x3, 0x76, 0x6c, 0x3, 0x18, 0x60, 0xc]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x6, 0xc00, 0x200, 0x3, 0x200, 0x5, 0x8000]}}]}]}, @NL80211_ATTR_TX_RATES={0x40, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x3c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff8, 0xc0, 0x6, 0x48, 0x80, 0x0, 0xea, 0x9]}}, @NL80211_TXRATE_HT={0x10, 0x2, [{0x3, 0x7}, {0x1, 0x3}, {0x0, 0x3}, {0x7}, {0x1, 0x6}, {0x0, 0x9}, {0x0, 0x6}, {0x0, 0x1}, {0x2, 0x5}, {0x3}, {0x1, 0xa}, {0x3, 0x9}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xc42c, 0x357c, 0xa, 0x4, 0xa9db, 0x7ff, 0x7, 0x2]}}]}]}]}, 0x378}, 0x1, 0x0, 0x0, 0x48000}, 0x8008001) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x9) fcntl$getownex(r1, 0x10, &(0x7f0000000900)) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000980)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_OCB(r0, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x1c, r3, 0x100, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x840}, 0x48040) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_QOS_MAP(r5, &(0x7f0000000c40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000ac0)={0x120, r3, 0x800, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xfffffffb, 0x4c}}}}, [@NL80211_ATTR_QOS_MAP={0x10, 0xc7, {[{0xff, 0x4}, {0x6, 0x2}], "32d2af304a7b31b3"}}, @NL80211_ATTR_QOS_MAP={0x32, 0xc7, {[{0x9, 0x7}, {0x2, 0x3}, {0x6, 0x6}, {0x66, 0x3}, {0xe, 0x6}, {0x4, 0x2}, {0x2, 0x7}, {0x2, 0x7}, {0x7, 0x7}, {0x0, 0x7}, {0x4, 0x5}, {0x7f, 0x4}, {0xd, 0x3}, {0x47, 0x5}, {0x1, 0x2}, {0x4}, {0x6, 0x5}, {0xc}, {0x4, 0x7}], "9f4a6d03beaa326c"}}, @NL80211_ATTR_QOS_MAP={0x12, 0xc7, {[{0x7f, 0x6}, {}, {0x4, 0x7}], "ab5226a9121330b7"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x2, 0x1}, {0x9, 0x7}, {0x0, 0x4}, {0x7, 0x2}, {0x4, 0x4}, {0x3, 0x6}, {0x9, 0x2}, {0x5, 0x8}, {0x84, 0x4}, {0x6, 0x3}, {0x7, 0x1}, {0x6, 0x1}, {0x3, 0x7}, {0x6, 0x6}], "eaa620afdb68d708"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xb}, {0x10, 0x5}, {0x6, 0x3}, {0x4, 0x5}, {0x5, 0x3}, {0x5, 0x7}, {0x0, 0x1}, {0x8, 0x3}, {0x7, 0x7}, {0x9, 0x3}, {0xc7, 0x3}, {0xdb, 0x4}, {0x8, 0x2}, {0x0, 0x3}, {0x2, 0x3}, {0x2}, {0x7, 0x3}], "797b0768cd2681ea"}}, @NL80211_ATTR_QOS_MAP={0x1e, 0xc7, {[{0x86, 0x5}, {0x30, 0x4}, {0xd, 0x4}, {0x80, 0x4}, {0x9b, 0x7}, {0x40, 0x4}, {0x60, 0x6}, {0xf7, 0x5}, {0xfa, 0x4}], "0ff4ffb9ddd14716"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x6, 0x1}, {0x7, 0x3}, {0x5, 0x5}, {0x0, 0x7}, {0x46, 0x5}, {0x8, 0x6}, {0x7, 0x1}, {0x64, 0x1}, {0x4, 0x1}, {0xda, 0x6}, {0x5, 0x1}, {0x9, 0x2}, {0x2, 0x7}, {0x1, 0x1}, {0x3, 0x4}, {0x8, 0x4}, {0xae, 0x1}], "1f33fcf58adb519c"}}]}, 0x120}, 0x1, 0x0, 0x0, 0x48880}, 0x1) getrusage(0x1, &(0x7f0000000c80)) accept4$vsock_stream(r0, &(0x7f0000000d40)={0x28, 0x0, 0xffffffff, @local}, 0x10, 0x80000) ioctl$TIOCL_GETKMSGREDIRECT(r1, 0x541c, &(0x7f0000000d80)) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000e80)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000e40)={&(0x7f0000000e00)={0x3c, r3, 0x400, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x44}, @val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x6, 0x5b}}}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x3c}}, 0x8) ioctl$VFAT_IOCTL_READDIR_SHORT(r5, 0x82307202, &(0x7f0000000ec0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$VT_ACTIVATE(r1, 0x5606, 0x7) r6 = syz_genetlink_get_family_id$fou(&(0x7f0000001140), r1) sendmsg$FOU_CMD_GET(r5, &(0x7f0000001200)={&(0x7f0000001100), 0xc, &(0x7f00000011c0)={&(0x7f0000001180)={0x30, r6, 0x834, 0x70bd2b, 0x25dfdbfe, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x3c}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040010}, 0x4) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000001280), r1) sendmsg$DEVLINK_CMD_GET(r0, &(0x7f00000013c0)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001380)={&(0x7f00000012c0)={0xa4, r7, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@pci={{0x8}, {0x11}}, @pci={{0x8}, {0x11}}, @pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4004000}, 0xc000) 4.778182589s ago: executing program 0 (id=933): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/power/sync_on_suspend', 0x40202, 0x105) write$tcp_mem(r0, &(0x7f0000000500)={0xfffffffffffffffa, 0x20, 0x48001, 0x20, 0x3ff}, 0x48) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000000), 0xd4, 0x10d002) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x1ff, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$USBDEVFS_GET_SPEED(r2, 0x551f) r7 = creat(&(0x7f0000000040)='./file0\x00', 0x110) unshare(0x22020600) syz_usb_connect$rtl8150(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1f}}]}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x380, 0x2}) write$cgroup_subtree(r7, &(0x7f00000000c0)={[{0x2d, 'rdma'}]}, 0x6) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x0, 0x1}) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000380)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f00000001c0)=[@reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x50, 0x0, &(0x7f0000000240)="0979e127b8b3891be8dd397c67fc82251cecd27196a59beb85cb7450266767e735d2f6932155ed86f508fe87dbb49fc69db4458cbb2113dbf9f32c7a53eed2206e041bb9eee97a5798b41527404ddeff"}) 1.681292164s ago: executing program 0 (id=996): prlimit64(0x0, 0x9, &(0x7f0000000040)={0xfffffffffffffffb, 0xfffffffffffffffc}, 0x0) (async) brk(0x689d80000000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x400007, 0x3, 0x10000, 0x3, 0x0, 0x400, 0x6}, 0x1c) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x18, 0x8, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) execve(0x0, &(0x7f0000000300)={[&(0x7f0000000200)='blkio.bfq.io_wait_time_recursive\x00']}, 0x0) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$key(0xf, 0x3, 0x2) ioctl$F2FS_IOC_GET_PIN_FILE(r3, 0x8004f50e, &(0x7f00000002c0)) sendmsg$key(r4, &(0x7f0000000440)={0x500, 0x0, &(0x7f0000000040)={0x0}, 0x19}, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder0\x00', 0x0, 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x2000000) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280)) sendmsg$DEVLINK_CMD_RATE_GET(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r6, @ANYBLOB="77bc8a9efdaa3515ed2a091e0c389067480430f6759da9643be7c8added0ba600c876698ac0c4d9efaada2a6db5717d51d8e10b03c206f4e8c651db061d41636f3ff4851b0d9a9e7e8c9c5fb3e079d"], 0x14}, 0x1, 0x0, 0x0, 0x2010}, 0x4c494) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_BT_RCVMTU(r7, 0x112, 0xd, &(0x7f0000000040)=0xfff7, &(0x7f0000000080)=0x2) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/custom1\x00', 0x800, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000200)='.pending_reads\x00', 0x0, 0x1a0) (async) r8 = socket$inet6(0xa, 0x3, 0x5) sendmmsg(r8, &(0x7f0000001500)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @remote, 0x0, 0x3}, 0x18, 0x0}, 0x5b4}], 0x1, 0xc040) 1.536856049s ago: executing program 0 (id=1002): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x6082, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$binfmt_aout(r2, &(0x7f0000000240)={{0xcc, 0xfd, 0x81, 0x3bc, 0x49, 0x1, 0x17, 0x5}, "60518b0ccc1ec9b6692b87e2a473681a4f", ['\x00', '\x00', '\x00', '\x00']}, 0x431) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x8c80, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETLINK(r3, 0x400454cd, 0x20) sendfile(r0, r0, 0x0, 0x1000007fd) 1.354120856s ago: executing program 5 (id=1011): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000006c0), 0x48200, 0x0) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES64=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x4040094) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000340)={'syzkaller0\x00', @random="988c08925391"}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) socket$unix(0x1, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="440000004ec6"}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000480)="be604475647d7a29472269b80db06ea99d16a1e23f58504441c02e955c5499b328b1bd19909555679e3bbb39e23235037223da6566637d09c0a7192acce97d05ae3077ffe54c98d0c06a98319bc853f4c0177977cff5e33badeed08f6d2ff80d19c30d111c2b98cd96a0f57677161d34c64fb37365fb0ffa931bc4915658f185a35995391049", 0x86}], 0x1}}], 0x1, 0x2000c044) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000004c0)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x6, 0x6, 0xc8}]}, 0x10) r8 = fcntl$dupfd(r6, 0x0, r7) io_setup(0x2adf, &(0x7f0000000180)=0x0) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') io_submit(r9, 0x1, &(0x7f0000000000)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2, 0x7fff, r10, 0x0}]) r11 = syz_genetlink_get_family_id$smc(&(0x7f0000000180), r8) sendmsg$SMC_PNETID_DEL(r10, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x58, r11, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wg2\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x58}}, 0x200400c1) unshare(0x22020600) 1.054714855s ago: executing program 0 (id=1015): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='binder\x00', 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) (async) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000300)) (async) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r0, 0x800448d3, 0x0) (async) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) (async) mmap(&(0x7f0000ae4000/0x2000)=nil, 0x2000, 0xd3283d0368e269b3, 0x1010, 0xffffffffffffffff, 0xffffe000) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) (async) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) (async) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) (async) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x10}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000bff000/0x400000)=nil) (async) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x1, &(0x7f0000000000)=[{0x6}]}) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000040)={@private2={0xfc, 0x2, '\x00', 0x2}, 0x800, 0x0, 0x1, 0x8, 0x6109, 0x3}, 0x20) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)={0x14, 0x0, 0x4, 0x70bd2b, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4044020}, 0x4000000) (async) recvmmsg(r4, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000000200)=""/60, 0x3c}, {&(0x7f00000001c0)=""/35, 0x23}, {&(0x7f00000014c0)=""/258, 0x102}, {&(0x7f00000004c0)=""/4082, 0xff2}], 0x4}}], 0x1, 0x40030002, 0x0) (async) sendmsg$nl_generic(r4, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002b40)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) (async) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000240)) 1.054470336s ago: executing program 0 (id=1016): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) pipe2$9p(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) fsetxattr$security_capability(r1, &(0x7f0000000980), &(0x7f0000000a80)=@v1={0x1000000, [{0x7, 0x10000}]}, 0xc, 0x2) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) socket(0x10, 0x3, 0xffff) sendto$packet(r4, &(0x7f0000000300)="0816", 0x2, 0x40000, &(0x7f0000000200)={0x11, 0xe, r5, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000140)=0x100000001, 0x4) ioctl$sock_SIOCOUTQ(r4, 0x5411, &(0x7f0000000080)) madvise(&(0x7f0000152000/0x2000)=nil, 0x2000, 0xa) syz_clone(0x1204000, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0) syz_usb_connect(0x0, 0x81, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a7420040ab0501030001010203010902240001000000000904000002aad45c0009058e02000000000009050a06"], 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0xffffc000) 957.405535ms ago: executing program 4 (id=1019): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) (async) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x1000, 0x8, '9P2000.u'}, 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) (async) write$P9_ROPEN(r1, &(0x7f0000000340)={0x18, 0x71, 0x2, {{0x4, 0x4, 0x7}, 0x9b6}}, 0x18) (async) write$FUSE_INIT(r2, &(0x7f0000001740)={0x50, 0x0, 0x0, {0x7, 0x21, 0x0, 0x14210000, 0x7d, 0x1005, 0x0, 0x3}}, 0x50) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000180)={0x0, 'pimreg\x00', {0x3}, 0x3fc}) (async) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000001300090468fe0700000000000000ff3f08000000480100100000000019002b000a0001000500fe8000000072081f03000500000000", 0x39}], 0x1) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000140)=0x2, 0x4) (async) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000004380), 0x1814800, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00'/15, @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',ignoreqv,noxattr,version=9p2000.L,k']) (async) r4 = syz_open_procfs(0x0, &(0x7f00000003c0)='mountinfo\x00') getsockopt$IP_SET_OP_GET_BYINDEX(r4, 0x1, 0x53, &(0x7f0000000000)={0x7, 0x7, 0x1}, &(0x7f0000000080)=0x28) (async) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x47f) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) (async) r6 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r6, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) (async) r7 = socket(0x8000000010, 0x2, 0x0) write(r7, &(0x7f00000006c0)="fc0000001c000704ab5b2509b86803000aab087a0400000001481193210001c0f0030584050060100000000100039815fa2c53c2864800008d5e63efbe737f96705e670929f4af6002b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82", 0x77) (async) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x81, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) write$tun(r4, &(0x7f0000000740)={@void, @val={0x2, 0x80, 0x56, 0x6, 0x8001, 0x8a}, @ipv6=@udp={0x2, 0x6, "61fed6", 0x3a2, 0x11, 0x0, @mcast1, @mcast1, {[@hopopts={0x6c, 0x7, '\x00', [@hao={0xc9, 0x10, @empty}, @hao={0xc9, 0x10, @mcast1}, @jumbo={0xc2, 0x4, 0x72ad2889}, @padn={0x1, 0x2, [0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x8}, @enc_lim={0x4, 0x1, 0x2}, @jumbo={0xc2, 0x4, 0x2}]}, @routing={0x11, 0x12, 0x1, 0xf3, 0x0, [@mcast1, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, @ipv4={'\x00', '\xff\xff', @remote}, @loopback, @local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, @mcast2]}, @srh={0x67, 0x2, 0x4, 0x1, 0x1, 0x0, 0x9, [@local]}, @routing={0x3b, 0x12, 0x2, 0x99, 0x0, [@ipv4={'\x00', '\xff\xff', @empty}, @dev={0xfe, 0x80, '\x00', 0x35}, @ipv4={'\x00', '\xff\xff', @broadcast}, @loopback, @dev={0xfe, 0x80, '\x00', 0x2c}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @empty, @empty, @remote]}, @srh={0xc, 0x12, 0x4, 0x9, 0x3, 0x48, 0x100, [@private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, @private2, @ipv4={'\x00', '\xff\xff', @loopback}, @private1, @loopback, @private0={0xfc, 0x0, '\x00', 0x1}, @private0, @loopback]}, @fragment={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x66}, @srh={0x2c, 0xe, 0x4, 0x7, 0xb6, 0x0, 0x40, [@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02']}, @routing={0x6, 0xc, 0x0, 0x8, 0x0, [@remote, @loopback, @dev={0xfe, 0x80, '\x00', 0x35}, @private0={0xfc, 0x0, '\x00', 0x1}, @empty, @dev={0xfe, 0x80, '\x00', 0x28}]}], {0x4e23, 0x4e24, 0x92, 0x0, @gue={{0x2, 0x1, 0x3, 0x9}, "dcd6717edc52379e446dab1827a366cdfd62f00c5f8c83cea7586df8d54e21882c49b4117ec24f339520f8aba12870ef2973f4c8445cb1264d4e861074b3b54c74d36e060b5d2efa0c4a8128e84699301f9cabe8c7a8c0c028e63ecf9d68db771170260946db15068c87cda36a8e5da99a5b4a307846eded015071383e98a5824846"}}}}}, 0x3d4) (async) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="46030008", @ANYRES16=r9, @ANYBLOB="0100000000000000000003000000140001800e0001006574683a7866726d30000000"], 0x28}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'veth1_to_batadv\x00', 0x2011}) (async) sendfile(0xffffffffffffffff, r4, 0x0, 0xffffffff) 874.783094ms ago: executing program 4 (id=1020): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0xc02, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4e23, 0x0, @dev={0xfe, 0x80, '\x00', 0x25}, 0x6}, 0x1c) (async) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000040)={@local}, 0x14) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e, 0xfe9, &(0x7f0000000200)={@fd={0x66642a85, 0x0, r0}, @flat=@weak_binder={0x77622a85, 0x1000, 0x3}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x2, 0x28}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x400}], 0x0, 0x0, 0x0}) 626.130698ms ago: executing program 2 (id=1024): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x33, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r2) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) r5 = socket(0x8000000010, 0x2, 0x0) write(r5, &(0x7f00000002c0)="1c0000001c000704ab5b2509b868030002ab087a0100000001481093", 0x1c) fcntl$lock(r4, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x1b9, 0x7fffffff}) fcntl$lock(r4, 0x24, &(0x7f0000000180)={0x2, 0x0, 0x4000000089}) sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x28, r3, 0x1, 0x70bd2c, 0x25dfd9fb, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}]}]}, @ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = dup(r11) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r12, r13, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r11, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r9, 0x8008ae9d, &(0x7f0000000000)) ioctl$KVM_GET_MSRS_cpu(r8, 0xc008ae88, &(0x7f0000000280)={0x1, 0x0, [{0x29b}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0xffffffffffffffd5, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x7624f2802272dfdf, 0x0, 0x0, 0x58, 0x18, &(0x7f00000000c0)={@fd={0x66642a85, 0x0, r6}, @ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/173, 0xad, 0x0, 0x29}, @flat=@weak_binder={0x77622a85, 0x10b, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x40}}, 0x400}], 0x0, 0x0, 0x0}) 621.941529ms ago: executing program 2 (id=1025): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'ip_vti0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x7c7, 0x3, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x86, 0x4, 0x0, @loopback, @local}}}}) (async) mount$binderfs(0x0, &(0x7f0000000100)='./binderfs\x00', 0x0, 0x120420, &(0x7f0000000000)=ANY=[@ANYBLOB='defcontext', @ANYRES8=r0]) 613.891049ms ago: executing program 2 (id=1026): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x8c83, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x81000010) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_udp_int(r1, 0x11, 0x1, 0x0, &(0x7f0000000040)) ioctl$BLKRRPART(r0, 0x125f, 0x0) 566.392044ms ago: executing program 2 (id=1027): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r1, 0x200, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="615db322eb3a"}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000084}, 0x400c004) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000340)={&(0x7f00000001c0)={0x14c, 0x0, 0x10, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x48, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}]}, @TIPC_NLA_MEDIA={0x30, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x92a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_MEDIA={0xc0, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0x200000c7}, 0x40000) pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000480)=[@text16={0x10, &(0x7f0000000400)="26d9240f99b9d7f2660f384179fcbad00466ed36f30f2c98be28640f22800f21ef66b9800000c00f326635001000000f3066b8000000000f23d00f21f86635300000050f23f80f700850", 0x4a}], 0x1, 0x0, &(0x7f00000004c0)=[@cstype0={0x4, 0xd}], 0x1) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000500)=0x0) r6 = syz_open_procfs$pagemap(r5, &(0x7f0000000540)) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xc) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$IEEE802154_ADD_IFACE(r7, &(0x7f00000006c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x78, r8, 0x100, 0x70bd26, 0x25dfdbff, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x399301e4fc81f055}}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_TYPE={0x5, 0x20, 0x1}, @IEEE802154_ATTR_DEV_TYPE={0x5}]}, 0x78}, 0x1, 0x0, 0x0, 0x8800}, 0x0) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), r0) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000a00)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000009c0)={&(0x7f0000000780)={0x228, r9, 0x10, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4100}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x24}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x800}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA={0x34, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x85}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}]}]}, @TIPC_NLA_MEDIA={0x84, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x56}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1abc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfffffff7}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}]}, @TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xaf}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x88a}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xe3}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffff}]}, @TIPC_NLA_BEARER={0x7c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x10}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x78d9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x20000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @private=0xa010100}}, {0x14, 0x2, @in={0x2, 0x4e21, @multicast2}}}}]}]}, 0x228}, 0x1, 0x0, 0x0, 0x2000c041}, 0xc0cd81ea27d844d7) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r3, &(0x7f0000000c40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000a80)={0x144, 0x0, 0x32ab91f9d3abacc2, 0x70bd26, 0x25dfdbfb, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0x8000000000000000}, {0xc, 0x90, 0x640c9ce9}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0x72f7}, {0xc, 0x90, 0x2}}, {@pci={{0x8}, {0x11}}, {0x8}, {0xc, 0x8f, 0x401}, {0xc, 0x90, 0x6}}, {@pci={{0x8}, {0x11}}, {0x8}, {0xc}, {0xc, 0x90, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0x8e, 0x1}, {0xc, 0x8f, 0x7}, {0xc, 0x90, 0x6}}]}, 0x144}, 0x1, 0x0, 0x0, 0x20001000}, 0x4040) setsockopt$IP_VS_SO_SET_STARTDAEMON(r4, 0x0, 0x48b, &(0x7f0000000c80)={0x0, 'veth1_vlan\x00', 0x2}, 0x18) write$P9_RMKDIR(0xffffffffffffffff, &(0x7f0000000cc0)={0x14, 0x49, 0x2, {0x10, 0x4, 0x4}}, 0x14) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000d00), &(0x7f0000000d40)=0xc) getsockopt$bt_l2cap_L2CAP_LM(r3, 0x6, 0x3, &(0x7f0000000d80), &(0x7f0000000dc0)=0x4) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r4, &(0x7f0000000f00)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x40, r10, 0x700, 0x70bd25, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x50452acb}]}, 0x40}, 0x1, 0x0, 0x0, 0x24044010}, 0x880) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r11, &(0x7f0000001000)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x80054000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f80)={0x1c, 0x1, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x6}, [@NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4044094) ioctl$KVM_SET_MP_STATE(r4, 0x4004ae99, &(0x7f0000001040)=0x2) accept4$vsock_stream(r3, &(0x7f0000001080)={0x28, 0x0, 0x2710, @hyper}, 0x10, 0x0) ioctl$KVM_GET_REG_LIST(r4, 0xc008aeb0, &(0x7f00000010c0)={0x4, [0x8000000, 0x6, 0x3ff, 0x1]}) ioctl$SNDRV_TIMER_IOCTL_CREATE(r3, 0xc02054a5, &(0x7f0000001100)={0x10001, r6, 'id1\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000011c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(r12, &(0x7f00000012c0)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001280)={&(0x7f0000001200)={0x68, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r13}, @val={0xc, 0x99, {0x2, 0x54}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xa}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x6}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x7}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x44010}, 0x20048814) 551.934265ms ago: executing program 2 (id=1028): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder0\x00', 0x1002, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, 0x0) 551.516185ms ago: executing program 2 (id=1029): capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r0, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000000) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r1, 0x40089413, &(0x7f0000000000)=0x4) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x200, 0x80) ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f0000000040)=""/228) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1000009, 0x50, r1, 0x0) mmap$binder(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) r3 = mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r4 = userfaultfd(0x80801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f0000000000)="0900bf65653f47f4020000008bd458d1e7cbdaf300000f34e7e4165f081ae36850f6d15c3e681411f7a496c0da04003c242f5bedaf6bec340dee49474362b24cb800edc500", 0x0, 0x48) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) signalfd4(r5, &(0x7f0000000000), 0x8, 0x800) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ffb000/0x1000)=nil, 0x1000}}) r6 = accept$packet(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000080)=0x14) setsockopt$packet_buf(r6, 0x107, 0x1, &(0x7f0000000100)="bb427b216824fb40a0753d8fdffa05ad8765055a98bbd39b61ac386e7b53c99e38b1c6ec9e4780cd5ac579137672fee1a45ef369b1a0d9d00035a6639996aa12a5fda18e9116d370722ed1b282b3134a394504126658e6fc8d5dbacf035c6a861c4d58a0d9b2da6216c3148ec9b3420b4c69143358d8c3e3f76824062ba360d1f390587c3599e23f1fb118b355f3530c3228084fecfd4db3233231c3f353327b9ac29872", 0xa4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x60, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x50, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1001, 0x2}, @fda={0x66646185, 0x9, 0x1, 0x34}, @flat=@binder={0x73622a85, 0xa}}, &(0x7f0000000280)={0x0, 0x18, 0x38}}}, @enter_looper, @release={0x40046306, 0x3}, @request_death={0x400c630e, 0x1}], 0x40, 0x0, &(0x7f0000000340)="5d1a10ae1db48ab0fc66f3850ba1e0308f195b1f605f7cfa8743fb9852cfae977984b0afa6ea8fc98b045c4ca91cddd39e105359090af2dd66beef5d5e51e5f1"}) 506.2252ms ago: executing program 5 (id=1030): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0xe28, 0x4, @mcast2, 0x7}, 0x1c) munmap(&(0x7f000045e000/0x1000)=nil, 0x1000) madvise(&(0x7f000045c000/0x4000)=nil, 0x4000, 0x80000000e) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) mremap(&(0x7f00006bd000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000aa3000/0x1000)=nil) syz_clone(0x140011, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x380, 0x2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272df9f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 486.500372ms ago: executing program 5 (id=1031): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) dup3(r0, r0, 0x0) 430.704907ms ago: executing program 5 (id=1032): openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) 430.478247ms ago: executing program 5 (id=1033): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x40000100000200) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000000)='!(+.\x00') mmap(&(0x7f0000018000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x85b83000) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r0, 0x8008f513, &(0x7f0000000040)) 429.276247ms ago: executing program 5 (id=1034): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000000)={0x400000000000030d}) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000970e5b4035121800eef0000000010902120001000000000904"], 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x1010, 0xffffffffffffffff, 0x4000) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) (async) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165342, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r5 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r5, 0x6, 0x15, &(0x7f0000000140)=0xc1, 0x4) (async) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0xd, 0x0, 0x20040001, 0x4008001, 0x1, 0x0, 0x4, 0xfffffffe, 0x2}}) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000200)={@private2, r4}, 0x14) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000800)=@acquire={0x134, 0x17, 0x1, 0x0, 0x0, {{@in=@rand_addr=0x64010102}, @in=@multicast2, {@in6=@private2, @in6=@local, 0x0, 0x40}, {{@in6=@local, @in=@dev={0xac, 0x14, 0x14, 0x2}, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfb1}, {}, 0x4, 0x6e6bb8}, 0xfffffffe}, [@sec_ctx={0xc, 0x8, {0x8, 0x8, 0x1, 0xa3}}]}, 0x134}}, 0x0) (async) mprotect(&(0x7f000000b000/0x2000)=nil, 0x2000, 0x4) r8 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x165142, 0x0) (async) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) (async) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r10) (async) getsockopt$SO_TIMESTAMPING(r10, 0x1, 0x41, &(0x7f0000000080), &(0x7f00000000c0)=0x4) (async) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r9, 0x0) write(r8, &(0x7f0000000400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a4", 0xfffffcf1) (async) write(r1, &(0x7f0000000400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a4", 0x1f000) 418.557289ms ago: executing program 0 (id=1035): r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f00000003c0)="2600000022004701050007108980e8ff06006d20002b1ffec0e90101c7bb0000b00000000000", 0x26) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000d9bffc), 0x4) sendto(r0, &(0x7f00000005c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x20000090, 0x0, 0x0) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000200)=""/76, 0x4c}, {&(0x7f00000009c0)=""/223, 0xdf}, {&(0x7f0000002c00)=""/4123, 0x101b}, {&(0x7f0000000000)=""/248, 0xf8}, {&(0x7f0000000800)=""/139, 0x8b}, {&(0x7f0000000340)=""/63, 0x3f}, {&(0x7f0000000140)=""/168, 0xa8}, {&(0x7f0000000900)=""/144, 0x90}], 0x8}, 0x10001}], 0x1, 0x0, 0x0) r1 = socket(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0xfffffffc) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, &(0x7f0000000b80)={0x14, &(0x7f0000000ac0)=ANY=[@ANYBLOB="4002a3000000a3234c7c9662294561b045fe3b73d593a579f32a1c3d4d8397026c7b4dd068e3be629832e3baeaa1005deee1d121c6e2c910772387d66a405b1b8953fe1c038a046c20d7d13ac79c6ff28da4d284585717da0385c72416dfb70d34354b1e6b70c43faed30e907f49e74d452fd96cbf2e6cfbccd0cbf78228192cc0d76c94b37eacde076b04573711a577f033b405fe93a1b8cba430fd3113eec4418e9577d2314ec701"], &(0x7f00000005c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000c80)={0x1c, &(0x7f0000000480)=ANY=[@ANYBLOB="2014120000000d0127c9ed9c692d59953a004e931f77579b0a6b0e00e1366683a83a4b0b1d6fc550bb6edd8fda7fad1c577d86d0db4deedfe2112962eccde56a25af8c8dedecdba0a034df5ff62ca4295b02a094e5c6bc56931ee7a817bac125c51ed7a5e785870d4bd1ad735a67d879c5a9174ec365a855884a329c4b0def1789c509fd0e4702dfcaacc4ff85be914da2e6a42e0a3387"], &(0x7f0000000c00)={0x0, 0xa, 0x1, 0x10}, &(0x7f0000000c40)={0x0, 0x8, 0x1, 0x4}}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8010, 0xffffffffffffffff, 0xffffd000) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x65) pipe2(&(0x7f0000001040), 0x80800) listen(r5, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0xe64, 0x3, @ipv4={'\x00', '\xff\xff', @empty}, 0x202}, 0x1c) socket$netlink(0x10, 0x3, 0x8000000004) writev(r5, &(0x7f00000006c0)=[{&(0x7f0000000740)="44ffb8ca9390b7c5d5051ff09868512986cc334181f30b8ff0932bc06ff177c3c7d2926d1837bb9163436cb21c65cd792fb5b2158dc57ab2e760380434d60a5bcb7f1082cdea9112eaf1c32fa8c298d08c7ed422d17f84166607000edf473de30e0f4a182cdb48ab0100ca4e253f519f434d936200"/131}, {&(0x7f0000000180)="060353b45c7495092539137362dbf42462588406b521e8b5afc70263b8afa45367b03bebd165e5a388fa03e002da68ac1e68383d01858c0fac89d427e68124885216ff7d2942244cf997d0103d74167f9c48689ea3d7bdfbe3905cd4e28b2deacb7d821b7b8f616f132dd7f71007e8184200010000517a00aeef98040a88e26a37cda469e7fea9dcbc30c2ee4aa7afbbc1ab1375"}, {&(0x7f0000000800)="ef7fbbc3aa957eef222ba0fcf9bdc91b7d60b80a55ff2e83d17a0807b3a0209d2c5423e912e31be45ec622bfefe9544c24cf6e58ceaafde749b7370bbecbc80fadacd44ce9f90912c97687992a8bdc85767300a82539e10d296aa9032835c41b899464c8232e15e421600aed9e44e4b67679ad3dfbdc1cb2099a22decfb6e35f40d727bbc3e478e0d3e7fd22ef5d5f1d75f03550d5e52c6c4e388c42bbd12d6bc816d238f5e6f260f1b60f259b26aca7ceef7dbd585adea91850c8f67d793593a3423f64c8b12b928529e0dc4123953551aab616db779a593fc2525e"}, {&(0x7f0000000340)="b2d6c9ec560c9c9f5a9b8418019659f89f8900b729127ff14c041bae4a0d072a493eab64c6d3f635756fcd825a0fd0a8e74b15df9e369bcb42b532d489db58976de0b3412c7aa6345f1c65f34daa9b2158fd23b79b02561ebb4ffb6e50bdbee859b9e35d0b58e747b519"}, {&(0x7f00000003c0)="78e2ccd8769ab8fe38bdfa0ee29e607be3c99eb5a2ac06c7109ba838c9dfc4c048153ada2873cf035ca2b026580262b01fe589e46f400c3df5c1b121d1fa328b2ff83cb09382591ac753d40c0b9356ee99b32531afe2096d0c674870d90155f2103400e31edd7c5e8419633d3bd723b2da092748ad5bb5f86f1ba773af1ba47d53f20f"}, {&(0x7f0000000240)="deaee692630b4be419ad19ce8a1cedc0effd3e2f1b730e3ad1cdcc58e6054b7803bd55021ce6084c12d4de1094a37a9e1b1a2b73502c7743d57c7504480cb511b83521fee68ea3cbdc71b480c2c8b60d33b4ef056aba06c00d8a383c828f4ca1618dffcefc162207edbbbca58a3889f31da0d838bc67c416e9a54c56ff970277c4b06c589abebc58325e6394b7ac1d39829b5939ace51b165bb65bc73e1e7ab2d2e7786169b3662e4c5de2e678860fec7ac2529a7331aeb4de99dbe8f3a8fbd80905f156f808ea5d68ce4314d1659e82922c817a76389ca5b08a2fa6ed7572da82047d27d44f897883a69f8d9afd849e45c5c2f7", 0x5}, {&(0x7f0000000600)="c15a99b0d58ccdb10dd2fa743337524f16e09819963f837837f2009d44f180803c1a6982fffbf76a264d32b80f5d863b240c0ac2b34b46f6018829587baec3b4f8cad02c39ef3dbcca671198a5a9e3cfba823944262fda91def1957744931be04e81f24d2b1b1b07786091697c6f1c90d0ad6496d5dbdc2ad1ba622359c79ca022be16ce3b97d73ca5a167addf6206a6707aaf79428b7506d0f91fbf3d", 0xfffffffffffffef1}], 0x49) socket$inet_tcp(0x2, 0x1, 0x0) 75.139123ms ago: executing program 4 (id=1036): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x80cd}], 0x1, 0x7) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r0, 0x0) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0xa13ca8e5839881a1, 0x4}) sendmmsg$inet6(r0, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x800) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/nf_conntrack\x00') read$FUSE(r1, &(0x7f0000000a40)={0x2020}, 0x2020) r2 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r2, 0x8008f512, &(0x7f0000000080)) 10.597339ms ago: executing program 4 (id=1037): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x6c, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x7, @mcast2, 0x1}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast1}}}}]}]}, 0x6c}}, 0x0) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r2, &(0x7f0000002400)={0x0, 0x0, &(0x7f00000023c0)={&(0x7f0000002180)={0x14, 0x0, 0x304, 0x70bd28, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x40480c1}, 0x2000c080) syz_genetlink_get_family_id$nfc(&(0x7f0000002500), r2) r5 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000002580), r2) sendmsg$NLBL_CALIPSO_C_ADD(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000600)={0x14, r5, 0x1, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x8000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r7 = dup3(r6, r0, 0x0) socket$inet6(0xa, 0x80002, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r8, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) fspick(0xffffffffffffffff, 0x0, 0xccdd3aaf1369b769) syz_kvm_setup_cpu$x86(r7, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, &(0x7f0000000180)="660fc730b9800000c00f3235010000000f30660f01bdd200000066b8ca008ee8360f3804d4c4c27516a7000000000f01c367260f3036f30f35b95c0900000f32", 0x40}], 0x1, 0x14, &(0x7f0000000380), 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000002c0)={0x10, 0x0, &(0x7f0000000280)=[@clear_death={0x400c630f, 0x1}], 0x0, 0x0, 0x0}) 9.270469ms ago: executing program 4 (id=1038): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r1, 0xf504, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 4 (id=1039): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder1\x00', 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@cache_readahead}], [], 0x6b}}) truncate(&(0x7f0000000240)='./file0\x00', 0xffff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x143042, 0x80) sendfile(r4, r4, 0x0, 0x7a680000) read$FUSE(r4, 0x0, 0xeffd) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000000000000000000000000000000000000000000000000000000000000000ffffe000000100000000000000000200000007000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="030000000000000007000000000000000000000000000000f7ffff7f000000000000000000000000000000000000000000000000000000000000000000000000feffffffffffffffffffffffffffffff00000000000000000000000000000000000000000000000001000003000000004400050020010000000000000000000000000000000000022b0000000a000000fc0100000000000000000000000000000000000004020000000000000000000000400000"], 0xfc}}, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r6 = add_key$user(&(0x7f0000000080), &(0x7f0000000140)={'syz', 0x0}, &(0x7f00000001c0)="03", 0x1, r5) r7 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') lseek(r7, 0xfffffffffffffff9, 0x2) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r8, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000440)=[{0x45, 0x0, 0x3, 0x6}, {}, {0x0, 0x1}, {}, {0x6}]}) ioctl$TUNGETIFF(r8, 0x800454d2, &(0x7f0000000180)={'veth1_to_team\x00'}) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r9, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000180)={0x14, 0x76, 0x31f, 0x0, 0x0, "", [@nested={0x4, 0xd}]}, 0x14}], 0x1, 0x0, 0x0, 0x4004000}, 0x0) r10 = fsopen(&(0x7f0000000300)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r10, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_BINARY(r10, 0x2, &(0x7f0000000100)='[+![\'!{U\x00', &(0x7f0000000200)="176e3ebc29b8068d6cc649d7cd03eb0c78a813f4b9e153a810c77992140cb29c844ae541e14bc04d7e3a701381112460b3e59a1e6d4c19ccdb688d6fc66f56931504039d07bc9c3910080943cec8cdb21ff76eef9ead3df5b1a2a13ba6f98bd82209aa", 0x63) keyctl$setperm(0x5, r6, 0x90000) keyctl$search(0xa, r5, &(0x7f0000000280)='user\x00', &(0x7f00000002c0)={'syz', 0x0}, r5) kernel console output (not intermixed with test programs): 111 1-1:1.105: probe with driver aqc111 failed with error -71 [ 34.782799][ T406] usb 1-1: USB disconnect, device number 6 [ 34.791158][ T330] usb 4-1: device descriptor read/64, error -71 [ 35.010199][ T475] usb 2-1: device descriptor read/64, error -71 [ 35.033724][ T330] usb 4-1: device descriptor read/64, error -71 [ 35.037672][ T617] usb 3-1: unknown interface protocol 0xc1, assuming v1 [ 35.047277][ T617] usb 3-1: cannot find UAC_HEADER [ 35.056638][ T692] netlink: 456 bytes leftover after parsing attributes in process `syz.2.113'. [ 35.066431][ T617] snd-usb-audio 3-1:151.131: probe with driver snd-usb-audio failed with error -22 [ 35.076916][ T617] usb 3-1: USB disconnect, device number 7 [ 35.081870][ T388] udevd[388]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:151.131/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 35.250180][ T475] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 35.270143][ T330] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 35.290913][ T696] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 35.314211][ T699] 9pnet_fd: Insufficient options for proto=fd [ 35.351110][ T701] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 35.390829][ T475] usb 2-1: device descriptor read/64, error -71 [ 35.400206][ T330] usb 4-1: device descriptor read/64, error -71 [ 35.433815][ T704] rust_binder: Error while translating object. [ 35.433844][ T704] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 35.440144][ T704] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:101 [ 35.630143][ T475] usb 2-1: device descriptor read/64, error -71 [ 35.645729][ T330] usb 4-1: device descriptor read/64, error -71 [ 35.760332][ T475] usb usb2-port1: attempt power cycle [ 35.765913][ T330] usb usb4-port1: attempt power cycle [ 35.890194][ T36] audit: type=1326 audit(1761563716.416:245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=691 comm="syz.2.113" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74cd58efc9 code=0x7fc00000 [ 35.926250][ T706] rust_binder: Error while translating object. [ 35.926302][ T706] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 35.932577][ T706] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:95 [ 35.942368][ T707] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.962139][ T711] rust_binder: 100: no such ref 1 [ 35.973685][ T711] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:100 [ 35.996873][ T715] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 36.013422][ T715] rust_binder: Write failure EINVAL in pid:104 [ 36.110139][ T475] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 36.123975][ T330] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 36.151326][ T330] usb 4-1: device descriptor read/8, error -71 [ 36.157623][ T475] usb 2-1: device descriptor read/8, error -71 [ 36.207624][ T731] SELinux: failed to load policy [ 36.216192][ T729] SELinux: failed to load policy [ 36.256748][ T737] capability: warning: `syz.0.126' uses deprecated v2 capabilities in a way that may be insecure [ 36.257401][ T739] loop2: detected capacity change from 0 to 7 [ 36.268982][ T737] rust_binder: Write failure EFAULT in pid:107 [ 36.292121][ T330] usb 4-1: device descriptor read/8, error -71 [ 36.299887][ T742] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 36.304764][ T475] usb 2-1: device descriptor read/8, error -71 [ 36.308206][ T742] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:109 [ 36.359085][ T749] binder: Unknown parameter 'context[7' [ 36.438019][ T758] rust_binder: 123: no such ref 3 [ 36.443151][ T758] rust_binder: 123: no such ref 1 [ 36.448396][ T758] rust_binder: Write failure EFAULT in pid:123 [ 36.449083][ T758] rust_binder: Write failure EINVAL in pid:123 [ 36.497054][ T766] rust_binder: Error in use_page_slow: ESRCH [ 36.497067][ T766] rust_binder: use_range failure ESRCH [ 36.503232][ T766] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 36.512756][ T766] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 36.521007][ T766] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:132 [ 36.522135][ T772] syzkaller0: refused to change device tx_queue_len [ 36.558288][ T774] 9pnet_fd: Insufficient options for proto=fd [ 36.560177][ T475] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 36.580191][ T330] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 36.589442][ T777] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 36.597500][ T777] rust_binder: 138: no such ref 0 [ 36.603030][ T475] usb 2-1: device descriptor read/8, error -71 [ 36.609874][ T330] usb 4-1: device descriptor read/8, error -71 [ 36.618624][ T781] netlink: 44 bytes leftover after parsing attributes in process `syz.0.141'. [ 36.627867][ T781] netlink: 43 bytes leftover after parsing attributes in process `syz.0.141'. [ 36.636761][ T781] netlink: 'syz.0.141': attribute type 5 has an invalid length. [ 36.644441][ T781] netlink: 43 bytes leftover after parsing attributes in process `syz.0.141'. [ 36.667060][ T785] rust_binder: Write failure EFAULT in pid:134 [ 36.697795][ T789] rust_binder: validate_parent_fixup: fixup_min_offset=46, parent_offset=35 [ 36.704100][ T789] rust_binder: Error while translating object. [ 36.713003][ T789] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 36.719198][ T789] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:138 [ 36.741180][ T330] usb 4-1: device descriptor read/8, error -71 [ 36.757999][ T475] usb 2-1: device descriptor read/8, error -71 [ 36.828739][ T791] rust_binder: Error in use_page_slow: ESRCH [ 36.828765][ T791] rust_binder: use_range failure ESRCH [ 36.834798][ T791] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 36.840462][ T791] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 36.848477][ T791] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:140 [ 36.860148][ T65] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 36.860205][ T330] usb usb4-port1: unable to enumerate USB device [ 36.883609][ T475] usb usb2-port1: unable to enumerate USB device [ 37.020822][ T65] usb 3-1: not running at top speed; connect to a high speed hub [ 37.029312][ T65] usb 3-1: config 95 has an invalid interface number: 1 but max is 0 [ 37.037602][ T65] usb 3-1: config 95 has no interface number 0 [ 37.043960][ T65] usb 3-1: config 95 interface 1 has no altsetting 0 [ 37.052256][ T65] usb 3-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 37.061480][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 37.069462][ T65] usb 3-1: Product: syz [ 37.073864][ T65] usb 3-1: Manufacturer: syz [ 37.078462][ T65] usb 3-1: SerialNumber: syz [ 37.100150][ T36] kauditd_printk_skb: 15 callbacks suppressed [ 37.100165][ T36] audit: type=1400 audit(1761563717.626:261): avc: denied { create } for pid=798 comm="syz.0.150" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 37.257129][ T814] KVM: debugfs: duplicate directory 814-8 [ 37.266354][ T814] kernel profiling enabled (shift: 7) [ 37.284748][ T783] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:143 [ 37.286556][ T783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 37.305367][ T783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 37.341740][ T36] audit: type=1400 audit(1761563717.876:262): avc: denied { bind } for pid=818 comm="syz.2.155" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 37.362356][ T65] usb 3-1: USB disconnect, device number 8 [ 37.433939][ T823] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=823 comm=syz.1.157 [ 37.439052][ T388] udevd[388]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:95.1/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 37.472392][ T821] netlink: 76 bytes leftover after parsing attributes in process `syz.2.156'. [ 37.513491][ T833] bpf: Bad value for 'uid' [ 37.520343][ T36] audit: type=1400 audit(1761563718.046:263): avc: denied { map } for pid=832 comm="syz.3.161" path="socket:[5956]" dev="sockfs" ino=5956 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 37.549018][ T36] audit: type=1400 audit(1761563718.046:264): avc: denied { accept } for pid=832 comm="syz.3.161" path="socket:[5956]" dev="sockfs" ino=5956 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 37.606553][ T36] audit: type=1400 audit(1761563718.136:265): avc: denied { create } for pid=840 comm="syz.1.164" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 37.631131][ T846] netlink: 9 bytes leftover after parsing attributes in process `syz.3.165'. [ 37.650153][ T846] z00X: renamed from gretap0 (while UP) [ 37.653890][ T856] loop2: detected capacity change from 0 to 7 [ 37.662703][ T846] z00X: entered allmulticast mode [ 37.684340][ T36] audit: type=1400 audit(1761563718.216:266): avc: denied { ioctl } for pid=845 comm="syz.3.165" path="/dev/usbmon0" dev="devtmpfs" ino=87 ioctlcmd=0x9201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 37.824856][ T860] x_tables: duplicate underflow at hook 1 [ 37.843675][ T864] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:91 [ 37.906207][ T860] rust_binder: 89: no such ref 0 [ 37.920407][ T860] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 37.927499][ T860] rust_binder: 89: no such ref 2 [ 37.932593][ T860] rust_binder: Failed to allocate buffer. len:1128, is_oneway:false [ 37.991006][ T874] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 37.999381][ T874] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 38.034839][ T36] audit: type=1400 audit(1761563718.566:267): avc: denied { name_bind } for pid=876 comm="syz.3.175" src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 38.062398][ T877] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 38.071518][ T330] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 38.079092][ T877] rust_binder: Write failure EINVAL in pid:100 [ 38.085162][ T36] audit: type=1400 audit(1761563718.566:268): avc: denied { node_bind } for pid=876 comm="syz.3.175" saddr=ff02::1 src=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 38.120600][ T880] erofs: dax options not supported [ 38.126112][ T880] erofs: dax options not supported [ 38.132818][ T880] erofs: dax options not supported [ 38.138180][ T880] erofs: dax options not supported [ 38.143547][ T880] erofs: dax options not supported [ 38.148845][ T880] erofs: dax options not supported [ 38.154219][ T880] erofs: dax options not supported [ 38.159531][ T880] erofs: dax options not supported [ 38.164946][ T880] erofs: dax options not supported [ 38.170245][ T880] erofs: dax options not supported [ 38.175610][ T880] erofs: dax options not supported [ 38.180915][ T880] erofs: dax options not supported [ 38.186264][ T880] erofs: dax options not supported [ 38.191568][ T880] erofs: dax options not supported [ 38.196914][ T880] erofs: dax options not supported [ 38.202208][ T880] erofs: dax options not supported [ 38.207598][ T880] erofs: dax options not supported [ 38.212901][ T880] erofs: dax options not supported [ 38.219439][ T880] erofs: dax options not supported [ 38.224804][ T880] erofs: dax options not supported [ 38.230108][ T880] erofs: dax options not supported [ 38.235432][ T880] erofs: dax options not supported [ 38.245221][ T880] erofs: dax options not supported [ 38.251924][ T880] erofs: dax options not supported [ 38.257291][ T880] erofs: dax options not supported [ 38.262692][ T880] erofs: dax options not supported [ 38.268201][ T880] erofs: dax options not supported [ 38.273374][ T330] usb 1-1: Using ep0 maxpacket: 32 [ 38.279195][ T880] erofs: dax options not supported [ 38.285191][ T880] erofs: dax options not supported [ 38.290739][ T880] erofs: dax options not supported [ 38.295976][ T880] erofs: dax options not supported [ 38.301509][ T880] erofs: dax options not supported [ 38.306679][ T330] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 38.316931][ T880] erofs: dax options not supported [ 38.322404][ T880] erofs: dax options not supported [ 38.327653][ T880] erofs: dax options not supported [ 38.332977][ T880] erofs: dax options not supported [ 38.337687][ T330] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 38.338397][ T880] erofs: dax options not supported [ 38.356563][ T880] erofs: dax options not supported [ 38.361848][ T880] erofs: dax options not supported [ 38.367286][ T880] erofs: dax options not supported [ 38.370156][ T330] usb 1-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 38.372592][ T880] erofs: dax options not supported [ 38.382724][ T330] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.391326][ T880] erofs: dax options not supported [ 38.404883][ T330] usb 1-1: config 0 descriptor?? [ 38.406578][ T880] erofs: dax options not supported [ 38.415246][ T330] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 38.415342][ T880] erofs: dax options not supported [ 38.427873][ T880] erofs: dax options not supported [ 38.433493][ T880] erofs: dax options not supported [ 38.438742][ T880] erofs: dax options not supported [ 38.444037][ T880] erofs: dax options not supported [ 38.449371][ T880] erofs: dax options not supported [ 38.454673][ T880] erofs: dax options not supported [ 38.459939][ T880] erofs: dax options not supported [ 38.468249][ T880] erofs: dax options not supported [ 38.473581][ T880] erofs: dax options not supported [ 38.478863][ T880] erofs: dax options not supported [ 38.484227][ T880] erofs: dax options not supported [ 38.489424][ T880] erofs: dax options not supported [ 38.494735][ T880] erofs: dax options not supported [ 38.500770][ T880] erofs: dax options not supported [ 38.509740][ T880] erofs: dax options not supported [ 38.515004][ T880] erofs: dax options not supported [ 38.520228][ T880] erofs: dax options not supported [ 38.530704][ T880] erofs: dax options not supported [ 38.535979][ T880] erofs: dax options not supported [ 38.541175][ T880] erofs: dax options not supported [ 38.546387][ T880] erofs: dax options not supported [ 38.582790][ T36] audit: type=1400 audit(1761563719.116:269): avc: denied { map } for pid=899 comm="syz.3.181" path="socket:[6131]" dev="sockfs" ino=6131 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 38.612959][ T904] rust_binder: 115: no such ref 1 [ 38.646817][ T36] audit: type=1400 audit(1761563719.175:270): avc: denied { setopt } for pid=907 comm="syz.3.184" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 38.691314][ T917] rust_binder: Write failure EINVAL in pid:128 [ 38.742257][ T65] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 38.923775][ T65] usb 3-1: Using ep0 maxpacket: 32 [ 38.930144][ T65] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 38.938392][ T65] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 38.948502][ T65] usb 3-1: config 0 has no interface number 0 [ 38.954598][ T65] usb 3-1: config 0 interface 196 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 38.967655][ T65] usb 3-1: config 0 interface 196 has no altsetting 0 [ 38.976092][ T65] usb 3-1: New USB device found, idVendor=05ac, idProduct=97c2, bcdDevice=eb.3a [ 38.985212][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 38.993193][ T65] usb 3-1: Product: syz [ 38.997393][ T65] usb 3-1: Manufacturer: syz [ 39.002104][ T65] usb 3-1: SerialNumber: syz [ 39.007446][ T65] usb 3-1: config 0 descriptor?? [ 39.015480][ T65] ipheth 3-1:0.196: Unable to find endpoints [ 39.219178][ T330] usb 3-1: USB disconnect, device number 9 [ 39.659426][ T65] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 39.811836][ T65] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.822993][ T65] usb 2-1: New USB device found, idVendor=046d, idProduct=c50c, bcdDevice= 0.00 [ 39.832075][ T65] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.840564][ T65] usb 2-1: config 0 descriptor?? [ 40.042365][ T476] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 40.196006][ T476] usb 4-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 40.205117][ T476] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 40.213105][ T476] usb 4-1: Product: syz [ 40.217325][ T476] usb 4-1: Manufacturer: syz [ 40.221920][ T476] usb 4-1: SerialNumber: syz [ 40.228905][ T476] r8152-cfgselector 4-1: Unknown version 0x0000 [ 40.235177][ T476] r8152-cfgselector 4-1: config 0 descriptor?? [ 40.253952][ T65] logitech 0003:046D:C50C.0002: hidraw0: USB HID v1.00 Device [HID 046d:c50c] on usb-dummy_hcd.1-1/input0 [ 40.448450][ T45] r8152-cfgselector 4-1: USB disconnect, device number 12 [ 40.501857][ T953] __vm_enough_memory: pid: 953, comm: syz.3.198, bytes: 18014402804453376 not enough memory for the allocation [ 40.514991][ T932] rust_binder: Got transaction with invalid offset. [ 40.515032][ T932] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 40.527510][ T932] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:98 [ 40.588366][ T962] input: syz1 as /devices/virtual/input/input8 [ 40.599138][ T330] usb 2-1: USB disconnect, device number 8 [ 40.606947][ T329] tipc: Subscription rejected, illegal request [ 40.623103][ T962] rust_binder: Write failure EFAULT in pid:167 [ 40.633805][ T965] netlink: 164 bytes leftover after parsing attributes in process `syz.2.202'. [ 40.679994][ T969] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 40.682040][ T969] rust_binder: Error while translating object. [ 40.688521][ T969] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 40.694713][ T969] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:163 [ 40.716880][ T971] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 40.726067][ T971] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:165 [ 40.735635][ T971] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 40.744883][ T971] rust_binder: Read failure Err(EFAULT) in pid:165 [ 40.794279][ T980] 9pnet_fd: Insufficient options for proto=fd [ 40.807854][ T980] fuse: Unknown parameter 'ser_s;Fid' [ 40.816351][ T980] 9pnet_fd: Insufficient options for proto=fd [ 40.818893][ T476] usb 1-1: USB disconnect, device number 7 [ 40.823271][ T980] netlink: 5 bytes leftover after parsing attributes in process `syz.2.209'. [ 40.898367][ T994] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 40.898402][ T994] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:197 [ 40.900508][ T987] rust_binder: validate_parent_fixup: fixup_min_offset=46, parent_offset=37 [ 40.917279][ T987] rust_binder: Error while translating object. [ 40.926319][ T987] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 40.927531][ T996] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 40.932863][ T987] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:180 [ 40.941926][ T996] IPv6: NLM_F_CREATE should be set when creating new route [ 40.941947][ T996] IPv6: NLM_F_CREATE should be set when creating new route [ 40.979742][ T996] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 41.110805][ T1009] af_packet: tpacket_rcv: packet too big, clamped from 1 to 4294967272. macoff=96 [ 41.126786][ T1009] rust_binder: BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 41.186864][ T1018] rust_binder: Failed to allocate buffer. len:4224, is_oneway:false [ 41.186884][ T1018] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 41.194994][ T1018] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:107 [ 41.877071][ T1025] random: crng reseeded on system resumption [ 41.892840][ T329] Bluetooth: hci1: Frame reassembly failed (-84) [ 42.178911][ T1030] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.194118][ T1035] cgroup: No subsys list or none specified [ 42.196185][ T1032] cgroup: Unknown subsys name 'fd' [ 42.200647][ T36] kauditd_printk_skb: 18 callbacks suppressed [ 42.200660][ T36] audit: type=1400 audit(1761563722.698:289): avc: denied { mounton } for pid=1031 comm="syz.0.228" path="/72/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 42.206840][ T1032] cgroup: Unknown subsys name 'fd' [ 42.220237][ T1034] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.239982][ T1032] cgroup: Unknown subsys name 'fd' [ 42.249650][ T1034] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 42.251534][ T1032] cgroup: Unknown subsys name 'fd' [ 42.257097][ T1034] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:113 [ 42.262934][ T1032] cgroup: Unknown subsys name 'fd' [ 42.269995][ T36] audit: type=1400 audit(1761563722.768:290): avc: denied { lock } for pid=1033 comm="syz.1.229" path="socket:[7078]" dev="sockfs" ino=7078 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 42.277188][ T1032] cgroup: Unknown subsys name 'fd' [ 42.299016][ T36] audit: type=1400 audit(1761563722.787:291): avc: denied { setopt } for pid=1039 comm="syz.1.230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 42.320503][ T1032] cgroup: Unknown subsys name 'fd' [ 42.349355][ T36] audit: type=1400 audit(1761563722.847:292): avc: denied { getopt } for pid=1045 comm="syz.0.231" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 42.355511][ T1047] rust_binder: Failed to allocate buffer. len:152, is_oneway:false [ 42.388477][ T1051] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 42.404650][ T1051] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 42.428034][ T1053] rust_binder: got new transaction with bad transaction stack [ 42.428055][ T1053] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:223 [ 42.478681][ T36] audit: type=1400 audit(1761563722.976:293): avc: denied { create } for pid=1059 comm="syz.1.236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 42.514940][ T1062] rust_binder: Write failure EFAULT in pid:122 [ 42.518200][ T1062] rust_binder: Failed to allocate buffer. len:4224, is_oneway:true [ 42.524481][ T1062] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 42.532785][ T1062] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:122 [ 42.793058][ T45] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 42.853474][ T54] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 42.955346][ T45] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 42.966990][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 42.977890][ T45] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 42.987641][ T45] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 43.000519][ T45] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 43.009565][ T45] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 43.018221][ T45] usb 1-1: config 0 descriptor?? [ 43.084802][ T1073] exFAT-fs (rnullb0): invalid boot record signature [ 43.091460][ T1073] exFAT-fs (rnullb0): failed to read boot sector [ 43.097991][ T1073] exFAT-fs (rnullb0): failed to recognize exfat type [ 43.218329][ T329] bridge_slave_1: left allmulticast mode [ 43.224755][ T329] bridge_slave_1: left promiscuous mode [ 43.231666][ T329] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.239740][ T329] bridge_slave_0: left allmulticast mode [ 43.245605][ T329] bridge_slave_0: left promiscuous mode [ 43.251487][ T329] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.327734][ T36] audit: type=1400 audit(1761563723.830:294): avc: denied { mounton } for pid=1080 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 43.393509][ T1080] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.407646][ T1080] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.414755][ T1080] bridge_slave_0: entered allmulticast mode [ 43.421039][ T1080] bridge_slave_0: entered promiscuous mode [ 43.427983][ T329] veth1_macvtap: left promiscuous mode [ 43.433489][ T329] veth0_vlan: left promiscuous mode [ 43.460330][ T1071] netlink: 20 bytes leftover after parsing attributes in process `syz.0.240'. [ 43.472904][ T45] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 43.483541][ T1080] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.490974][ T1080] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.498625][ T45] plantronics 0003:047F:FFFF.0003: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 43.512429][ T1080] bridge_slave_1: entered allmulticast mode [ 43.518839][ T1080] bridge_slave_1: entered promiscuous mode [ 43.564146][ T1080] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.571206][ T1080] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.578471][ T1080] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.585519][ T1080] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.609126][ T1099] netlink: 'syz.3.248': attribute type 4 has an invalid length. [ 43.616817][ T1099] netlink: 17 bytes leftover after parsing attributes in process `syz.3.248'. [ 43.636523][ T339] bridge0: port 1(bridge_slave_0) entered disabled state [ 43.646448][ T339] bridge0: port 2(bridge_slave_1) entered disabled state [ 43.656018][ T339] bridge0: port 1(bridge_slave_0) entered blocking state [ 43.663085][ T339] bridge0: port 1(bridge_slave_0) entered forwarding state [ 43.672259][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 43.679316][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 43.710910][ T1080] veth0_vlan: entered promiscuous mode [ 43.724255][ T1080] veth1_macvtap: entered promiscuous mode [ 43.747654][ T36] audit: type=1400 audit(1761563724.237:295): avc: denied { mounton } for pid=1080 comm="syz-executor" path="/root/syzkaller.cYn9Nx/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 43.807441][ T36] audit: type=1400 audit(1761563724.296:296): avc: denied { mount } for pid=1105 comm="syz.4.249" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 43.810290][ T1106] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 43.829829][ T36] audit: type=1400 audit(1761563724.296:297): avc: denied { mounton } for pid=1105 comm="syz.4.249" path="/1/file0" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 43.842889][ T1106] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 43.871689][ T36] audit: type=1400 audit(1761563724.366:298): avc: denied { read } for pid=1105 comm="syz.4.249" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 43.981710][ T640] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 44.067187][ T1109] SELinux: security_context_str_to_sid () failed with errno=-22 [ 44.067466][ T1110] SELinux: security_context_str_to_sid () failed with errno=-22 [ 44.303695][ T1114] rust_binder: Write failure EFAULT in pid:180 [ 44.542546][ T45] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 44.702528][ T45] usb 4-1: Using ep0 maxpacket: 32 [ 44.709102][ T45] usb 4-1: config 4 has an invalid interface number: 128 but max is 0 [ 44.717317][ T45] usb 4-1: config 4 has no interface number 0 [ 44.723860][ T45] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 44.735066][ T330] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 44.742703][ T45] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 44.752719][ T45] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 44.761901][ T45] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.774620][ T45] hub 4-1:4.128: USB hub found [ 44.809452][ T1119] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 1 [ 44.816629][ T1119] rust_binder: Write failure EINVAL in pid:12 [ 44.913376][ T330] usb 3-1: config 0 interface 0 has no altsetting 0 [ 44.926116][ T330] usb 3-1: New USB device found, idVendor=0458, idProduct=501b, bcdDevice= 0.00 [ 44.935174][ T330] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 44.943957][ T330] usb 3-1: config 0 descriptor?? [ 44.971952][ T45] hub 4-1:4.128: 2 ports detected [ 44.977050][ T45] hub 4-1:4.128: Using single TT (err -22) [ 45.112359][ T475] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 45.153942][ T330] usbhid 3-1:0.0: can't add hid device: -71 [ 45.159958][ T330] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 45.169367][ T330] usb 3-1: USB disconnect, device number 10 [ 45.242340][ T475] usb 5-1: device descriptor read/64, error -71 [ 45.310933][ T1142] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 45.326023][ T1143] overlayfs: failed to get index nlink (file1/file0, err=-61) [ 45.326114][ T1142] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 45.502363][ T475] usb 5-1: device descriptor read/64, error -71 [ 45.562863][ T476] usb 1-1: USB disconnect, device number 8 [ 45.579475][ T45] usb 4-1: USB disconnect, device number 13 [ 45.692345][ T65] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 45.699470][ T1154] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found [ 45.710978][ T1154] rust_binder: Write failure EINVAL in pid:245 [ 45.738886][ T1163] rust_binder: Error while translating object. [ 45.745577][ T1163] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 45.751851][ T1163] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:254 [ 45.761551][ T475] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 45.831165][ T1172] fuse: Bad value for 'fd' [ 45.846481][ T1174] 9pnet_fd: Insufficient options for proto=fd [ 45.853723][ T65] usb 3-1: config 0 has an invalid interface number: 214 but max is 0 [ 45.861896][ T65] usb 3-1: config 0 has no interface number 0 [ 45.870526][ T65] usb 3-1: config 0 interface 214 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 45.887490][ T65] usb 3-1: config 0 interface 214 has no altsetting 0 [ 45.895675][ T65] usb 3-1: New USB device found, idVendor=07c9, idProduct=000e, bcdDevice=5d.4f [ 45.904899][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.912972][ T65] usb 3-1: Product: syz [ 45.917130][ T65] usb 3-1: Manufacturer: syz [ 45.921699][ T65] usb 3-1: SerialNumber: syz [ 45.922345][ T475] usb 5-1: device descriptor read/64, error -71 [ 45.927015][ T65] usb 3-1: config 0 descriptor?? [ 45.938273][ T1151] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 46.146549][ T1151] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 46.182330][ T475] usb 5-1: device descriptor read/64, error -71 [ 46.292464][ T475] usb usb5-port1: attempt power cycle [ 46.622035][ T1186] netlink: 4 bytes leftover after parsing attributes in process `syz.3.276'. [ 46.632340][ T475] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 46.662320][ T475] usb 5-1: device descriptor read/8, error -71 [ 46.760948][ T1195] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.761142][ T1197] rust_binder: Write failure EINVAL in pid:199 [ 46.795259][ T475] usb 5-1: device descriptor read/8, error -71 [ 46.857001][ T1203] rust_binder: Read failure Err(EAGAIN) in pid:271 [ 46.868085][ T1206] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 46.888172][ T1206] rust_binder: Write failure EINVAL in pid:205 [ 46.904810][ T1210] tipc: Enabling of bearer rejected, failed to enable media [ 46.919922][ T1210] process 'syz.3.285' launched './file0' with NULL argv: empty string added [ 46.972778][ T1220] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 46.979288][ T1222] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 46.980368][ T1220] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 47.042372][ T475] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 47.073496][ T475] usb 5-1: device descriptor read/8, error -71 [ 47.118934][ T1231] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 136, limit: 224, size: 226) [ 47.118958][ T1231] rust_binder: Error while translating object. [ 47.129544][ T1231] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 47.135816][ T1231] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:287 [ 47.208162][ T475] usb 5-1: device descriptor read/8, error -71 [ 47.226317][ T45] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 47.289305][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -32 [ 47.302463][ T36] kauditd_printk_skb: 16 callbacks suppressed [ 47.302480][ T36] audit: type=1400 audit(1761596495.797:315): avc: denied { create } for pid=1241 comm="syz.0.296" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 47.303293][ T1242] rust_binder: Error while translating object. [ 47.329095][ T1242] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 47.335322][ T1242] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:298 [ 47.344704][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0006: -32 [ 47.352392][ T475] usb usb5-port1: unable to enumerate USB device [ 47.353784][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): invalid MAC address, using random [ 47.382314][ T45] usb 4-1: Using ep0 maxpacket: 8 [ 47.388852][ T45] usb 4-1: unable to get BOS descriptor or descriptor too short [ 47.402488][ T45] usb 4-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 47.412428][ T45] usb 4-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 47.422171][ T45] usb 4-1: config 8 interface 0 has no altsetting 0 [ 47.430408][ T45] usb 4-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 47.439555][ T45] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.447584][ T45] usb 4-1: Product: syz [ 47.451957][ T45] usb 4-1: Manufacturer: syz [ 47.456843][ T45] usb 4-1: SerialNumber: syz [ 47.662818][ T1222] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 47.662848][ T1222] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 47.670794][ T1222] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:212 [ 47.683674][ T45] usb 4-1: selecting invalid altsetting 0 [ 47.701706][ T45] snd-usb-audio 4-1:8.0: probe with driver snd-usb-audio failed with error -12 [ 47.711848][ T45] usb 4-1: USB disconnect, device number 14 [ 47.720191][ T344] udevd[344]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:8.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 47.862343][ T617] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 47.883386][ T36] audit: type=1400 audit(1761596496.377:316): avc: denied { write } for pid=1249 comm="syz.4.299" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 48.019021][ T1255] rust_binder: Error while translating object. [ 48.019051][ T1255] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 48.022319][ T617] usb 1-1: Using ep0 maxpacket: 16 [ 48.025411][ T1255] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:21 [ 48.035815][ T617] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 48.065955][ T617] usb 1-1: config 0 has no interfaces? [ 48.072790][ T617] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 48.081981][ T617] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 48.091061][ T617] usb 1-1: SerialNumber: syz [ 48.099530][ T617] usb 1-1: config 0 descriptor?? [ 48.221101][ T1268] exFAT-fs (rnullb0): invalid boot record signature [ 48.227868][ T1268] exFAT-fs (rnullb0): failed to read boot sector [ 48.234279][ T1268] exFAT-fs (rnullb0): failed to recognize exfat type [ 48.252206][ T1270] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.282250][ T1277] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.289306][ T36] audit: type=1400 audit(1761596496.777:317): avc: denied { ioctl } for pid=1276 comm="syz.3.308" path="socket:[8704]" dev="sockfs" ino=8704 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 48.296130][ T1277] rust_binder: validate_parent_fixup: fixup_min_offset=46, parent_offset=35 [ 48.320509][ T1277] rust_binder: Error while translating object. [ 48.327373][ T617] usb 1-1: USB disconnect, device number 9 [ 48.331442][ T1277] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 48.345706][ T1277] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:228 [ 48.442473][ T1293] binder: Bad value for 'defcontext' [ 48.468953][ T36] audit: type=1400 audit(1761596496.957:318): avc: denied { write } for pid=1296 comm="syz.0.314" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 48.491047][ T1298] rust_binder: Write failure EFAULT in pid:312 [ 48.584835][ T1309] input: syz0 as /devices/virtual/input/input10 [ 48.654657][ T1311] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.659132][ T1311] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 48.832314][ T617] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 48.943129][ T1317] loop2: detected capacity change from 0 to 7 [ 48.949542][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 48.958815][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 48.966760][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 48.975984][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 48.983879][ T1317] loop2: unable to read partition table [ 48.989652][ T1317] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 48.990949][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 49.012253][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 49.020496][ T617] usb 1-1: Using ep0 maxpacket: 8 [ 49.026678][ T617] usb 1-1: config 0 interface 0 altsetting 32 endpoint 0x81 has invalid wMaxPacketSize 0 [ 49.036568][ T617] usb 1-1: config 0 interface 0 has no altsetting 0 [ 49.043206][ T617] usb 1-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00 [ 49.052245][ T617] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.052394][ T1317] loop2: detected capacity change from 7 to 4 [ 49.063129][ T617] usb 1-1: config 0 descriptor?? [ 49.072406][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 49.081564][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 49.089903][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 49.090431][ T1319] /dev/rnullb0: Can't open blockdev [ 49.099053][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 49.101187][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 49.121198][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 49.132710][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 49.141851][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 49.174275][ T36] audit: type=1400 audit(1761596497.667:319): avc: denied { ioctl } for pid=1320 comm="syz.4.322" path="socket:[8910]" dev="sockfs" ino=8910 ioctlcmd=0x7459 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 49.220708][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -32 [ 49.232670][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -32 [ 49.245696][ T1328] overlayfs: failed to clone upperpath [ 49.444202][ T1151] binder: Unknown parameter 'ma000000sGl[%bv-m' [ 49.452056][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 49.463182][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0040: -71 [ 49.474283][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 49.485862][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 49.497251][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001e: -71 [ 49.502573][ T475] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 49.509345][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x001a: -71 [ 49.526751][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x001c: -71 [ 49.540649][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001a: -71 [ 49.553891][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001c: -71 [ 49.565093][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 49.576391][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 49.590032][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 49.601872][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0019: -71 [ 49.612847][ T617] usbhid 1-1:0.0: can't add hid device: -71 [ 49.618786][ T617] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 49.624869][ T36] audit: type=1326 audit(1761596498.117:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1353 comm="syz.3.333" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7d3e98efc9 code=0x0 [ 49.626770][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 49.660932][ T617] usb 1-1: USB disconnect, device number 10 [ 49.667938][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 49.672334][ T475] usb 5-1: Using ep0 maxpacket: 8 [ 49.679177][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 49.686302][ T475] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 243, changing to 11 [ 49.694964][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 49.706186][ T475] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 8 [ 49.719021][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x000e: -71 [ 49.726488][ T475] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 49.737706][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 49.748754][ T475] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 49.758494][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 49.767380][ T475] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.778474][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 49.785957][ T475] usb 5-1: Product: 峽늸㥵ꂐ괛왅쉛“瀒ृ೻淣ᕁ嫘檫ꘔ柁ወ뜑⤪࠺峬爅깬쥝饻컮䔶徿챮狯虖髣㉀䁉⼏阘芇꾍䋞삾폞㒄텍찧쌸Ȕ [ 49.797223][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 49.814188][ T475] usb 5-1: Manufacturer: k [ 49.825580][ T65] ax88179_178a 3-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 49.830213][ T475] usb 5-1: SerialNumber: й [ 49.842324][ T65] ax88179_178a 3-1:0.214 eth1: register 'ax88179_178a' at usb-dummy_hcd.2-1, AT-UMC2000 USB 3.0/USB 3.1 Gen 1 to Gigabit Ethernet Adapter, 26:31:cc:0d:df:d3 [ 49.863090][ T65] usb 3-1: USB disconnect, device number 11 [ 49.874317][ T65] ax88179_178a 3-1:0.214 eth1: unregister 'ax88179_178a' usb-dummy_hcd.2-1, AT-UMC2000 USB 3.0/USB 3.1 Gen 1 to Gigabit Ethernet Adapter [ 49.876571][ T36] audit: type=1400 audit(1761596498.367:321): avc: denied { read } for pid=149 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 50.001719][ T36] audit: type=1400 audit(1761596498.487:322): avc: denied { name_bind } for pid=1361 comm="syz.2.335" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 50.050149][ T339] Bluetooth: hci0: Frame reassembly failed (-84) [ 50.059365][ T475] cdc_ncm 5-1:1.0: bind() failure [ 50.065220][ T475] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 50.072013][ T475] cdc_ncm 5-1:1.1: bind() failure [ 50.080729][ T475] usb 5-1: USB disconnect, device number 6 [ 50.362338][ T65] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 50.382328][ T617] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 50.474499][ T1383] netlink: 'syz.3.340': attribute type 46 has an invalid length. [ 50.482243][ T1383] netlink: 'syz.3.340': attribute type 28 has an invalid length. [ 50.512365][ T617] usb 1-1: device descriptor read/64, error -71 [ 50.519657][ T65] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 50.527813][ T65] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 50.537954][ T65] usb 3-1: config 0 has no interface number 0 [ 50.545354][ T65] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 50.554468][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 50.562614][ T65] usb 3-1: Product: syz [ 50.566804][ T65] usb 3-1: Manufacturer: syz [ 50.571458][ T65] usb 3-1: SerialNumber: syz [ 50.576658][ T65] usb 3-1: config 0 descriptor?? [ 50.752320][ T617] usb 1-1: device descriptor read/64, error -71 [ 50.784585][ T1363] rust_binder: Error while translating object. [ 50.784614][ T1363] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 50.790822][ T1363] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:225 [ 50.992324][ T617] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 51.132356][ T617] usb 1-1: device descriptor read/64, error -71 [ 51.141387][ T36] audit: type=1400 audit(1761596499.627:323): avc: denied { create } for pid=1393 comm="syz.3.344" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 51.143326][ T1394] overlayfs: missing 'lowerdir' [ 51.183560][ T1396] overlayfs: failed to resolve './file1/file0': -2 [ 51.259708][ T1401] x_tables: unsorted underflow at hook 2 [ 51.283588][ T36] audit: type=1400 audit(1761596499.777:324): avc: denied { read } for pid=1402 comm="syz.3.347" name="file0" dev="tmpfs" ino=620 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 51.372335][ T617] usb 1-1: device descriptor read/64, error -71 [ 51.482432][ T617] usb usb1-port1: attempt power cycle [ 51.822408][ T617] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 51.843310][ T617] usb 1-1: device descriptor read/8, error -71 [ 51.973282][ T617] usb 1-1: device descriptor read/8, error -71 [ 52.062928][ T640] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 52.063218][ T54] Bluetooth: hci0: command 0x1003 tx timeout [ 52.212365][ T617] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 52.233293][ T617] usb 1-1: device descriptor read/8, error -71 [ 52.383276][ T617] usb 1-1: device descriptor read/8, error -71 [ 52.492430][ T617] usb usb1-port1: unable to enumerate USB device [ 52.512347][ T45] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 52.670959][ T45] usb 5-1: unable to get BOS descriptor or descriptor too short [ 52.676797][ T1442] netlink: 'syz.3.358': attribute type 12 has an invalid length. [ 52.679072][ T45] usb 5-1: not running at top speed; connect to a high speed hub [ 52.687982][ T1442] 9pnet_fd: Insufficient options for proto=fd [ 52.694971][ T45] usb 5-1: config 13 has an invalid interface number: 90 but max is 0 [ 52.709017][ T45] usb 5-1: config 13 has no interface number 0 [ 52.715228][ T45] usb 5-1: config 13 interface 90 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 52.730127][ T45] usb 5-1: New USB device found, idVendor=0499, idProduct=100d, bcdDevice=81.b7 [ 52.739214][ T45] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.747257][ T45] usb 5-1: Product: syz [ 52.751432][ T45] usb 5-1: Manufacturer: syz [ 52.756219][ T45] usb 5-1: SerialNumber: syz [ 52.851027][ T1460] incfs: Backing dir is not set, filesystem can't be mounted. [ 52.851320][ T1461] incfs: Backing dir is not set, filesystem can't be mounted. [ 52.858738][ T1460] incfs: mount failed -2 [ 52.866488][ T1461] incfs: mount failed -2 [ 52.967023][ T1435] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 52.981702][ T45] usb 5-1: USB disconnect, device number 7 [ 53.003735][ T65] usb 3-1: USB disconnect, device number 12 [ 53.021413][ T1470] rust_binder: Failed to allocate buffer. len:4208, is_oneway:false [ 53.048018][ T1476] input: syz1 as /devices/virtual/input/input11 [ 53.162766][ T1479] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 53.162786][ T1479] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:326 [ 53.299790][ T36] audit: type=1400 audit(1761596501.787:325): avc: denied { connect } for pid=1486 comm="syz.0.373" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 53.330080][ T36] audit: type=1400 audit(1761596501.817:326): avc: denied { nlmsg_write } for pid=1488 comm="syz.0.374" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 53.388336][ T1497] rust_binder: Error while translating object. [ 53.388368][ T1497] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 53.394587][ T1497] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:344 [ 53.415029][ T1499] input: syz1 as /devices/virtual/input/input12 [ 53.443332][ T1501] SELinux: security_context_str_to_sid (sytem_uGй :) failed with errno=-22 [ 53.463121][ T36] audit: type=1400 audit(1761596501.957:327): avc: denied { append } for pid=1505 comm="syz.0.380" name="event2" dev="devtmpfs" ino=209 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 53.502956][ T1510] rust_binder: Write failure EFAULT in pid:65 [ 53.598866][ T36] audit: type=1400 audit(1761596502.088:328): avc: denied { write } for pid=1521 comm="syz.0.387" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 53.629387][ T1525] 9pnet_fd: Insufficient options for proto=fd [ 53.634185][ T1527] veth0_to_batadv: entered allmulticast mode [ 53.642436][ T1527] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1527 comm=syz.0.389 [ 53.655164][ T1527] rust_binder: Write failure EINVAL in pid:366 [ 53.673648][ T1533] rust_binder: Error while translating object. [ 53.679838][ T1533] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 53.696163][ T1533] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:371 [ 53.716305][ T1535] syz.0.392 (1535) used obsolete PPPIOCDETACH ioctl [ 53.739113][ T36] audit: type=1400 audit(1761596502.229:329): avc: denied { getopt } for pid=1536 comm="syz.3.393" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 53.765781][ T1542] netlink: 'syz.3.394': attribute type 4 has an invalid length. [ 53.773543][ T1542] netlink: 17 bytes leftover after parsing attributes in process `syz.3.394'. [ 53.807116][ T36] audit: type=1400 audit(1761596502.300:330): avc: denied { ioctl } for pid=1548 comm="syz.3.396" path="socket:[10055]" dev="sockfs" ino=10055 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 53.850332][ T1556] rust_binder: Error while translating object. [ 53.850380][ T1556] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 53.856596][ T1556] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:378 [ 53.890627][ T1564] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 53.916817][ T1568] netlink: 152 bytes leftover after parsing attributes in process `syz.2.404'. [ 53.959275][ T1575] fuse: Unknown parameter 'uid<00000000000000000000' [ 54.187066][ T65] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 54.335909][ T65] usb 3-1: Using ep0 maxpacket: 8 [ 54.342448][ T65] usb 3-1: unable to get BOS descriptor or descriptor too short [ 54.350882][ T65] usb 3-1: config 4 has an invalid interface number: 147 but max is 0 [ 54.359114][ T65] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 54.369261][ T65] usb 3-1: config 4 has no interface number 0 [ 54.377904][ T65] usb 3-1: string descriptor 0 read error: -22 [ 54.382050][ T36] audit: type=1400 audit(1761596502.874:331): avc: denied { write } for pid=1576 comm="syz.3.407" path="socket:[10380]" dev="sockfs" ino=10380 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 54.384216][ T65] usb 3-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 54.416866][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.490190][ T1595] netlink: 224 bytes leftover after parsing attributes in process `syz.3.412'. [ 54.492701][ T36] audit: type=1400 audit(1761596502.985:332): avc: denied { nlmsg_read } for pid=1594 comm="syz.3.412" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 54.597651][ T1605] netlink: 328 bytes leftover after parsing attributes in process `syz.4.415'. [ 54.630490][ T1574] rust_binder: Error while translating object. [ 54.630519][ T1574] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 54.636860][ T1574] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:245 [ 54.648895][ T617] usb 3-1: USB disconnect, device number 13 [ 54.673019][ T36] audit: type=1400 audit(1761596503.166:333): avc: denied { read write } for pid=1606 comm="syz.4.416" name="uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 54.677333][ T1607] netlink: 188 bytes leftover after parsing attributes in process `syz.4.416'. [ 54.696453][ T36] audit: type=1400 audit(1761596503.166:334): avc: denied { open } for pid=1606 comm="syz.4.416" path="/dev/uhid" dev="devtmpfs" ino=199 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 54.728660][ T1564] overlayfs: statfs failed on './file0' [ 54.765037][ T1614] binder: Bad value for 'stats' [ 54.770108][ T1614] binder: Bad value for 'stats' [ 54.781272][ T1616] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 54.873263][ T1626] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.100620][ T1653] capability: warning: `syz.3.432' uses 32-bit capabilities (legacy support in use) [ 55.143158][ T1662] 9pnet_fd: Insufficient options for proto=fd [ 55.180135][ T1670] netlink: 20 bytes leftover after parsing attributes in process `syz.2.438'. [ 55.189701][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.189725][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.196298][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.202786][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.209291][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.215757][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.222272][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.228727][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.235304][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.241968][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.248457][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.255068][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.261681][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.268405][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.278082][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.295727][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.302217][ T65] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 55.318402][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.318426][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.324855][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.334016][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.341016][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.347515][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.354000][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.360469][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.366891][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.373508][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.380044][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.386540][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.393092][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.399649][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.406068][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.412801][ T1671] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.487997][ T65] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 55.517552][ T65] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 55.527902][ T65] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 55.537090][ T65] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 55.548315][ T65] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 55.560382][ T65] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 55.569509][ T65] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 55.577581][ T65] usb 1-1: Product: syz [ 55.583378][ T65] usb 1-1: Manufacturer: syz [ 55.591921][ T65] cdc_wdm 1-1:1.0: skipping garbage [ 55.597230][ T65] cdc_wdm 1-1:1.0: skipping garbage [ 55.603572][ T65] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 55.609539][ T65] cdc_wdm 1-1:1.0: Unknown control protocol [ 55.653847][ T1716] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 55.653915][ T1717] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:87 [ 55.660562][ T1716] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:87 [ 55.666001][ T1717] rust_binder: Write failure EINVAL in pid:87 [ 55.680946][ T1716] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch [ 55.696266][ T1716] rust_binder: Write failure EINVAL in pid:87 [ 55.721565][ T1725] binder: Bad value for 'defcontext' [ 55.756682][ T1735] rust_binder: Write failure EFAULT in pid:94 [ 55.764800][ T1739] SELinux: Context system_u:object_r:apt_var_log_t:s0 is not valid (left unmapped). [ 55.778754][ T1742] tipc: Enabling of bearer rejected, failed to enable media [ 55.792944][ T65] usb 1-1: USB disconnect, device number 15 [ 55.841637][ T1755] binder: Unknown parameter 'seMlabel' [ 55.878870][ T1760] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 55.878894][ T1760] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:110 [ 56.007009][ T1771] binder: Unknown parameter 'context[7' [ 56.281266][ T1791] IPv6: NLM_F_CREATE should be specified when creating new route [ 56.309462][ T1795] rust_binder: Got transaction with invalid offset. [ 56.309488][ T1795] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 56.316273][ T1795] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:408 [ 56.337038][ T339] Bluetooth: hci1: Frame reassembly failed (-84) [ 56.529167][ T65] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 56.589957][ T1806] overlayfs: failed to clone upperpath [ 56.679206][ T65] usb 3-1: config 1 interface 0 altsetting 129 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 56.692335][ T65] usb 3-1: config 1 interface 0 has no altsetting 0 [ 56.700520][ T65] usb 3-1: New USB device found, idVendor=046d, idProduct=00fe, bcdDevice= 0.40 [ 56.709608][ T65] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.717588][ T65] usb 3-1: Product: 忿瑋縉햴⎻ᐳ덌ᮣ턖ᄔ歆檮鏋ꘆ⨝鰥衩ᾥ柘줩祳郠纕萀 [ 56.728306][ T65] usb 3-1: Manufacturer: 艭꜆đ葡嫬磊驃씨扴伀왑⨄꜑ᜂ㸜㈖ứ䪕鵦쩩ꀯ㣲鵲韻츁챬㿭閪Խ㻿휻덁ѕ뵱楨뀦鋗뭬篤噸겕揲聫ᾼ䞄὇鹔遪ﶝꛪ鄮衁⨁愕ퟔ缑৬๴逦䃕봟㲖걣僪ﳎ뽪繱ዴ쾩쵐䪁ᰕ䒨瘜豏䶊麘ἒ꺽驔㸤ꚭჯ佶䈪箭➨异䰺ꉔ㮕鐟ﺆ㣞㻎᥽곫돜ꈙ⦂켺䜸˙焐ֆ糪⿑ᘁ㒢즡濤㜤砆 [ 56.764050][ T65] usb 3-1: SerialNumber: 、 [ 56.942551][ T1828] Zero length message leads to an empty skb [ 57.010485][ T1831] overlayfs: failed to clone upperpath [ 57.026646][ T1832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.035179][ T1832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.043829][ T1793] rust_binder: Write failure EFAULT in pid:268 [ 57.047336][ T65] usbhid 3-1:1.0: can't add hid device: -71 [ 57.059596][ T65] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 57.068414][ T65] usb 3-1: USB disconnect, device number 14 [ 57.794357][ T1839] SELinux: security_context_str_to_sid (E) failed with errno=-22 [ 58.107515][ T639] Bluetooth: hci0: command 0x1003 tx timeout [ 58.107515][ T640] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 58.130479][ T1841] rust_binder: Write failure EFAULT in pid:117 [ 58.150000][ T1846] rust_binder: Failed to allocate buffer. len:8, is_oneway:true [ 58.156357][ T1846] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 58.164027][ T1846] rust_binder: Read failure Err(EFAULT) in pid:121 [ 58.355685][ T54] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 58.368371][ T640] Bluetooth: hci1: command 0x1003 tx timeout [ 58.554249][ T45] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 58.713089][ T45] usb 5-1: Using ep0 maxpacket: 16 [ 58.744644][ T45] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 58.753748][ T45] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.761738][ T45] usb 5-1: Product: syz [ 58.766083][ T45] usb 5-1: Manufacturer: syz [ 58.770694][ T45] usb 5-1: SerialNumber: syz [ 58.778499][ T45] r8152-cfgselector 5-1: Unknown version 0x0000 [ 58.784936][ T45] r8152-cfgselector 5-1: config 0 descriptor?? [ 58.933343][ T36] kauditd_printk_skb: 12 callbacks suppressed [ 58.933373][ T36] audit: type=1400 audit(1761596507.468:347): avc: denied { mounton } for pid=1858 comm="syz.0.506" path="/144/file0" dev="ramfs" ino=12658 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 59.011468][ T1866] overlayfs: conflicting options: metacopy=off,verity=require [ 59.091358][ T1877] 9pnet: p9_errstr2errno: server reported unknown error 184467440 [ 59.099949][ T1877] rust_binder: validate_parent_fixup: fixup_min_offset=46, parent_offset=35 [ 59.099972][ T1877] rust_binder: Error while translating object. [ 59.108734][ T1877] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 59.115006][ T1877] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:435 [ 59.125157][ T1877] 9pnet_fd: Insufficient options for proto=fd [ 59.232388][ T1881] rust_binder: Failed copying remainder into alloc: EFAULT [ 59.232411][ T1881] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 59.239873][ T1881] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 59.248216][ T1881] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:439 [ 59.283904][ T31] r8152-cfgselector 5-1: USB disconnect, device number 8 [ 59.626471][ T1028] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 59.632614][ T54] Bluetooth: hci2: command 0x1003 tx timeout [ 59.711072][ T1895] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 152, size: 18446744073709551507) [ 59.711099][ T1895] rust_binder: Error while translating object. [ 59.723344][ T1895] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 59.729584][ T1895] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:451 [ 59.778830][ T36] audit: type=1400 audit(1761596508.304:348): avc: denied { listen } for pid=1892 comm="syz.2.519" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 59.808213][ T1898] binder: Unknown parameter '' [ 59.837205][ T36] audit: type=1400 audit(1761596508.314:349): avc: denied { getopt } for pid=1904 comm="syz.0.522" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 59.883367][ T36] audit: type=1400 audit(1761596508.314:350): avc: denied { ioctl } for pid=1904 comm="syz.0.522" path="socket:[12860]" dev="sockfs" ino=12860 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 60.019958][ T1912] overlayfs: overlapping lowerdir path [ 60.130578][ T1921] GUP no longer grows the stack in syz.4.528 (1921): 200000001000-200000c01000 (200000000000) [ 60.140980][ T1921] CPU: 0 UID: 0 PID: 1921 Comm: syz.4.528 Not tainted syzkaller #0 0b5ffdee5fcd2f7749818d1ff954e9c21353764e [ 60.141027][ T1921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 60.141047][ T1921] Call Trace: [ 60.141054][ T1921] [ 60.141062][ T1921] __dump_stack+0x21/0x30 [ 60.141103][ T1921] dump_stack_lvl+0x10c/0x190 [ 60.141128][ T1921] ? __cfi_dump_stack_lvl+0x10/0x10 [ 60.141154][ T1921] ? find_vma+0xcd/0x110 [ 60.141174][ T1921] dump_stack+0x19/0x20 [ 60.141197][ T1921] __get_user_pages+0x1e34/0x22d0 [ 60.141221][ T1921] ? __kasan_check_write+0x18/0x20 [ 60.141251][ T1921] ? down_read_killable+0x79/0xf0 [ 60.141272][ T1921] ? populate_vma_page_range+0x230/0x230 [ 60.141294][ T1921] ? kernel_text_address+0xa9/0xe0 [ 60.141319][ T1921] ? unwind_get_return_address+0x51/0x90 [ 60.141342][ T1921] __gup_longterm_locked+0xcb1/0x1580 [ 60.141367][ T1921] ? stack_depot_save_flags+0x38/0x800 [ 60.141389][ T1921] gup_fast_fallback+0x12ae/0x14a0 [ 60.141411][ T1921] ? kasan_save_track+0x3e/0x80 [ 60.141430][ T1921] ? __kmalloc_cache_noprof+0x24c/0x490 [ 60.141448][ T1921] ? futex_lock_pi+0x77a/0xa10 [ 60.141473][ T1921] ? get_user_pages_fast_only+0xc0/0xc0 [ 60.141499][ T1921] get_user_pages_fast+0x73/0xb0 [ 60.141522][ T1921] get_futex_key+0x24d/0x930 [ 60.141540][ T1921] ? __cfi_get_futex_key+0x10/0x10 [ 60.141558][ T1921] ? futex_lock_pi+0x77a/0xa10 [ 60.141579][ T1921] ? futex_setup_timer+0xb4/0xd0 [ 60.141596][ T1921] futex_lock_pi+0x1c0/0xa10 [ 60.141618][ T1921] ? __cfi_futex_lock_pi+0x10/0x10 [ 60.141640][ T1921] ? __kasan_check_write+0x18/0x20 [ 60.141666][ T1921] ? wake_up_q+0x10f/0x1c0 [ 60.141694][ T1921] ? __cfi_futex_wake_mark+0x10/0x10 [ 60.141715][ T1921] ? __seccomp_filter+0x433/0x1a70 [ 60.141733][ T1921] do_futex+0x25c/0x500 [ 60.141752][ T1921] ? __cfi_do_futex+0x10/0x10 [ 60.141769][ T1921] ? vm_mmap_pgoff+0x145/0x4e0 [ 60.141787][ T1921] __se_sys_futex+0x28f/0x300 [ 60.141807][ T1921] ? __x64_sys_futex+0x110/0x110 [ 60.141828][ T1921] __x64_sys_futex+0xe9/0x110 [ 60.141848][ T1921] x64_sys_call+0x227f/0x2ee0 [ 60.141875][ T1921] do_syscall_64+0x58/0xf0 [ 60.141898][ T1921] ? clear_bhb_loop+0x50/0xa0 [ 60.141919][ T1921] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 60.141939][ T1921] RIP: 0033:0x7f9f35f8efc9 [ 60.141964][ T1921] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 60.141982][ T1921] RSP: 002b:00007f9f36e44038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 60.142018][ T1921] RAX: ffffffffffffffda RBX: 00007f9f361e5fa0 RCX: 00007f9f35f8efc9 [ 60.142033][ T1921] RDX: 0000000000000001 RSI: 000000000000000d RDI: 0000200000000b00 [ 60.142048][ T1921] RBP: 00007f9f36011f91 R08: 0000000000000000 R09: 0000000000000002 [ 60.142061][ T1921] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 60.142074][ T1921] R13: 00007f9f361e6038 R14: 00007f9f361e5fa0 R15: 00007ffea90c87e8 [ 60.142092][ T1921] [ 60.851916][ T1927] random: crng reseeded on system resumption [ 60.857881][ T36] audit: type=1400 audit(1761596509.402:351): avc: denied { listen } for pid=1926 comm="syz.0.531" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 60.896457][ T36] audit: type=1400 audit(1761596509.402:352): avc: denied { accept } for pid=1926 comm="syz.0.531" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 61.038193][ T1938] rust_binder: Error while translating object. [ 61.038239][ T1938] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 61.053392][ T1938] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:473 [ 61.156994][ T1954] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:155 [ 61.279216][ T1967] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 61.288617][ T1967] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 61.305031][ T1967] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 61.318965][ T1970] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 61.378414][ T1973] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 61.463509][ T617] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 61.622433][ T617] usb 3-1: Using ep0 maxpacket: 8 [ 61.632355][ T45] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 61.636163][ T617] usb 3-1: config 0 has an invalid interface number: 31 but max is 0 [ 61.663240][ T617] usb 3-1: config 0 has no interface number 0 [ 61.677197][ T617] usb 3-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 61.687120][ T617] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.695290][ T617] usb 3-1: Product: syz [ 61.699541][ T617] usb 3-1: Manufacturer: syz [ 61.704388][ T617] usb 3-1: SerialNumber: syz [ 61.721013][ T617] usb 3-1: config 0 descriptor?? [ 61.794587][ T45] usb 5-1: config 0 interface 0 altsetting 7 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 61.821094][ T45] usb 5-1: config 0 interface 0 has no altsetting 0 [ 61.827748][ T45] usb 5-1: New USB device found, idVendor=056a, idProduct=0084, bcdDevice= 0.00 [ 61.846932][ T45] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 61.861428][ T45] usb 5-1: config 0 descriptor?? [ 61.866659][ T1974] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 61.935880][ T36] audit: type=1400 audit(1761596510.489:353): avc: denied { mounton } for pid=1964 comm="syz.2.544" path="/92/file0" dev="tmpfs" ino=521 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 62.002176][ T617] usb 3-1: Found UVC 0.04 device syz (046d:08c3) [ 62.008640][ T617] uvcvideo 3-1:0.31: Entity type for entity Output 6 was not initialized! [ 62.019281][ T617] usb 3-1: USB disconnect, device number 15 [ 62.025635][ T36] audit: type=1326 audit(1761596510.580:354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1975 comm="syz.0.547" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fea9638efc9 code=0x0 [ 62.292184][ T45] wacom 0003:056A:0084.0004: hidraw0: USB HID v1.01 Device [HID 056a:0084] on usb-dummy_hcd.4-1/input0 [ 62.488357][ T45] usb 5-1: USB disconnect, device number 9 [ 62.516541][ T1993] rust_binder: Error while translating object. [ 62.516585][ T1993] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 62.522773][ T1993] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:286 [ 62.553268][ T1995] bridge0: port 3(erspan0) entered blocking state [ 62.568942][ T1995] bridge0: port 3(erspan0) entered disabled state [ 62.575543][ T1995] erspan0: entered allmulticast mode [ 62.581358][ T1995] erspan0: entered promiscuous mode [ 62.586741][ T1995] bridge0: port 3(erspan0) entered blocking state [ 62.593192][ T1995] bridge0: port 3(erspan0) entered forwarding state [ 62.881297][ T339] Bluetooth: hci0: Frame reassembly failed (-84) [ 63.018024][ T2004] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 63.101732][ T2006] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 63.998449][ T2009] netlink: 104 bytes leftover after parsing attributes in process `syz.4.558'. [ 64.014438][ T2009] rust_binder: Write failure EFAULT in pid:176 [ 64.086683][ T36] audit: type=1400 audit(1761596512.654:355): avc: denied { read } for pid=2010 comm="syz.4.559" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 64.086801][ T2011] rust_binder: 178: no such ref 1 [ 64.118792][ T2011] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 64.128117][ T2011] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:178 [ 64.167758][ T2015] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 64.177502][ T2015] rust_binder: Error in use_page_slow: ESRCH [ 64.184008][ T2015] rust_binder: use_range failure ESRCH [ 64.190505][ T2015] rust_binder: Failed to allocate buffer. len:4240, is_oneway:false [ 64.196175][ T2015] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 64.204402][ T2015] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:182 [ 64.351407][ T2026] binder: Binderfs stats mode cannot be changed during a remount [ 64.385047][ T2028] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 64.385289][ T2028] rust_binder: Error in use_page_slow: ESRCH [ 64.393109][ T2028] rust_binder: use_range failure ESRCH [ 64.399388][ T2028] rust_binder: Failed to allocate buffer. len:4120, is_oneway:false [ 64.405029][ T2028] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 64.413077][ T2028] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:195 [ 64.473622][ T2033] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 64.490789][ T36] audit: type=1400 audit(1761596513.067:356): avc: denied { remount } for pid=2032 comm="syz.4.567" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 64.949966][ T1028] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 64.956148][ T54] Bluetooth: hci0: command 0x1003 tx timeout [ 65.013040][ T2037] can0: slcan on ptm0. [ 65.024722][ T36] audit: type=1400 audit(1761596513.600:357): avc: denied { search } for pid=149 comm="dhcpcd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 65.046515][ T36] audit: type=1400 audit(1761596513.600:358): avc: denied { read } for pid=149 comm="dhcpcd" name="n16" dev="tmpfs" ino=2734 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.068376][ T36] audit: type=1400 audit(1761596513.600:359): avc: denied { open } for pid=149 comm="dhcpcd" path="/run/udev/data/n16" dev="tmpfs" ino=2734 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.091452][ T36] audit: type=1400 audit(1761596513.600:360): avc: denied { getattr } for pid=149 comm="dhcpcd" path="/run/udev/data/n16" dev="tmpfs" ino=2734 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 65.148733][ T2039] can0 (unregistered): slcan off ptm0. [ 65.190352][ T2044] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 65.197601][ T2044] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:211 [ 65.234515][ T2052] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.243967][ T2052] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 65.250691][ T2052] rust_binder: validate_parent_fixup: new_min_offset=60, sg_entry.length=0 [ 65.257205][ T2052] rust_binder: Error while translating object. [ 65.265909][ T2052] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 65.283567][ T2052] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:219 [ 65.360733][ T2060] netlink: 'syz.0.577': attribute type 12 has an invalid length. [ 65.488501][ T36] audit: type=1400 audit(1761596514.063:361): avc: denied { map } for pid=2063 comm="syz.4.578" path="/proc/226/comm" dev="proc" ino=13591 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 65.537095][ T36] audit: type=1400 audit(1761596514.114:362): avc: denied { create } for pid=2062 comm="syz.2.579" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dccp_socket permissive=1 [ 65.768549][ T2082] netlink: 'syz.4.583': attribute type 32 has an invalid length. [ 65.786368][ T2082] SELinux: security_context_str_to_sid () failed with errno=-22 [ 65.953612][ T2098] rust_binder: Read failure Err(EAGAIN) in pid:240 [ 65.971396][ T36] audit: type=1400 audit(1761596514.546:363): avc: denied { remount } for pid=2100 comm="syz.4.590" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 65.993673][ T2105] netlink: 'syz.4.592': attribute type 12 has an invalid length. [ 66.261452][ T45] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 66.281392][ T10] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 66.377430][ T2117] 9pnet_fd: Insufficient options for proto=fd [ 66.377433][ T2118] 9pnet_fd: Insufficient options for proto=fd [ 66.404199][ T36] audit: type=1400 audit(1761596514.989:364): avc: denied { getopt } for pid=2119 comm="syz.2.596" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 66.423718][ T45] usb 5-1: Using ep0 maxpacket: 16 [ 66.441143][ T10] usb 1-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 66.441599][ T45] usb 5-1: config 0 has an invalid interface number: 105 but max is 0 [ 66.456156][ T2124] rust_binder: Failed to allocate buffer. len:4096, is_oneway:true [ 66.462153][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 66.477371][ T45] usb 5-1: config 0 descriptor has 1 excess byte, ignoring [ 66.480108][ T10] usb 1-1: New USB device found, idVendor=056a, idProduct=032c, bcdDevice= 0.00 [ 66.489988][ T45] usb 5-1: config 0 has no interface number 0 [ 66.495805][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 66.513836][ T45] usb 5-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 66.515951][ T10] usb 1-1: config 0 descriptor?? [ 66.523110][ T45] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 66.536028][ T45] usb 5-1: Product: syz [ 66.540445][ T45] usb 5-1: Manufacturer: syz [ 66.545045][ T45] usb 5-1: SerialNumber: syz [ 66.569529][ T45] usb 5-1: config 0 descriptor?? [ 66.581138][ T45] usb 5-1: Found UVC 0.00 device syz (046d:08f3) [ 66.589353][ T45] usb 5-1: No valid video chain found. [ 66.603405][ T2133] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 66.603505][ T2134] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:316 [ 66.739133][ T10] usbhid 1-1:0.0: can't add hid device: -71 [ 66.758355][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 66.785144][ T10] usb 1-1: USB disconnect, device number 16 [ 66.789121][ T45] usb 5-1: USB disconnect, device number 10 [ 66.827866][ T2152] rust_binder: Error while translating object. [ 66.827908][ T2152] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 66.835010][ T2152] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:537 [ 66.896156][ T2157] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 66.905442][ T2158] rust_binder: Read failure Err(EAGAIN) in pid:542 [ 67.067116][ T2168] overlayfs: missing 'lowerdir' [ 67.108450][ T2172] rust_binder: Error while translating object. [ 67.108501][ T2172] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 67.114828][ T2173] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=2173 comm=syz.0.611 [ 67.136615][ T2172] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:555 [ 67.150288][ T2176] rust_binder: Failed to allocate buffer. len:24, is_oneway:false [ 67.485152][ T10] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 67.607834][ T2193] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 67.608929][ T2193] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 67.624171][ T2193] rust_binder: 2193 RLIMIT_NICE not set [ 67.646848][ T2194] rust_binder: Read failure Err(EAGAIN) in pid:327 [ 67.654090][ T10] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 67.676568][ T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 67.685810][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 67.694740][ T2207] __vm_enough_memory: pid: 2207, comm: syz.4.621, bytes: 18014402804453376 not enough memory for the allocation [ 67.715143][ T10] usb 1-1: Product: syz [ 67.724384][ T10] usb 1-1: Manufacturer: syz [ 67.729314][ T10] usb 1-1: SerialNumber: syz [ 67.734878][ T2178] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 67.958965][ T2178] rust_binder: Error while translating object. [ 67.958997][ T2178] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 67.965050][ T31] usb 3-1: new full-speed USB device number 16 using dummy_hcd [ 67.965939][ T2178] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:561 [ 67.988793][ T10] usb 1-1: USB disconnect, device number 17 [ 68.005169][ T617] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 68.139277][ T31] usb 3-1: not running at top speed; connect to a high speed hub [ 68.147842][ T31] usb 3-1: config 1 interface 0 has no altsetting 0 [ 68.156031][ T617] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 68.156319][ T31] usb 3-1: New USB device found, idVendor=04da, idProduct=104d, bcdDevice= 0.40 [ 68.175220][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.183210][ T31] usb 3-1: Product: ࠉ [ 68.184946][ T617] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 68.187763][ T31] usb 3-1: Manufacturer: ఌ [ 68.201056][ T31] usb 3-1: SerialNumber: ␈䉸髤硫먹㓳衙ᬕ犫䯳鎁暵쎬䳥Ꮠ꿵﯁䝆ሯΪ﫥鯐逫㱣菮攈䕃첃኉絡皌矝⌲䀊籑厶繴㊬힗蚣绺넴皻ᩜ⩻䋇몲츊譤㙿ⴏ穭㹭㙰ᐻ⠑盓뎷᥅풄䚊዗ㆴꙔ媳撥郙ꎵ㦵ॺ끔嗏틹灚੹ [ 68.232770][ T617] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 68.241907][ T617] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.250109][ T617] usb 5-1: Product: syz [ 68.254460][ T617] usb 5-1: Manufacturer: syz [ 68.259194][ T617] usb 5-1: SerialNumber: syz [ 68.639913][ T617] usb 5-1: 0:2 : does not exist [ 68.647333][ T31] usbhid 3-1:1.0: can't add hid device: -71 [ 68.653308][ T31] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 68.658268][ T617] usb 5-1: unit 4 not found! [ 68.683963][ T31] usb 3-1: USB disconnect, device number 16 [ 68.686549][ T617] usb 5-1: USB disconnect, device number 11 [ 68.698562][ T2237] netlink: 260 bytes leftover after parsing attributes in process `syz.0.632'. [ 68.711262][ T2237] __vm_enough_memory: pid: 2237, comm: syz.0.632, bytes: 18014402804453376 not enough memory for the allocation [ 68.734855][ T2240] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 68.803907][ T2249] rust_binder: Failed to allocate buffer. len:4096, is_oneway:true [ 68.803936][ T2249] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 68.812032][ T2249] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:591 [ 68.837868][ T2251] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 68.847201][ T2251] rust_binder: Read failure Err(EFAULT) in pid:593 [ 68.952783][ T2261] rust_binder: Error while translating object. [ 68.959529][ T2261] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 68.965936][ T2261] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:603 [ 69.009369][ T2268] netlink: 'syz.0.643': attribute type 58 has an invalid length. [ 69.054980][ T2271] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.188994][ T2276] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 69.198184][ T2276] rust_binder: Failed copying remainder into alloc: EFAULT [ 69.204626][ T2276] rust_binder: Failure in apply_sg: BR_FAILED_REPLY { source: EFAULT } [ 69.212193][ T2276] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 69.220643][ T2276] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:288 [ 69.282248][ T2288] rust_binder: Write failure EFAULT in pid:298 [ 69.424649][ T31] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 69.594596][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 69.604044][ T31] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 69.606675][ T2300] rust_binder: 618: no such ref 0 [ 69.613125][ T31] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 69.630085][ T2300] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 69.643345][ T31] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 69.644605][ T2300] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 69.663378][ T31] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 69.672683][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 69.683684][ T31] usb 3-1: Product: syz [ 69.702779][ T31] usb 3-1: Manufacturer: syz [ 69.707599][ T31] usb 3-1: SerialNumber: syz [ 70.051676][ T36] kauditd_printk_skb: 8 callbacks suppressed [ 70.051693][ T36] audit: type=1400 audit(1761596778.637:373): avc: denied { mounton } for pid=2308 comm="syz.4.657" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 70.295994][ T2327] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 70.296028][ T2327] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:633 [ 70.334493][ T45] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 70.351755][ T31] usb 3-1: 0:2 : does not exist [ 70.365488][ T31] usb 3-1: 1:0: cannot get min/max values for control 2 (id 1) [ 70.379622][ T31] usb 3-1: USB disconnect, device number 17 [ 70.515563][ T45] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 70.526803][ T45] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 70.536800][ T45] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 70.551455][ T45] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 70.554386][ T617] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 70.563038][ T45] usb 5-1: config 0 descriptor?? [ 70.577213][ T45] hub 5-1:0.0: USB hub found [ 70.735312][ T617] usb 1-1: config 8 has an invalid interface number: 223 but max is 0 [ 70.753675][ T617] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 70.763971][ T617] usb 1-1: config 8 has no interface number 0 [ 70.770428][ T617] usb 1-1: config 8 interface 223 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 70.784049][ T45] hub 5-1:0.0: 1 port detected [ 70.785072][ T617] usb 1-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 70.798088][ T617] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.806262][ T617] usb 1-1: Product: syz [ 70.810471][ T617] usb 1-1: Manufacturer: syz [ 70.815285][ T617] usb 1-1: SerialNumber: syz [ 70.866084][ T2331] fuse: Bad value for 'group_id' [ 70.871180][ T2331] fuse: Bad value for 'group_id' [ 70.927636][ T2342] SELinux: security_context_str_to_sid () failed with errno=-22 [ 70.938411][ T2342] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 70.964158][ T2345] rust_binder: Write failure EFAULT in pid:348 [ 71.023042][ T2329] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 71.029333][ T2329] rust_binder: Read failure Err(EFAULT) in pid:635 [ 71.046173][ T617] usb 1-1: USB disconnect, device number 18 [ 71.104741][ T2357] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 71.116562][ T36] audit: type=1400 audit(1761596779.707:374): avc: denied { lock } for pid=2358 comm="syz.2.674" path="socket:[14813]" dev="sockfs" ino=14813 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 71.214099][ T2373] netlink: 'syz.2.677': attribute type 15 has an invalid length. [ 71.514141][ T617] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 71.581033][ T2378] binder: Unknown parameter 'appraise_type' [ 71.587884][ T36] audit: type=1400 audit(1761596780.177:375): avc: denied { accept } for pid=2377 comm="syz.0.679" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 71.607200][ T45] hub 5-1:0.0: activate --> -90 [ 71.665237][ T617] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 71.676307][ T617] usb 3-1: New USB device found, idVendor=1e7d, idProduct=3264, bcdDevice= 0.00 [ 71.685591][ T617] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.694512][ T617] usb 3-1: config 0 descriptor?? [ 71.874089][ T65] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 72.014821][ T406] usb 5-1: USB disconnect, device number 12 [ 72.035207][ T65] usb 1-1: config 0 interface 0 altsetting 247 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 72.046499][ T65] usb 1-1: config 0 interface 0 altsetting 247 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 72.059921][ T65] usb 1-1: config 0 interface 0 has no altsetting 0 [ 72.066816][ T65] usb 1-1: New USB device found, idVendor=06cb, idProduct=73f5, bcdDevice= 0.00 [ 72.076153][ T65] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 72.086234][ T65] usb 1-1: config 0 descriptor?? [ 72.091489][ T2385] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 72.305255][ T2385] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.313789][ T2385] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 72.334068][ T2376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.346685][ T2376] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 72.545987][ T617] usbhid 3-1:0.0: can't add hid device: -71 [ 72.551442][ T2389] netlink: 288 bytes leftover after parsing attributes in process `syz.4.682'. [ 72.551974][ T617] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 72.599921][ T617] usb 3-1: USB disconnect, device number 18 [ 72.637867][ T65] usbhid 1-1:0.0: can't add hid device: -71 [ 72.653936][ T65] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 72.665102][ T65] usb 1-1: USB disconnect, device number 19 [ 72.861915][ T2406] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 72.872651][ T2406] rust_binder: Error in use_page_slow: ESRCH [ 72.879200][ T2406] rust_binder: use_range failure ESRCH [ 72.885220][ T2406] rust_binder: Failed to allocate buffer. len:4256, is_oneway:false [ 72.890727][ T2406] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 72.898824][ T2406] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:338 [ 73.023755][ T36] audit: type=1400 audit(1761596781.607:376): avc: denied { mounton } for pid=2412 comm="syz.4.689" path="pipe:[14932]" dev="pipefs" ino=14932 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 73.068298][ T2416] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 152, size: 18446744073709551507) [ 73.068322][ T2416] rust_binder: Error while translating object. [ 73.093748][ T2416] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 73.099947][ T2416] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:383 [ 73.185722][ T36] audit: type=1400 audit(1761596781.777:377): avc: denied { load_policy } for pid=2420 comm="syz.4.693" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 73.196116][ T2421] SELinux: ebitmap: truncated map [ 73.234591][ T2421] SELinux: failed to load policy [ 73.357970][ T46] bridge_slave_1: left allmulticast mode [ 73.363698][ T46] bridge_slave_1: left promiscuous mode [ 73.372175][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.400101][ T46] bridge_slave_0: left allmulticast mode [ 73.420135][ T46] bridge_slave_0: left promiscuous mode [ 73.433716][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.452166][ T12] Bluetooth: hci0: Frame reassembly failed (-84) [ 73.593629][ T617] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 73.614336][ T46] veth1_macvtap: left promiscuous mode [ 73.621508][ T46] veth0_vlan: left promiscuous mode [ 73.656701][ T2463] virtiofs: Unknown parameter 'always' [ 73.692978][ T2449] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.700107][ T2449] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.707438][ T2449] bridge_slave_0: entered allmulticast mode [ 73.714227][ T2449] bridge_slave_0: entered promiscuous mode [ 73.714233][ T2464] fuse: Bad value for 'fd' [ 73.725431][ T2449] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.732503][ T2449] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.739759][ T2449] bridge_slave_1: entered allmulticast mode [ 73.746581][ T2449] bridge_slave_1: entered promiscuous mode [ 73.764663][ T617] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 73.775661][ T617] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 73.785483][ T617] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 73.798490][ T617] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 73.807631][ T617] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 73.817967][ T617] usb 5-1: config 0 descriptor?? [ 73.838643][ T2449] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.845714][ T2449] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.852959][ T2449] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.859987][ T2449] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.879745][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.887254][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.896568][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.903625][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.913939][ T339] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.920980][ T339] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.946961][ T2449] veth0_vlan: entered promiscuous mode [ 73.959162][ T2449] veth1_macvtap: entered promiscuous mode [ 74.226075][ T617] plantronics 0003:047F:FFFF.0005: No inputs registered, leaving [ 74.234866][ T617] plantronics 0003:047F:FFFF.0005: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 74.264137][ T2486] fuse: Bad value for 'fd' [ 74.311177][ T36] audit: type=1400 audit(1761596782.898:378): avc: denied { execute } for pid=2499 comm="syz.2.714" path="/memory.events.local" dev="ramfs" ino=15965 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 74.484360][ T45] usb 5-1: USB disconnect, device number 13 [ 74.897590][ T36] audit: type=1400 audit(1761596783.488:379): avc: denied { mounton } for pid=2511 comm="syz.5.719" path="/proc/9/task" dev="proc" ino=15981 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 75.188551][ T2522] __vm_enough_memory: pid: 2522, comm: syz.4.722, bytes: 18014402804453376 not enough memory for the allocation [ 75.224720][ T2529] overlayfs: unescaped trailing colons in lowerdir mount option. [ 75.483204][ T54] Bluetooth: hci0: command 0x1003 tx timeout [ 75.483204][ T1028] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 75.517158][ T2563] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 75.517181][ T2563] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:24 [ 75.527294][ T2565] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 75.547293][ T2568] incfs: ino conflict with backing FS 1 [ 75.560023][ T36] audit: type=1400 audit(1761596784.148:380): avc: denied { ioctl } for pid=2567 comm="syz.5.739" path="/10/file0/.pending_reads" dev="incremental-fs" ino=2 ioctlcmd=0x671e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 76.019756][ T2572] rust_binder: Got transaction with invalid offset. [ 76.019784][ T2572] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 76.026530][ T2572] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:654 [ 76.131105][ T36] audit: type=1400 audit(1761596784.718:381): avc: denied { nlmsg_read } for pid=2575 comm="syz.4.742" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 76.156479][ T2579] 9pnet_fd: Insufficient options for proto=fd [ 76.190742][ T2583] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 76.190889][ T2583] rust_binder: Error in use_page_slow: ESRCH [ 76.197358][ T2583] rust_binder: use_range failure ESRCH [ 76.204319][ T2583] rust_binder: Failed to allocate buffer. len:5192, is_oneway:false [ 76.209845][ T2583] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 76.217881][ T2583] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:378 [ 76.245746][ T2590] binder: Unknown parameter 'context[7' [ 76.263364][ T2590] netlink: 4 bytes leftover after parsing attributes in process `syz.4.747'. [ 76.293021][ T617] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 76.315050][ T2591] overlayfs: failed to resolve '/': -2 [ 76.321774][ T2591] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 76.444146][ T617] usb 1-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 76.456500][ T2600] rust_binder: BC_FREEZE_NOTIFICATION_DONE 0000000000000001 not found [ 76.464732][ T617] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 76.476248][ T2600] rust_binder: Write failure EINVAL in pid:392 [ 76.477486][ T36] audit: type=1400 audit(1761596785.068:382): avc: denied { write } for pid=2596 comm="syz.4.750" name="config" dev="proc" ino=4026532894 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 76.477684][ T617] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 76.517609][ T617] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 76.526677][ T617] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.538860][ T2574] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 77.352891][ T617] aiptek 1-1:17.0: Aiptek using 400 ms programming speed [ 77.360721][ T617] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:17.0/input/input19 [ 77.372662][ T617] usb 1-1: USB disconnect, device number 20 [ 77.378632][ C0] aiptek 1-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 77.384614][ T36] audit: type=1326 audit(1761596785.969:383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2611 comm="syz.4.753" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f9f35f8efc9 code=0x7fc00000 [ 77.562961][ T54] Bluetooth: hci0: command 0x1003 tx timeout [ 77.563117][ T1028] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 77.579675][ T2625] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2576 sclass=netlink_route_socket pid=2625 comm=syz.4.755 [ 78.072535][ T617] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 78.103687][ T2633] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 78.103720][ T2633] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:33 [ 78.113670][ T2634] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 78.141914][ T36] audit: type=1400 audit(1761596786.729:384): avc: denied { bpf } for pid=2636 comm="syz.5.759" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 78.202526][ T617] usb 1-1: device descriptor read/64, error -71 [ 78.349945][ T2656] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 78.353867][ T36] audit: type=1400 audit(1761596786.949:385): avc: denied { create } for pid=2653 comm="syz.2.764" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=irda_socket permissive=1 [ 78.401405][ T36] audit: type=1400 audit(1761596786.989:386): avc: denied { getopt } for pid=2660 comm="syz.2.767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 78.420793][ T36] audit: type=1400 audit(1761596786.989:387): avc: denied { accept } for pid=2659 comm="syz.4.768" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 78.428394][ T2664] netlink: 16 bytes leftover after parsing attributes in process `syz.2.769'. [ 78.440656][ T36] audit: type=1400 audit(1761596786.989:388): avc: denied { read } for pid=2659 comm="syz.4.768" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 78.449232][ T617] usb 1-1: device descriptor read/64, error -71 [ 78.473552][ T2665] binder: Unknown parameter '00000000000000000000000' [ 78.577642][ T36] audit: type=1400 audit(1761596787.169:389): avc: denied { setopt } for pid=2687 comm="syz.2.775" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 78.722394][ T617] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 78.737360][ T2703] netlink: 8 bytes leftover after parsing attributes in process `syz.2.780'. [ 78.852355][ T617] usb 1-1: device descriptor read/64, error -71 [ 79.092317][ T617] usb 1-1: device descriptor read/64, error -71 [ 79.202344][ T617] usb usb1-port1: attempt power cycle [ 79.302353][ T2740] overlayfs: failed to clone lowerpath [ 79.542169][ T617] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 79.563294][ T617] usb 1-1: device descriptor read/8, error -71 [ 79.572310][ T65] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 79.693067][ T617] usb 1-1: device descriptor read/8, error -71 [ 79.722135][ T65] usb 5-1: Using ep0 maxpacket: 8 [ 79.728313][ T65] usb 5-1: config 0 has an invalid interface number: 200 but max is 0 [ 79.736616][ T65] usb 5-1: config 0 has no interface number 0 [ 79.742755][ T65] usb 5-1: config 0 interface 200 altsetting 2 has an endpoint descriptor with address 0xB5, changing to 0x85 [ 79.754489][ T65] usb 5-1: config 0 interface 200 altsetting 2 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 79.765574][ T65] usb 5-1: config 0 interface 200 altsetting 2 endpoint 0x85 has invalid maxpacket 1126, setting to 1024 [ 79.776816][ T65] usb 5-1: config 0 interface 200 has no altsetting 0 [ 79.785011][ T65] usb 5-1: New USB device found, idVendor=0b57, idProduct=8528, bcdDevice=6d.39 [ 79.794157][ T65] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.802212][ T65] usb 5-1: Product: syz [ 79.806530][ T65] usb 5-1: Manufacturer: syz [ 79.811106][ T65] usb 5-1: SerialNumber: syz [ 79.816428][ T65] usb 5-1: config 0 descriptor?? [ 79.821647][ T2744] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 79.920390][ T2759] SELinux: security_context_str_to_sid (root) failed with errno=-22 [ 79.929308][ T2759] overlayfs: failed to clone lowerpath [ 79.942261][ T617] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 79.962966][ T617] usb 1-1: device descriptor read/8, error -71 [ 79.976117][ T2774] overlayfs: failed to clone lowerpath [ 80.011420][ T2779] netlink: 12 bytes leftover after parsing attributes in process `syz.5.804'. [ 80.037922][ T65] input: Hanwang Art Master III 0906 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.200/input/input20 [ 80.067235][ T65] usb 5-1: USB disconnect, device number 14 [ 80.092978][ T617] usb 1-1: device descriptor read/8, error -71 [ 80.202440][ T617] usb usb1-port1: unable to enumerate USB device [ 80.348662][ T2822] netlink: 20 bytes leftover after parsing attributes in process `syz.5.820'. [ 80.660400][ T2839] netlink: 188 bytes leftover after parsing attributes in process `syz.4.826'. [ 80.669603][ T2840] netlink: 188 bytes leftover after parsing attributes in process `syz.4.826'. [ 80.688751][ T2842] rust_binder: Write failure EINVAL in pid:441 [ 80.699268][ T2845] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 80.712824][ T2845] rust_binder: Write failure EINVAL in pid:444 [ 80.841710][ T36] kauditd_printk_skb: 81 callbacks suppressed [ 80.841728][ T36] audit: type=1400 audit(1761596789.429:471): avc: denied { module_load } for pid=2846 comm="syz.0.829" path="/bus" dev="ramfs" ino=17568 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=system permissive=1 [ 80.841960][ T2847] Invalid ELF header magic: != ELF [ 80.940340][ T2853] netlink: 'syz.2.832': attribute type 4 has an invalid length. [ 80.948084][ T2853] netlink: 3581 bytes leftover after parsing attributes in process `syz.2.832'. [ 81.096599][ T36] audit: type=1400 audit(1761596789.689:472): avc: denied { read } for pid=2863 comm="syz.2.836" path="socket:[17593]" dev="sockfs" ino=17593 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 81.231746][ T65] usb 1-1: new low-speed USB device number 25 using dummy_hcd [ 81.277629][ T2876] netlink: 'syz.4.840': attribute type 11 has an invalid length. [ 81.288545][ T36] audit: type=1400 audit(1761596789.879:473): avc: denied { shutdown } for pid=2875 comm="syz.4.840" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 81.392713][ T65] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 81.402120][ T65] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.410842][ T65] usb 1-1: config 0 descriptor?? [ 81.437756][ T2886] cgroup: Bad value for 'name' [ 81.692270][ T2899] rust_binder: Failed to allocate buffer. len:8, is_oneway:true [ 81.692404][ T2899] rust_binder: Write failure EINVAL in pid:468 [ 81.816370][ T2902] syzkaller0: refused to change device tx_queue_len [ 82.220924][ T2849] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 82.220949][ T2849] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:673 [ 82.273075][ T2927] netlink: 56 bytes leftover after parsing attributes in process `syz.5.858'. [ 82.301720][ T45] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 82.359196][ T2931] overlayfs: failed to clone upperpath [ 82.365327][ T36] audit: type=1400 audit(1761596790.960:474): avc: denied { create } for pid=2929 comm="syz.5.859" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 82.385971][ T36] audit: type=1400 audit(1761596790.970:475): avc: denied { link } for pid=2929 comm="syz.5.859" name="file1" dev="tmpfs" ino=277 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 82.452540][ T45] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 82.463484][ T45] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 82.473428][ T45] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 82.486287][ T45] usb 5-1: New USB device found, idVendor=0eef, idProduct=72d0, bcdDevice= 0.00 [ 82.495352][ T45] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.504191][ T45] usb 5-1: config 0 descriptor?? [ 82.735927][ T65] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 82.754173][ T65] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9 [ 82.767294][ T2933] rust_binder: Got transaction with invalid offset. [ 82.767331][ T2933] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 82.773998][ T2933] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:675 [ 82.791483][ T65] asix 1-1:0.0: probe with driver asix failed with error -71 [ 82.812738][ T65] usb 1-1: USB disconnect, device number 25 [ 82.912499][ T45] hid-multitouch 0003:0EEF:72D0.0006: hidraw0: USB HID v0.00 Device [HID 0eef:72d0] on usb-dummy_hcd.4-1/input0 [ 83.101315][ T65] usb 1-1: new full-speed USB device number 26 using dummy_hcd [ 83.112331][ T45] usb 5-1: USB disconnect, device number 15 [ 83.209577][ T36] audit: type=1107 audit(1761596791.800:476): pid=2959 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 83.228478][ T2962] netlink: 32 bytes leftover after parsing attributes in process `syz.5.870'. [ 83.252424][ T65] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 83.264199][ T65] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 83.275820][ T65] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 83.288556][ T65] usb 1-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 83.298809][ T65] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 83.306989][ T65] usb 1-1: Product: syz [ 83.311356][ T65] usb 1-1: Manufacturer: syz [ 83.315965][ T65] usb 1-1: SerialNumber: syz [ 83.323020][ T65] usb 1-1: config 0 descriptor?? [ 83.328298][ T2935] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 83.336124][ T65] hub 1-1:0.0: USB hub found [ 83.537785][ T2935] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:677 [ 83.538856][ T65] hub 1-1:0.0: config failed, can't read hub descriptor (err -22) [ 83.559018][ T65] usb 1-1: USB disconnect, device number 26 [ 83.594947][ T336] udevd[336]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 83.891134][ T10] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 84.049678][ T10] usb 5-1: config index 0 descriptor too short (expected 3133, got 61) [ 84.058637][ T10] usb 5-1: config 0 has an invalid interface number: 156 but max is 1 [ 84.066851][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.077333][ T10] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 84.086236][ T10] usb 5-1: config 0 has no interface number 0 [ 84.092375][ T10] usb 5-1: config 0 interface 156 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 84.102206][ T10] usb 5-1: config 0 interface 156 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 84.115939][ T2991] rust_binder: Write failure EFAULT in pid:679 [ 84.116033][ T10] usb 5-1: config 0 interface 156 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 84.132077][ T10] usb 5-1: config 0 interface 156 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 84.145174][ T10] usb 5-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 84.154248][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.163052][ T10] usb 5-1: config 0 descriptor?? [ 84.169201][ T10] usb 5-1: MIDIStreaming interface descriptor not found [ 84.192259][ T36] audit: type=1400 audit(1761596792.790:477): avc: denied { map } for pid=2994 comm="syz.5.882" path="socket:[17179]" dev="sockfs" ino=17179 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 84.582193][ T10] usb 5-1: USB disconnect, device number 16 [ 84.589076][ T3020] netlink: 'syz.2.890': attribute type 4 has an invalid length. [ 84.597104][ T3020] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.890'. [ 84.609086][ T3018] netlink: 56 bytes leftover after parsing attributes in process `syz.5.889'. [ 84.632427][ T3024] netlink: 4 bytes leftover after parsing attributes in process `syz.2.892'. [ 84.656120][ T3031] overlayfs: failed to clone upperpath [ 84.657220][ T3032] netlink: 8 bytes leftover after parsing attributes in process `syz.5.896'. [ 84.672060][ T36] audit: type=1400 audit(1761596793.270:478): avc: denied { create } for pid=3029 comm="syz.2.895" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=iucv_socket permissive=1 [ 84.927400][ T3039] SELinux: security_context_str_to_sid (sysadm_u) failed with errno=-22 [ 84.943430][ T3042] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOMEM } [ 84.943459][ T3042] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOMEM } my_pid:689 [ 84.970170][ T36] audit: type=1400 audit(1761596793.560:479): avc: denied { mounton } for pid=3045 comm="syz.0.901" path="/dev/binderfs/binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 85.012026][ T3048] rust_binder: Error while translating object. [ 85.012056][ T3048] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 85.018238][ T3048] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:696 [ 85.041293][ T36] audit: type=1400 audit(1761596793.640:480): avc: denied { read } for pid=3053 comm="syz.0.904" path="socket:[17966]" dev="sockfs" ino=17966 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 85.287275][ T3076] netlink: 'syz.4.912': attribute type 27 has an invalid length. [ 85.343013][ T3098] netlink: 224 bytes leftover after parsing attributes in process `syz.4.919'. [ 85.355149][ T3101] netlink: 'syz.5.921': attribute type 29 has an invalid length. [ 85.580732][ T31] usb 5-1: new low-speed USB device number 17 using dummy_hcd [ 85.730726][ T31] usb 5-1: Invalid ep0 maxpacket: 16 [ 85.860660][ T31] usb 5-1: new low-speed USB device number 18 using dummy_hcd [ 85.902844][ T3112] fuse: Bad value for 'fd' [ 85.921239][ T3116] netlink: 'syz.5.927': attribute type 2 has an invalid length. [ 85.992299][ T3127] netlink: 76 bytes leftover after parsing attributes in process `syz.5.931'. [ 86.010781][ T31] usb 5-1: Invalid ep0 maxpacket: 16 [ 86.025871][ T31] usb usb5-port1: attempt power cycle [ 86.172702][ T3142] overlayfs: failed to clone upperpath [ 86.192455][ T3144] netlink: 44 bytes leftover after parsing attributes in process `syz.2.936'. [ 86.202409][ T3144] tipc: Enabling of bearer rejected, failed to enable media [ 86.211862][ T3144] netlink: 44 bytes leftover after parsing attributes in process `syz.2.936'. [ 86.403655][ T10] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 86.451320][ T31] usb 5-1: new low-speed USB device number 19 using dummy_hcd [ 86.470882][ T31] usb 5-1: Invalid ep0 maxpacket: 16 [ 86.561520][ T10] usb 1-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 86.576842][ T10] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 86.600489][ T31] usb 5-1: new low-speed USB device number 20 using dummy_hcd [ 86.604432][ T10] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 86.620213][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.630821][ T31] usb 5-1: Invalid ep0 maxpacket: 16 [ 86.636251][ T31] usb usb5-port1: unable to enumerate USB device [ 86.636492][ T10] usb 1-1: Product: syz [ 86.654221][ T10] usb 1-1: Manufacturer: syz [ 86.663978][ T10] usb 1-1: SerialNumber: syz [ 86.675300][ T10] rtl8150 1-1:1.0: couldn't find required endpoints [ 86.689264][ T10] rtl8150 1-1:1.0: probe with driver rtl8150 failed with error -5 [ 86.879204][ T3135] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 86.879272][ T3135] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:721 [ 87.507885][ T3173] netlink: 8 bytes leftover after parsing attributes in process `syz.2.946'. [ 87.572133][ T36] audit: type=1400 audit(1761596796.171:481): avc: denied { connect } for pid=3180 comm="syz.2.949" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 87.795069][ T36] audit: type=1400 audit(1761596796.391:482): avc: denied { write } for pid=3199 comm="syz.2.954" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 87.883824][ T3211] netlink: 124 bytes leftover after parsing attributes in process `syz.2.959'. [ 87.938089][ T36] audit: type=1400 audit(1761596796.531:483): avc: denied { getattr } for pid=3217 comm="syz.2.962" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 88.059778][ T3239] 9pnet_fd: Insufficient options for proto=fd [ 88.145769][ T36] audit: type=1326 audit(1761596796.741:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3255 comm="syz.5.977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd9edb8efc9 code=0x7ffc0000 [ 88.180884][ T36] audit: type=1326 audit(1761596796.741:485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3255 comm="syz.5.977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd9edb8efc9 code=0x7ffc0000 [ 88.204758][ T36] audit: type=1326 audit(1761596796.741:486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3255 comm="syz.5.977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=187 compat=0 ip=0x7fd9edb8efc9 code=0x7ffc0000 [ 88.238511][ T36] audit: type=1326 audit(1761596796.741:487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3255 comm="syz.5.977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd9edb8efc9 code=0x7ffc0000 [ 88.262158][ T36] audit: type=1326 audit(1761596796.741:488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3255 comm="syz.5.977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd9edb8efc9 code=0x7ffc0000 [ 88.295388][ T36] audit: type=1326 audit(1761596796.741:489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3255 comm="syz.5.977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fd9edb8efc9 code=0x7ffc0000 [ 88.339378][ T36] audit: type=1326 audit(1761596796.741:490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3255 comm="syz.5.977" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd9edb8efc9 code=0x7ffc0000 [ 88.451669][ T3273] fuse: Bad value for 'fd' [ 89.009966][ T10] usb 1-1: USB disconnect, device number 27 [ 89.137650][ T3308] __vm_enough_memory: pid: 3308, comm: syz.0.996, bytes: 21200621596672 not enough memory for the allocation [ 89.327444][ T3330] incfs: Error accessing: ./file0. [ 89.344459][ T3330] incfs: mount failed -20 [ 89.382394][ T3341] __vm_enough_memory: pid: 3341, comm: syz.4.1007, bytes: 18014402804453376 not enough memory for the allocation [ 89.458106][ T3355] SELinux: security_context_str_to_sid (syste_uGй :) failed with errno=-22 [ 89.716870][ T3367] overlayfs: overlapping lowerdir path [ 89.744487][ T3375] tmpfs: Unknown parameter '0xffffffffffffffff' [ 89.860233][ T3381] sit0: entered promiscuous mode [ 89.866137][ T3381] netlink: 'syz.4.1019': attribute type 1 has an invalid length. [ 89.873895][ T3381] __nla_validate_parse: 3 callbacks suppressed [ 89.873908][ T3381] netlink: 9 bytes leftover after parsing attributes in process `syz.4.1019'. [ 89.900412][ T3387] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 89.900434][ T3387] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:537 [ 90.144020][ T3394] veth0_to_team: mtu greater than device maximum [ 90.764175][ T3428] tipc: Started in network mode [ 90.769113][ T3428] tipc: Node identity ff020000000000000000000000000001, cluster identity 4711 [ 90.778086][ T3428] tipc: Enabling of bearer rejected, failed to enable media [ 90.788528][ T3428] rust_binder: BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 90.825073][ T3432] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI [ 90.837748][ T3432] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 90.846150][ T3432] CPU: 1 UID: 0 PID: 3432 Comm: syz.4.1039 Not tainted syzkaller #0 0b5ffdee5fcd2f7749818d1ff954e9c21353764e [ 90.857686][ T3432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 90.867727][ T3432] RIP: 0010:iter_file_splice_write+0xace/0x11b0 [ 90.873973][ T3432] Code: 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 67 d6 e6 ff 49 8b 1e 49 c7 06 00 00 00 00 48 83 c3 08 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 43 d6 e6 ff 4c 8b 1b 48 8b 3c 24 [ 90.893692][ T3432] RSP: 0018:ffffc9000df37820 EFLAGS: 00010202 [ 90.899752][ T3432] RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff888111303900 [ 90.907805][ T3432] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 7fffffffffff0000 [ 90.915759][ T3432] RBP: ffffc9000df37a40 R08: ffff8881f6f72240 R09: 1ffff1103edee448 [ 90.923714][ T3432] R10: 1ffff1103edee44b R11: 0000000000000fd8 R12: dffffc0000000000 [ 90.931678][ T3432] R13: 7fffffffffff0000 R14: ffff88812719d010 R15: ffff88812719d000 [ 90.939656][ T3432] FS: 00007f9f36e446c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 90.948662][ T3432] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 90.955232][ T3432] CR2: 0000200000001900 CR3: 000000013ec06000 CR4: 00000000003526b0 [ 90.963188][ T3432] Call Trace: [ 90.966450][ T3432] [ 90.969369][ T3432] ? __cfi_iter_file_splice_write+0x10/0x10 [ 90.975254][ T3432] ? __kmalloc_noprof+0x271/0x530 [ 90.980259][ T3432] ? futex_wait_setup+0x1bc/0x260 [ 90.985273][ T3432] ? __kasan_check_write+0x18/0x20 [ 90.990369][ T3432] ? __cfi_iter_file_splice_write+0x10/0x10 [ 90.996248][ T3432] direct_splice_actor+0x279/0x4b0 [ 91.001345][ T3432] splice_direct_to_actor+0x4fb/0xbc0 [ 91.006705][ T3432] ? __cfi_direct_splice_actor+0x10/0x10 [ 91.012323][ T3432] ? __cfi_splice_direct_to_actor+0x10/0x10 [ 91.018206][ T3432] do_splice_direct+0x182/0x270 [ 91.023040][ T3432] ? __cfi_do_splice_direct+0x10/0x10 [ 91.028403][ T3432] ? __cfi_direct_file_splice_eof+0x10/0x10 [ 91.034284][ T3432] ? security_file_permission+0x2e/0xc0 [ 91.039814][ T3432] ? rw_verify_area+0xac/0x230 [ 91.044569][ T3432] do_sendfile+0x5c8/0xfb0 [ 91.048976][ T3432] ? vfs_writev+0xcf0/0xcf0 [ 91.053488][ T3432] ? __se_sys_futex+0x28f/0x300 [ 91.058327][ T3432] __x64_sys_sendfile64+0x193/0x1f0 [ 91.063509][ T3432] ? __cfi___x64_sys_sendfile64+0x10/0x10 [ 91.069212][ T3432] ? switch_fpu_return+0x12/0x20 [ 91.074143][ T3432] x64_sys_call+0xa26/0x2ee0 [ 91.078747][ T3432] do_syscall_64+0x58/0xf0 [ 91.083162][ T3432] ? clear_bhb_loop+0x50/0xa0 [ 91.087833][ T3432] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 91.093726][ T3432] RIP: 0033:0x7f9f35f8efc9 [ 91.098137][ T3432] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 91.117729][ T3432] RSP: 002b:00007f9f36e44038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 91.126135][ T3432] RAX: ffffffffffffffda RBX: 00007f9f361e5fa0 RCX: 00007f9f35f8efc9 [ 91.134102][ T3432] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 0000000000000009 [ 91.142158][ T3432] RBP: 00007f9f36011f91 R08: 0000000000000000 R09: 0000000000000000 [ 91.150124][ T3432] R10: 000000007a680000 R11: 0000000000000246 R12: 0000000000000000 [ 91.158102][ T3432] R13: 00007f9f361e6038 R14: 00007f9f361e5fa0 R15: 00007ffea90c87e8 [ 91.166078][ T3432] [ 91.169117][ T3432] Modules linked in: [ 91.173441][ T3432] ---[ end trace 0000000000000000 ]--- [ 91.180415][ T3432] RIP: 0010:iter_file_splice_write+0xace/0x11b0 [ 91.186781][ T3432] Code: 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 67 d6 e6 ff 49 8b 1e 49 c7 06 00 00 00 00 48 83 c3 08 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 43 d6 e6 ff 4c 8b 1b 48 8b 3c 24 [ 91.208954][ T3432] RSP: 0018:ffffc9000df37820 EFLAGS: 00010202 [ 91.215083][ T3432] RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff888111303900 [ 91.223088][ T3432] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 7fffffffffff0000 [ 91.231156][ T3432] RBP: ffffc9000df37a40 R08: ffff8881f6f72240 R09: 1ffff1103edee448 [ 91.239126][ T3432] R10: 1ffff1103edee44b R11: 0000000000000fd8 R12: dffffc0000000000 [ 91.247136][ T3432] R13: 7fffffffffff0000 R14: ffff88812719d010 R15: ffff88812719d000 [ 91.255151][ T3432] FS: 00007f9f36e446c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 91.264256][ T3432] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 91.270874][ T3432] CR2: 00007fd9eddb4198 CR3: 000000013ec06000 CR4: 00000000003526b0 [ 91.278849][ T3432] Kernel panic - not syncing: Fatal exception [ 91.285266][ T3432] Kernel Offset: disabled [ 91.289597][ T3432] Rebooting in 86400 seconds..