last executing test programs: 2.954196517s ago: executing program 0 (id=1): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x1ffffffffffd}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x800, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) close(0x3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x0, 0x0, 0x0}, 0x10}], 0x0, 0x0, 0x0}) r3 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r3, &(0x7f0000000440)=[{{&(0x7f0000000500)=@xdp={0x2c, 0x300, r5}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x3c}], 0x1, 0x0, 0x0, 0x2f00}}], 0x1, 0x20000084) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) fsetxattr$system_posix_acl(r8, &(0x7f0000001340)='system.posix_acl_default\x00', 0x0, 0x0, 0x2) bind$packet(r2, &(0x7f0000000080)={0x11, 0x18, r5, 0x1, 0x5, 0x6, @multicast}, 0x14) 2.766657999s ago: executing program 0 (id=8): openat$dir(0xffffffffffffff9c, &(0x7f0000002a00)='./file0\x00', 0x40, 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYRES16=r0, @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) syz_fuse_handle_req(r1, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(r0, 0x0, 0x0) syz_fuse_handle_req(r0, 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x20c01, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r3, 0x5000943f, 0x0) 2.73477838s ago: executing program 0 (id=9): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000002140), 0x101000, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000d00), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000640)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000600)={&(0x7f00000009c0)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="00082dbd7000fcdbdf25120000000800080008000000080007000600000008000900feffffff0c0001800800030003000000080006000600000018000180140002006272696467653000000001000000000008000800fdffffff080008000800000008000600030000000000000001000000fa90f08dc56060df762e2783d3af96f005dea71847bffbc7d245b7bbdcd8728975ed32fc1d934453c50106c981"], 0x78}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000000000000c000000200001801400020073797a5f74756e000000000000000000080003000200000018000380140003801000"], 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) keyctl$session_to_parent(0x12) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000000, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0xeb9a0000) unshare(0x20000400) fsopen(&(0x7f0000000000)='securityfs\x00', 0x1) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r4, 0x5452, &(0x7f0000000040)=0x8001) fcntl$setownex(r4, 0xf, &(0x7f0000000140)={0x2, r2}) sendmmsg$unix(r3, &(0x7f0000011500)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)="11", 0x1}], 0x1}}], 0x1, 0x40015) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000680), 0x10000, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r5, 0x541c, &(0x7f00000006c0)) r6 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$ARPT_SO_SET_REPLACE(r6, 0x0, 0x60, &(0x7f0000000140)={'filter\x00', 0x7, 0x4, 0x3c0, 0x108, 0x1f0, 0x0, 0x108, 0x2d8, 0x2d8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0xc0, 0xe8, 0x0, {0xa00}}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x410) syz_usb_connect(0x6, 0x725, &(0x7f00000010c0)={{0x12, 0x1, 0x310, 0xce, 0x17, 0x55, 0x40, 0x499, 0x1035, 0x4fb4, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x713, 0x2, 0x4, 0x6, 0xc0, 0x9, [{{0x9, 0x4, 0x60, 0xfd, 0x7, 0x2f, 0xf7, 0x29, 0x7, [@generic={0x5d, 0xa, "52fcf05914d608b16836bee054e99b446ccaec92719fac4ef8c7e5a635a73234842f2b526a93784489f7fb8409b633b1769f17f80b05d96904d22c2892340a1bbaf10c0e89c58812eec5b15916d77ef404a6b5c0453c59db4f908b"}], [{{0x9, 0x5, 0x83, 0x10, 0x8, 0x4, 0x2, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x40, 0x4}]}}, {{0x9, 0x5, 0x9, 0x1, 0x10, 0x4f, 0xfa, 0x0, [@generic={0x4f, 0x22, "82b17d9d1b012a456225ec6ce7bc7a7c914adf247342654d8426021cd7be988ce26efe5e9140ac8f19c8bfc00638f8ecb3ce35f93a3c4d1026a6fd04ec845aba00689440994541b389aa74fd4a"}, @uac_iso={0x7, 0x25, 0x1, 0x83, 0x5a, 0xe}]}}, {{0x9, 0x5, 0xf, 0x10, 0x994e6d06c1633b2d, 0x80, 0xa, 0x9}}, {{0x9, 0x5, 0x7, 0x10, 0x200, 0x1, 0x3, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x10, 0x1}, @uac_iso={0x7, 0x25, 0x1, 0x180, 0x6, 0x80}]}}, {{0x9, 0x5, 0x9, 0x0, 0x200, 0x5, 0x1, 0x9, [@generic={0x2a, 0x2, "e5454b51b28b650a0c0f9d31e5fd08e5bea4ea3810431b097eb1486464d724b8f5ec870ef59bbb54"}, @generic={0x83, 0x34, "656057e784a01c51c0c91f00ed0b303b74b7785335dd71d71c0e486b8c19e2939738c4fdef35c3bd59346a9b1f5baf399d2237dd2d82432b2549a0fa0b63790598b3091f60da4fe3bd464ba0b514693236da0ebe571b61ea2a2dab97fb74eed08478c61540282cc5dbe888cd8e73c65f1cefca20d6ce63ce763691ba7160ebdf67"}]}}, {{0x9, 0x5, 0xc, 0x3, 0x8, 0x3, 0x7, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x3}, @generic={0x8d, 0x6, "06a68118e2ca21216ef387866b5291e0729280eea6b45c1644804b0681037d625c7898c3770d36920ff997993bdf551f6d479618ea6d5e4d0caa61fe93e0e46afa236f3babe80c06004d4b7a897b26ee5737055ade0896b5f73a709d6d36e1f6fd59839e88ce5675e1bdb65bc9ddbed988c4fdd6f80707d99d11811537e09517cdf67e8d5a0dcbddcec6f6"}]}}, {{0x9, 0x5, 0x8, 0x0, 0x20, 0x7, 0xb, 0x6}}]}}, {{0x9, 0x4, 0xdd, 0x6, 0xe, 0x6f, 0x63, 0x86, 0xc2, [@cdc_ecm={{0x7, 0x24, 0x6, 0x0, 0x0, "dc04"}, {0x5, 0x24, 0x0, 0x6000}, {0xd, 0x24, 0xf, 0x1, 0x962e, 0x3, 0x7, 0x7}, [@network_terminal={0x7, 0x24, 0xa, 0x7, 0x6, 0x0, 0x6}, @call_mgmt={0x5, 0x24, 0x1, 0x2, 0x4}, @call_mgmt={0x5, 0x24, 0x1, 0x0, 0x1}, @obex={0x5, 0x24, 0x15, 0x7}, @ncm={0x6, 0x24, 0x1a, 0x2, 0x20}, @dmm={0x7, 0x24, 0x14, 0xffff, 0x8}]}, @hid_hid={0x9, 0x21, 0x6, 0x9, 0x1, {0x22, 0xd6}}], [{{0x9, 0x5, 0xb, 0x1, 0x3ff, 0x74, 0xa, 0x8}}, {{0x9, 0x5, 0x2, 0xa, 0x40, 0x7, 0xb2, 0xf8}}, {{0x9, 0x5, 0x3, 0x3, 0x8, 0x1, 0x9, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x7, 0x7}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x8, 0x18}]}}, {{0x9, 0x5, 0x80, 0x0, 0x200, 0xa, 0x78, 0x7}}, {{0x9, 0x5, 0x0, 0x10, 0x8, 0x5b, 0x40, 0xe8, [@generic={0xe7, 0x24, "7cb8a9844b076d8283eaa19b84f2347e345792a936fc2e13cba7367b4619466ef3ecfe412f2b83fb9340cf9539a9089f79c24d24c377605b4f6d02f6142cc4e6ec51db5288749bb3f682c369aa1c9b91bacf99d22354ef2925058b3fd50b22426080e95c1c182a7caef12fc5138be87b79611d30ece309c7d1c692ae7290b05b351b61b9b6f1bae4974df1726dd549a465b3cbd32d2328993a8e1a49c62d98a0af93420286ad68969885f642672d8cc21aa7b8ea5c5849a91b1081b7899af97e715cef4418793745f75de1ed2576a501d7d5f78acc91a6807703692d350cafc829488c473e"}, @generic={0x36, 0x9, "5141dbabaadbd25c7e77aa48c2f2189f89b5b9847dd13fc4d9cb0898b177bbe963ff9353e3e29e610d0af05f76239350b088c8f5"}]}}, {{0x9, 0x5, 0x4, 0x0, 0x200, 0x10, 0x5, 0x3}}, {{0x9, 0x5, 0x80, 0x10, 0x20, 0x3, 0x3, 0x1}}, {{0x9, 0x5, 0xe, 0x10, 0x20, 0x2, 0x12, 0x7}}, {{0x9, 0x5, 0x9, 0x1, 0x200, 0x7, 0x65, 0x3b, [@generic={0x61, 0xa, "3a591503693f7548a0d2a0329e604245a541a713d6bcfcc30fdfddc8667581ea96e032c45d59c145a3d56f937d442fea3e9d6646f83d0766cc296e18dee6f8782c704a7483d643640ef784851de42404705e0accffb7102f34da039f543405"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x49, 0x99f}]}}, {{0x9, 0x5, 0xc, 0xc, 0x3ff, 0x7, 0x9, 0x7f, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x0, 0x7f44}, @generic={0xac, 0x4, "354e7e19f52b5defda312ace4251bf11771042e65f40155e8255994e45b5b73e64be55119c6eace3f9f1058ed085ee6ec6186dd354754731a3e6a5c484cb4bdff9d8213c03daedd19388ae6e2f7cf1d05442a06e163eb807636e35da1b9fb42b89db17f528f1c101f0d01f816909166cd45686676d58f92b41967f572f6581e3d1a53232a366ab57a042c0a16cc825cdb8b00d25d6a8155f6c709f8c4f8f10b1678ddcb163057fb5af6e"}]}}, {{0x9, 0x5, 0x4, 0x4, 0x400, 0x1c, 0x1, 0x8, [@generic={0xe9, 0x7, "22b53f1e4838399cc4c1a2d7d69349f3f0361aa2185b4fd8b966e996fa1394b897332378b6fed77be2aea944302e3f1b6da62803d14162a264ac021c2ce32e6ef8c89f2fa2be21ca8c401d0eaca57fa39043974f47b4df4ac12f95f4f1e5fd5c0e93486cd63110cb0f6a64d3c4e05f583cff748f151cda63f4be6bf2396f5fffd9209acf649b2275c5659cec6399bd86cd215a729188c2cc718730effe1934de47f16fe527489c8e44074048216bcd37c67ce514c24d208d48917f97ad8c9af05bf10d7b66a56061e2ba83146d389127971ba4097d5d2328782d61c39389e826b5d0cd52f903d8"}, @uac_iso={0x7, 0x25, 0x1, 0x82, 0x8, 0x6}]}}, {{0x9, 0x5, 0x6, 0x1, 0x400, 0x9, 0x1, 0x3, [@generic={0xb0, 0x24, "8596eb33a8ebd9da1a37e3afe3fad73744816fa0fed2ca260cd11a90d0f79cb6780a610e3ff6f69b2ec597ad8a95697436e11b16f3759273d7d9b2fe40e78a18e0fc948dbfd5427eb079cf8a7a2ed64b97dcd1229ed49de80403e15ec13144954e583a90fbc28afca7f033df3e23ab34971007b9b2a7e744220ad575a4b657999d9c020b53d42c967f499611ce10d9934f344f398a0a7ec373ee560362f86c94c97c2d11565377f4ea9029b2905e"}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x1, 0x3}]}}, {{0x9, 0x5, 0xf, 0x0, 0x200, 0x1, 0x6, 0x4}}, {{0x9, 0x5, 0xa, 0x10, 0x10, 0x3, 0x1, 0x9}}]}}]}}]}}, &(0x7f0000000940)={0xa, &(0x7f0000000700)={0xa, 0x6, 0x110, 0x9, 0x9, 0x2, 0x10, 0x8f}, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="134467f1cdb6af8b"], 0x5, [{0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0x807}}, {0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x2c09}}, {0xfffffffffffffe47, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x363f}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x441}}]}) lsm_get_self_attr(0x68, 0x0, 0x0, 0x1) r7 = socket$inet(0x2, 0xa, 0x7) readv(r7, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/7, 0x7}], 0x1) r8 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r8, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfff}, 0x1c) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) r10 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r10, 0x29, 0xc8, 0x0, 0xc000000) close_range(r9, 0xffffffffffffffff, 0x0) keyctl$session_to_parent(0x12) ioctl$TIOCGPTPEER(r6, 0x5441, 0x5) 2.303260366s ago: executing program 2 (id=21): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000240)='./file0\x00') chmod(&(0x7f0000000180)='./file0/file0\x00', 0x3dc) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x141000, 0x80) socket$key(0xf, 0x3, 0x2) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x0, 0x3, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[], 0x60}}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder0\x00', 0x6, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder-control\x00', 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CAP_X2APIC_API(r2, 0x4068aea3, &(0x7f0000000380)={0x81, 0x0, 0x3}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000002c0)={[0x8aba, 0x4, 0x6, 0x8, 0x40, 0xf, 0x120000, 0x5, 0x0, 0x8, 0x8000000000000001, 0x8, 0x800000000, 0xf, 0x3, 0x1], 0x3000, 0x141200}) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4400ae8f, &(0x7f0000000140)=@x86={0x6, 0xff, 0xe, 0x0, 0x4, 0x6, 0x7f, 0x64, 0x5, 0x3, 0x81, 0x8, 0x0, 0x0, 0x40, 0x4, 0x10, 0x0, 0x7f, '\x00', 0x1, 0x410000}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000340)={[{0x122e, 0x990a, 0x0, 0x82, 0x0, 0x4, 0xc, 0x0, 0x0, 0xff, 0x1f, 0x0, 0x10000}, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x9, 0x80, 0x0, 0x4}, {0x0, 0x0, 0x3c, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x5a}]}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r6, 0xae80, 0x0) connect$unix(r1, &(0x7f0000000280)=@abs={0x0, 0x0, 0x4e24}, 0x6e) lchown(&(0x7f00000001c0)='./file0\x00', 0xee00, 0x0) open(&(0x7f0000000400)='./file0/file0\x00', 0x4803, 0x9) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x1081, 0x200000000000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f00000001c0)=[@enter_looper], 0x720, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70b7a440b4187098442946238cdd38a235b264899fa2f8b51f8a660653545ab78b6a47b6462efaa8192061344501fb8d96f8de3b132ee012626f94be7b4a9e572a43167614409ee4aa2a40d2feb04bb54137ca025e367e2eee1e8b4f78b741aac17c55ab77d0fd2b7318207e91fd536b9fb7c994a9ad0769020b45bc05965f6dffb15fd462bb2e49632c788cfeb74472be3d9eaf3284719df7187a354b3915df2661363052a24baf8cc101728d302f75878515b436d1fbdb3fc5fc88e8745c56b1bd79dc2cc7e7b5be814275a3edfc67e923d199c97fd6a8b2d11d2923b688471fe8c1e771545d17bad44fc5f7a91cf43ba91b4627c9554a333b6e8ee1c457b54c30bccbbabdfed6158fed6e548cd54ad7409e0a03fb2f685f8987e98ee687a09a730c2a757d3b1595a1146d57230e178284ef3fed5553bbd1e82bd418a13c03f944421d013d96182302122d01c432e24c43a9dff19658a3680167297367a1ee7f70e0968ce28ca2bc8b8525c41f8d4f9cdcaaa25b2d0fea854626eba2e86ecb31e9be7b8e704287fe45ad3f169d7f67e798b0de3bf70f485f81ba5e9aef1ec5782c4c609ffdc93a3bdfeeb7e7cd05ea7023895be4a3f78f188fdbd83ded6dcdf1d429c12b1b250284110295e3515bfb117119839f13057ea2366d3c4b75b28f60afe17b195d04ff58dd2f3382bb57152f2928f9a91bbcc42057777ba13becb4552419caa2ffc325219a6995f5d1e9a193a1aede859834ef765009d6c242ad918ecf3fe62c8dfe2ff309cbce740950cdd05c8e0b7f75aa21731be678552b2d0024a4b3815fb52f056ba37f3f466afab6b5728def0fdef93655524121927df3a39af0845df7612e9ccdae25f406ac0ad7a0e4f980398597ab2c2291d87a1ed618b9e392f1d055d5290be67b6cec9e7505c41025d2aa6e82a4f693042989b5f4a9abfe0ec51fd9dcb972a054b80ee6a460fd422eaa971e2cb759c72e676e2877c667c6ce002be1ce6ba8380e6dd691590c84ba68d26f3284280dcacd082b42bf5aac71467b3fcd5d68ab1bc26cf48fe770ccff5f14ff8afafb18d3127a6d989b7d77665a7a9bf4cb488621c904acd0b073396ad8509c9ddb02eb1d23510a52289a5f0d7edba66d4ef271b9c6acc3bfa996b55f6808650236b0001132ef85fc5070b69144ff5fdd8d64f6c3e0dd22711f69a940ebdb4ab5ff6240da3160049d2047e6713d47ad0db40ec543c095ad67c8cbe438fb875927c98e265498b3da8d4ca54bac0e6efe759a2d4d4190e9fc8835599da8237f472411a71236bb930d28a26f49062d270f4087a6a709c005eebc9740ed54dd005c787c44badac9c720b0d424d0ded9bb8c24c0e842deedf386fc7714a31268292d3bcc53b1cf24b156445c8bf64336f742b1ba836eba0ae4a5aaa9a6f35d4f81734e16bce965795d5b1255609d1860fe11c9c536db078af94772830ba000c13e1d9383e3d862fa07f2199da148632c036bc19f6014eeb206a3654d390c78911deeabebf128def61122754e0a4696db82666a018f8d2f44b5aadc12809ade8bed1b1ba2adbb6e3e82180e26748dc30a8eda0edb21fcaa702632ed3fb4e89550c3e0e1fd2b5ecf1983d85bf9569b231e28155756bd97f1220cbc2b5b1c02dab88ee4a8970d4833b9e51529895afe5029823576297d4a917602fe08df57e1d7f63d050877ddf8e82a5383e15f313171b2d5618a1549f3dfced0732b887508ca5e134124d0ed0bd4b767115d1530f73504387e0364d73a2d3b114fcb49219b1c15e066c455b01672e49499995454a502236f5a5007895d3d1d8843007352a3ccc3f71d3e801efd0a6ef922bf39ead16e01ec20ebff2b1ce7cfd0984b26225cb1359b36efe9ad2ae1f6de4862c0faaa52f4d0eb4c13960ceb4aeaa10ae61a09a5abdb0c61661962a0aab14d465a8ae6f45826e1e66428cf8572eb53c98160df6613a62bb611c63f1ffb7a795a889fc16670f6302fd36ee4247bdd4282f1afb6042c832a4b0857cecae0a7090d9b11ae46d9186c710c8dd12911db573493329bea2c743734d86a577cf27aa01e4fc6c91f1fa34bba173d20b97ed8bb4bad43692df90bfd2b193b9e8b93a95ec0d0d42217395d89db511d2e9bbeb3ef47b7b2d81ab54b5c8faa760ef5c0493af13a9327c9432521ed6bfcb9d778d25031da41a983027fe7d794c26326053d38172444307d88501cdd26c3fdeafdf5f599d3dcfd39972f28ec3fb1fb40982615f5d71d6693a8774df072576834c69b89f209b458fad4671f0108fdfc8548a6fcf76a843369a3bca4d2974221ed9af224d151fa8aa73276ba65ca3d8bc98d6504f16bcac30c697f68cb1625b4f2259ee0c694951752845fa11c20fc4dda369d53918c3746918692ee2cda958612808b841b8d36ef3933f5340e1fc8fb10ac2ae97da921f6a67806831356d515c7a32468dfd3385c"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) 2.298570886s ago: executing program 1 (id=23): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42a02, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE(r2, 0x4068aea3, &(0x7f0000000700)={0xcc, 0x0, 0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000480)={0x10, 0x0, &(0x7f0000000540)=[@acquire, @release], 0x0, 0x0, 0x0}) 2.127445969s ago: executing program 1 (id=25): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = userfaultfd(0x801) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)=ANY=[@ANYBLOB="0209000007000000000000000000000005001700322000000a"], 0x38}}, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00005cf000/0x4000)=nil, 0x400000, 0x2, 0x2}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, 0xfffffffffffffffc, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x0, 0x0, 0x0}) 2.122590239s ago: executing program 1 (id=27): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async, rerun: 64) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) (rerun: 64) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x204, 0x2) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) sendfile(r2, r3, 0x0, 0x8000) (async) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000500)={0x40, 0x12, 0xa, 0x4, 0x0, 0x2, 0x0}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r6, 0x4008ae8a, &(0x7f0000000140)=ANY=[@ANYBLOB="b1c497"]) (async, rerun: 32) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x4040ae79, 0x0) (async, rerun: 32) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000002100), 0x280449c, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) setxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='system.posix_acl_access\x00', 0x0, 0x0, 0x2) (async, rerun: 32) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x53, 0x0, &(0x7f0000000400)="892a7863af87409b1b8fe4e183cc4e2c2eddca324f8c2a61fb078c81d7272d92b902bf051aacb6decd83ec368991a0d7599c3ce3f7bed9d8078ba649896475d964ddb0c6d4d498b0ef80a3f6170b75654851be"}) (rerun: 32) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f00000001c0)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) (async, rerun: 64) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x2000)=nil, 0x2000, &(0x7f0000000000)) (rerun: 64) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0) socketpair(0x27, 0x4, 0x2, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$inet6(r7, &(0x7f0000000080)={0xa, 0x4e24, 0x63f, @private0, 0x4}, 0x1c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0}) 1.407862079s ago: executing program 2 (id=29): openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x0, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4020aeb2, &(0x7f0000000300)={0x0, 0x12c, @pic={0x81, 0x5, 0xfc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1}}) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r1, 0x2000) (async) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x3938700}, 0x0) (async) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom0\x00', 0x802, 0x0) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000740)="120000001200e7ef00", 0x9, 0x0, 0x0, 0x0) (async) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) (async) close(r3) mmap(&(0x7f000022e000/0x1000)=nil, 0x1000, 0x3000009, 0x11, 0xffffffffffffffff, 0x126f000) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeef, 0x8031, 0xffffffffffffffff, 0x1000) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x10a, 0xfffffffffffffffc}) (async) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$RTC_PIE_ON(r5, 0x7005) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e2793b10d10501200006010203010902120008000000000904"], 0x0) (async) r6 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_buf(r6, 0x29, 0x2f, 0x0, 0x108) (async) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) mmap$binder(&(0x7f000009a000/0x4000)=nil, 0x4000, 0x1, 0x11, r2, 0x2) 1.271228981s ago: executing program 2 (id=31): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000280)) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000040)=0x1) r2 = dup2(r1, r1) read$FUSE(r2, &(0x7f0000000b00)={0x2020}, 0x2020) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x8}, 0x0) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000001c0)={'\x00', 0x200, 0x6, 0x3, 0xff, 0x6, r4}) syz_clone3(&(0x7f0000000480)={0x200a00800, &(0x7f0000000140), &(0x7f0000000240)=0x0, &(0x7f00000002c0), {0x29}, &(0x7f0000000300)=""/170, 0xaa, &(0x7f00000003c0)=""/75, &(0x7f0000000440)=[r4], 0x1, {r2}}, 0x58) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000500), &(0x7f0000000540)=0xc) syz_pidfd_open(r5, 0x0) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000100)) close_range(r0, 0xffffffffffffffff, 0x0) 1.217588222s ago: executing program 2 (id=32): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r3, 0x8910, &(0x7f00000001c0)={'vlan0\x00', 0x2f}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) accept$inet(r4, &(0x7f0000000140)={0x2, 0x0, @multicast2}, &(0x7f0000000180)=0x10) pipe(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0xffffffffffffffff) bind$inet(r5, &(0x7f00000000c0)={0x2, 0x4e21, @loopback}, 0x10) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000400)={0x24, 0x76, 0x31f, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @ipv4=@broadcast}, @nested={0xc, 0xd, 0x0, 0x1, [@typed={0x8, 0xf0, 0x0, 0x0, @fd}]}]}, 0x24}], 0x1}, 0x0) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000440)=ANY=[@ANYBLOB="b0000000000000ab284dc9a94095f54e34f11a5a480d2115805745f8a24d"], 0xb0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) openat$rfkill(0xffffffffffffff9c, 0x0, 0x28001, 0x0) poll(&(0x7f0000000340)=[{r0, 0x652}, {r4}, {r0, 0x446b}, {r2, 0x42}], 0x4, 0x138) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r7, &(0x7f0000000980)={0x2020}, 0x160e) 1.167405233s ago: executing program 1 (id=33): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000001600", @ANYRES16], 0x20}}, 0x40816) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r2, 0xffffffff80000800, 0x0, &(0x7f00000003c0)={0x0, 0x5, 0xfeff, 0x0, 0x0, 0xfffffffffffffffc, 0x3, 0x0, 0xfeff}) fallocate(r2, 0x0, 0xa, 0x20001) mmap(&(0x7f0000701000/0x2000)=nil, 0x2000, 0x1000000, 0x8030, r2, 0x6000) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0xfffffffe) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f0000000540)=')}%!:\xb9+\xe4\x1f2\xba\xc3\x0ed\x93Z\xbf\xa6`\xa6\x84\xef\x18\x8d\x90@\x1bb\xff\x01\x8a%\xf6vl\x15GPFo\rAmW\xd7*F\xe6\az\x852\x92\x0e\xd9\x9a\x11\xd3\xa8\x96\xad\xcc\xf9\xb0\xcb\x8f\x1ao\xfd9\xa8\x03\xe0j\x81lM}\xf0\x1e\xfb\xd2\x84\xa0\xb1\xc0\x97\xc16\xf7@l%j\xc9\x11ll|\xc6x\xcdD\xd7\x94\xe2\x1c\x96\xa3\x88a\xd8?M\x8dA5q\x11Ou\xa0 LS\xff\x92Y\xee3\x8a0\b%\xe8:}\f\x14\x03\xc2S\x8a@\xf8w\xe1Z\xb7\xf5\x9c\xbbj\xb7g\xd1\x9dH\x18\x9a\x11\xc0f\xbd0\x9cD}\xf8\xff\x9d\x8b\xb2\xb2&\xbb(\xba\xe8f\xd6Qg\x9dT\xfa\xd01\xec\x12\xf4\xfb\xd4\xf1|/\xf3]\x03-\xe0\x93=O\xb3\xdcf:R\x11\t\x15\xc2\xfaV\x17\xc9b\x9b\x95\xd4@\xdb\xf0\xb5\x02\x8a\x91\xb0?\xc6g\x88\x1b\xd7\xd4!\x99\x02\x8b\xad \x90\xbciz\x99R\xa4\xca{H&\xa9\xd4C\xfd<,pAz\xf4_\x9d\xf8\x98\x8e\xd9M \xf4\x0f)O\xbf\x8d\xf9:$\f\xc7\xeb\x96Vpg\xb0\xea@q\x03\x87LZ\'\x93\x1e\xecY\xd3Lc\xfe\xbf\xafm_\aO\x96\x00\x89\xca\xb2\x0e9\x98\x8b\xbb\x84\xe0\xd8\xb2\xa1N\xd8o\xc0K\x85\x8f)\x00Lr\x00N!A\x86\xd4\xb2\x98\x86)Cr\x0e\xe4\x86\x970f\x9e\xba\xe9\xba\xd7\xb8W\xa5\xe9\xe3\xaf\x9fj0\n|\x8e\xbd\x9f\xef\xc7iq+\x0f\xcf\xd3\xb2>[2\x98\x7f\x14\x9c\x13\x83\x80\xf3xv\xd6\xd0]\xdb\x82S@\x92\xbb\x97\x8a\x850\x84\xd9~1l\x98\x90\xfb;\xde4\xba\xdc\x8a\xb7\x1f\x8f\x19Uz\x9c\xcc\a\x1e\x85=\xb3\x18s\xe2\xcf\x92\xc4\x05\xb6V\t\x06\x96\xfe\'x\x02ryX\xe6%U\x80;g\x0f\xa11\x12\xfb\xdf\x14\xff-b\x0f;\xb6\xf1R\xea\xfc\x97\x87\xbejB`\xa1\xe6,\xaa\xc4k\x02\xd5\xcc\x1bu\x96\x80\x81?\x87{\x06\xad:\x15\x93C\xab9\xb1\xaf\xd1\xcb\x8a\xeb\xdf\x9f+^\x7f\x06C\xe8\xc3\xbew6\x8f\xe7\xf0\x05x\xb7&p\xe0d\xea\x92DQm\t\xb9\xa8\xa5\x00\x00\x00\x00\x00\x00\x00\x00\x00$\xe4l\xb2\xc1.\xecu5f\xe1\xa4\xe1\xcf/\x00\xdfx\xa5\xc0\x83\xab\x1b\r\xc4\xd2\xb5\xd9\xbbs\x9a\xd8DG\xd1*t\x03\xaa\x1c\xa0Q\xd6a\xe7\xb64\r\xd9BH/\xa1\xfa/\xaa)\xe0\xdf1D\xd1\xb2\xd2\xabR\x9c\xdcrU\xf4M\xca^') mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) 1.167015953s ago: executing program 3 (id=34): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xe22a00, 0x0) ioctl$IOC_PR_RESERVE(r0, 0x401070c9, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000d40), 0x1, 0x0) read$FUSE(r1, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xf8, 0x1, 0x1, 0x801, 0x0, 0x0, {0x3, 0x0, 0xa}, [@CTA_FILTER={0x54, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x1a}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0xb}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x11}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x12}, @CTA_FILTER_REPLY_FLAGS={0x8}, @CTA_FILTER_ORIG_FLAGS={0x8}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x2}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x8}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x20}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x921}]}, @CTA_SEQ_ADJ_REPLY={0x14, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x8}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x5}]}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}, @CTA_SEQ_ADJ_REPLY={0x1c, 0x10, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0xac5}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x101}]}, @CTA_TUPLE_REPLY={0x50, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x3a}}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x9}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4000}, 0x81) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x188) mount$tmpfs(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x1c051, &(0x7f0000000000)={[], [{@subj_type={'subj_type', 0x3d, '/dev/rnullb0\x00'}}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)={0x0, 0x0}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x14d200, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r3, 0x0, 0x484, &(0x7f00000003c0)=""/33, &(0x7f0000000400)=0x21) syz_open_procfs(r2, &(0x7f0000000180)='clear_refs\x00') socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1, 0x22052, r0, 0xfffff000) 1.166046363s ago: executing program 1 (id=35): mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='exfat\x00', 0x200000, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_xen(&(0x7f00000000c0), &(0x7f0000000100)='./cgroup\x00', &(0x7f0000000140), 0x4000, &(0x7f0000000200)={'trans=xen,', {[{@access_uid={'access', 0x3d, r0}}], [{@context={'context', 0x3d, 'unconfined_u'}}]}}) 1.158957483s ago: executing program 2 (id=36): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000000c0)={'syz0\x00', {0xfff7, 0xc, 0x5, 0x81}, 0x1d, [0x7b, 0xb7e2, 0x3, 0x9, 0x100, 0x3, 0x1, 0x7, 0x9, 0x2, 0x7, 0xa, 0x3, 0x0, 0x7f, 0xc, 0x7fff, 0x6, 0x6, 0x5, 0x6, 0x6, 0x7, 0x6, 0xff, 0x2, 0xfffff5ee, 0x401, 0x0, 0xfc75, 0x8, 0x9, 0x4, 0x2, 0xffffffff, 0x81, 0xfffff765, 0x2, 0x3, 0xfffffff9, 0xa, 0xffffffff, 0x5, 0x0, 0x3ff, 0x6, 0x200007, 0x4c, 0xfffffffd, 0x80, 0x8, 0x9, 0x9, 0x7, 0x8000101, 0xc3c, 0x1733, 0x7fff, 0x7ffc, 0x1, 0x6, 0x5, 0x1, 0x4], [0x8, 0x3, 0x8, 0x8, 0x0, 0x8, 0x4, 0x0, 0x25, 0x10, 0x6, 0x7, 0x8, 0xe62, 0xffffff73, 0x1000, 0x6, 0x13e5, 0x3, 0x3, 0x1000, 0x7, 0x1, 0x3b40, 0x4, 0x1000, 0x5, 0xe4, 0x8, 0x5a, 0xffff2503, 0x7fffffff, 0x6995, 0x1, 0x80000000, 0x8, 0xdaa, 0x5, 0x2, 0x76c4, 0xfffffffd, 0x5, 0x4, 0x10000, 0xd, 0x2, 0x9, 0x10, 0x4000e, 0x9, 0x7, 0xa, 0x9, 0xffffffff, 0x8, 0x3, 0x2, 0x3a6, 0x27f8, 0xc0d, 0xfffffffd, 0x9, 0x9, 0xfffffffb], [0x8a3, 0x6, 0x3, 0x9, 0x1000, 0x0, 0x80000000, 0x5, 0x7f, 0xa, 0x100, 0x1000, 0xf1, 0x6, 0xc, 0x10000, 0x72, 0xc, 0x633, 0xd, 0x7, 0x6, 0x80000000, 0x6, 0x0, 0x7, 0x8, 0x2ef3adcb, 0x10, 0x2, 0x8, 0x8, 0x74, 0x4, 0x7, 0x7ff, 0xfffffff2, 0x63, 0x7, 0x2, 0x3, 0x3, 0x20a7fd9e, 0xfffffffd, 0x2, 0xa1, 0x0, 0x9d, 0x7, 0xa8a, 0x2, 0x6, 0x77, 0x8, 0x1ff, 0x7, 0x7, 0x2, 0x0, 0x80002, 0x8, 0x2, 0x3, 0x5], [0x4, 0x4, 0x5, 0x7ffe, 0x493e, 0x3, 0x35ff4447, 0x7, 0x5, 0x4, 0x7fff, 0x5, 0x5, 0x3ff, 0xb88f, 0xffff0000, 0x9, 0xf7df, 0x2, 0x10, 0x8, 0x2, 0xff, 0x6, 0x4, 0x4, 0x0, 0x0, 0x7, 0x4e6, 0x8, 0x6, 0x5ef, 0x8000, 0xc, 0x4, 0x401, 0x1, 0x5, 0x0, 0x9a8, 0x99f, 0x231, 0x3ff, 0x8, 0x1, 0xffff0001, 0x1, 0x1, 0x10, 0x8, 0x5396, 0x6161, 0x9, 0x101, 0x1ff, 0x8, 0x431, 0x6, 0x5, 0x4, 0x7b, 0x7fc, 0x9]}, 0x45c) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000140)=@x86={0x3, 0x4, 0x0, 0x0, 0xc, 0x4, 0xd, 0x3, 0xb8, 0x4, 0x2, 0x5, 0x0, 0x8, 0x1, 0x3, 0x9, 0x6d, 0x81, '\x00', 0x2, 0xfff}) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000280)={0x2, 0x0, @ioapic={0x0, 0x200, 0x20003, 0x10020f5b, 0x0, [{0x0, 0x9}, {}, {}, {0x0, 0x35, 0xff}, {0x20, 0xa, 0xfc}, {0x0, 0x0, 0x6, '\x00', 0x7}, {0x20}, {0x2, 0x2, 0x7}, {0x0, 0x0, 0x8}, {0x0, 0x1, 0xff}, {0x0, 0x0, 0xfe, '\x00', 0x1}, {0x0, 0x0, 0x0, '\x00', 0x3}, {}, {0x0, 0xfc}, {0x7, 0x0, 0x0, '\x00', 0x39}, {0x0, 0x2, 0x0, '\x00', 0x8}, {0x0, 0x8, 0x0, '\x00', 0xff}, {0x0, 0x75, 0xfa}, {0x0, 0x0, 0x0, '\x00', 0x20}, {0x0, 0x0, 0x3}, {0x6, 0x0, 0x0, '\x00', 0x1}, {0x0, 0x0, 0x0, '\x00', 0xfc}, {0x0, 0x5, 0x0, '\x00', 0x1}, {0x0, 0xfc, 0x0, '\x00', 0x80}]}}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$cgroup_subtree(r1, &(0x7f0000000200), 0x2, 0x0) r6 = socket(0x2, 0x2, 0x0) setsockopt$inet_int(r6, 0x0, 0x13, &(0x7f0000000040)=0x1006, 0x4) sendto$inet(r6, 0x0, 0x0, 0x80, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000540), r6) write$cgroup_subtree(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB=',cpu'], 0x5) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f00000002c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000000)={@flat=@weak_binder={0x77622a85, 0x90e, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/255, 0xff, 0x0, 0x33}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x31}}, &(0x7f0000000280)={0x0, 0x18, 0x40}}, 0x10}], 0x50, 0x0, &(0x7f0000000380)="1920ff09471b1099c7961fdcc405843a41a786d3ed8ebe8e80e4b4144e1cf51c728b926c80eb2a8e4f6b2dab5b6ac95dd16066dc703442a9132a8dd210e45df98d795a638622681df1cb222612051f61"}) 1.092049604s ago: executing program 3 (id=37): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000001100)=@req3={0x8000, 0x200, 0x80, 0x20000}, 0x1c) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000280)) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000040)=0x1) r4 = dup2(r3, r3) read$FUSE(r4, &(0x7f0000000b00)={0x2020}, 0x2020) close_range(r2, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0x5a051feb1f984a1d, 0x202812, r1, 0x7dfff000) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x80049367, &(0x7f0000000000)) 1.043220685s ago: executing program 1 (id=38): r0 = socket(0x10, 0x3, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) (async) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000340)={&(0x7f0000fee000/0x11000)=nil, 0x11000}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x10003, 0x0, 0xd7c4, 0xfffffff9}, 0x10) write(r0, &(0x7f0000000280)="240000001e005f0214fefffffffffff8074000001d00000004000000080009000d1b0000", 0x24) (async) r2 = creat(&(0x7f0000001380)='./file0\x00', 0x4) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r3, 0x0, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x40004) (async) pipe2$watch_queue(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$PPPIOCSMRU(r5, 0x40047452, &(0x7f00000002c0)=0x8) (async) r6 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, &(0x7f0000000340)={0x0, 0x5, 0x9, 0xb6, 0x0, 0x3, 0x0}) (async) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000005b574e69622bf85eda07b3"], 0x0}, 0x0) (async) r8 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUCODE(r8, 0xc018480d, 0x0) syz_usb_control_io(r7, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000300)={0x0, 0x17, 0x5, "0f7dbd41e0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000040)='proc\x00', 0x110003, 0x0) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f00000011c0), 0x65101, 0x0) ioctl$EVIOCGKEYCODE_V2(r4, 0x80284504, &(0x7f00000001c0)=""/112) 918.511596ms ago: executing program 3 (id=39): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x20e02, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x11, r0, 0x45809000) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0)=[{{&(0x7f0000000400)=@pptp={0x18, 0x2, {0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000580)="7ef64777995d3f25e813e01cafc30c3f433ef3d969292ef9a74aff9c6febb7b56afb2653091d0a3fc5df54b9754990eab3430f5c12b8734272f493f33529d43e30253a1c9b57d40bdb6999be2916b6bc185e830bbf579daf61027897c6a7275c7018a8978f3013342bd70904705264bf1c5cf7e850c030e8ff98e6be404dae21a6a5c9ceb31a8a0f23a9c7b5c4c13f6b70b1d9e51484b53084cdba0fdac6c199b833de805545edd3869324f3dd824b60f575c05dd9e39b696db9b3d8256d619a3a605abf37d4ecbb65dffcb8b52b97cae2754a1c", 0xd4}, {&(0x7f00000006c0)="75e38055680a4efcd1b911d0a2bb078d005c10265da29950eb5ed9a344ef755f1f04dd0bbf6f76fc6294e686d3c3b14a31bd6407e640e9dd2bf77e27832109820cef915e354f399bbb87ccbc83ab90b8984b519f562024c0f631dff31041e72c5270bafe642a7c9b40c113c45ab0cbeec2d7164d345718cdc65897ef961fc6ddfa27ad9c4e4e68a8805eccf7c12fa6b7c375c69cf2937b291f0a45da587fb242b34f1c40a1ff77a8f7e98b08c527bbdb9394c5aeddac540a350fbad997e7874524cee9b938ece6be073a8045a281c460d730c32e9c492c13b08358cc46e2b3f8054c07b9596583aa2c", 0xe9}, {&(0x7f00000007c0)="b812e11ecf96d220aa5a519237d19eb22ecf3d626b725b05fe9bba2a95d695047c6674d381dffee73be0830940f23786a509f5d6f152ed83ae6171775ef3a496dcf563c5d2a5c819f16726670c42fbdade79b3995f33988cce69576d4fc4de7a26a19d28f71343fc890325446fdaf6f60be2e0fd344286689e176767a22b9e22852e8b3d20a61797cca1d5c6ef6b6c5db33d12d77cf365", 0x97}, {&(0x7f0000000200)="03ec4cbd9f0e88f35eebc60d07ca4b115aa8ecbf51a661ea5da05f0d75630cde", 0x20}, {&(0x7f0000000880)="1a3198e37689f10793a3d6b6eb90625b3af9e81a7e9afe4e8827b9e40680923a5b4ad675eebb93208e67a7e24fa3a3d666be8c05fa1e74c1daa95af444718884c82bef5c76f6e724dc560c2aacc943c789645de77843c91d677d9161f8087339dc9b6d6648594d85143911c9c0db259b46af7a18011ba4584f990dc201a11dc273d0b7dceaf6c85c8476e16130add26cd4b402", 0x93}, {&(0x7f0000000940)="cc328b59a13f5ec8c0a16c9dba11b3656efe3f305141fa002150c50efa749a8b130b7769ac06d700f6fd80ab98b11270e05a4468e30a376753c57ccee312fb8eaa41feb1d606429e375bd6f23f2064884395e1fb4bc21bfe2ee3cae4233092766bdb586c3d1985ad1530b87cd552f1a2f6ecb0adcb83309e4062720e41d9caa3db61c29107003386d1246eff5399e66d", 0x90}], 0x6}}], 0x1, 0x20000000) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f0000000300)=&(0x7f0000000240)) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0xeeee0000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r2, 0x29, 0x31, 0x0, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f00000001c0)={0x2, 0x1, &(0x7f0000000040)=""/39, &(0x7f0000000180)=""/23, &(0x7f0000000340)=""/153, 0x8080004}) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x18) mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) mount$incfs(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x0, 0x0) umount2(&(0x7f0000000000)='./file0\x00', 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000300)={'veth0_to_bond\x00', &(0x7f0000000040)=@ethtool_perm_addr}) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) 855.041407ms ago: executing program 3 (id=40): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0) r3 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCSUSAGE(r3, 0x4018480c, &(0x7f0000000280)={0x2, 0x1, 0xfefffff7, 0x2, 0xf2c, 0x7}) sendto$inet6(r1, &(0x7f00000002c0)="e8", 0xfffffffffffffd79, 0x2000c850, 0x0, 0x4d) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) writev(r1, &(0x7f0000000a40)=[{&(0x7f0000000000)="208a94057a775c1b76f05504a09ee132c2595469b18f63ec54de9facecb972ea109ebbffff7a81956287873190bc642c0b798682e3b2fa6eea94", 0x3a}, {&(0x7f0000000300)="222b08b90690dbbeeb050e2fe9c1e075ff2ddb241e3477f015700a94f69314959511ebe417d36a41ebb9f8a9eb6c6e46aaf6e65be52250c813b6f919e260bbe8d855acf165b4888db1afb18694bcc858651f9e2c774295686afe1fd62c3e71074ab6d4a82b250116b505c808c903dc97d865952cadbda37b95a560d1f00048a47fc789", 0x83}, {&(0x7f0000002f40)="d667301bd1d1849d2ed9ee986a446dea6ddf48d9a3209415e30258227da4df470cbcd6f3511ca7e001220e6ca9b07fce7f082de3c4bb263b78e42da8ab9cbeecde70fa7977de1988de2094ff483ee62a485d0271f7c2c1ded4a5858e090abf701d6f5ec78b442ef52a73544f5173bd7a9d79db8fbbb6956240a46a6a50df4128ac0e8cdc3c8f3821bb0408a07f5319ac61c303d8235939d3f17a23bdc1de478e09245ebe7828368152e74708d69dfc93d58c73d0d2b07f0528a7e05a67e739020a5790b1d9bbaab1e96e8debd205235c1a9fc1cfd60d76fb6bbbc7a2da4116c956eef8bb15156ee90324b598db7f06ecd38a6b0772f793c4baf172aaf595f890715ada1928d016d3890d73bc6842edd1bc33fdda5398a0ab1301fe7311ef8858c3bf68b81deab9daf5a6cbf396d62e7806f7f0e6b0b7208270d0e3598b4861796d876423caf80cc75b0699c43bc2c94fb3702ddcaafefa637e23504c474b4248fe4887788dad66d4e88429e5cff282ff3b27feb30666b29bcadf617b3db6f1e4848a2041fbecf689423a256876740e7263748c520facd3eec8edda43c109e81e27d91f1e4e13af3e738f5b557f1a32b13f99874b1257c7e36e0b5a32187459fc93500e08325937b196e40c0c65e06dbbe5bd52fe9b6db42b350c9a96a4d996ff1a05a5cffebfcf56716ae9a3c7f9768db96b5e034f0ba8837e9936a17df353702dbf4463b15d64010a65e75805dbb749598511d3330b30d1bc61631fadcdf7755e6de3ae61e855680479219d9f89311ec02dbd878f49292ae1405ca09cc1fc2f8ebbfcb8ee79bbfd1948357986390605f5032cc4f4baf8556cdbce22fa90059fb6e38bfeae2f9b283d6dbbbb90b536b02746212a9822c249d641a6a68aaf3a8fbb111b4fcfad46b3bed94c0a2bbd8471edb26ee5fd21276e6e6fe3d0053461ede35eee03312834b20e5ded2281a834317b2a4a17e10ff283e3f91e65603f8b50219e61138f414cf257c25baba5d6eef6756ee0c9bfc8bc7856004f5ceca6081aca71998f8ed38e70303ead19eabd86f7c21eddc8293892c1d19528aa820f8780b11829d72b858dfa6ac6a10d3f798629fda18f171431628ca9eabf4e3f3fddc2a1e936ea8edebc1940494c3525d12a1115203db9bcd7e4c024cc1cfbdeb553880cb9e9d39dfd322c4f97d8381fa3aed0bafac36eb0813e75ee8bf32b0e7fc9785fcf1d55950b8e8263df973665e762c2d3b4bedf974fdbaf2a3ce0cdaa190df9708ffe3e1452fcb8efa2343d7db8274086abf7cc07f02fb683a233d8538d37f2f852d639dd0ae9837508341e92ce84145d113a98022b8cb3d55fa9346ec4f0327903a3d8c447e4db070ddfed58e33fc6781f51677941dd17d2b83e996197bb738196b0dbb5b552feb27b69c6d1fa196c8f56c4a83b61c2565e0a816e23d2dcadd0e23d2cdcd97606502ceba7c4b4c1c71a39633c2ef369fb06c4f9ba8199761a790baac2714ce2f871b6f7242fadfac37ff3e8d257430af226dbe0f10ebbd04417baf03b798b2e562b0d70e3f455430df46bbc38df4580b1c58639562b7314dc8ffe5e74cb148348dad6e4f907c6c823fd70a35160c5dd4ae3c6fe45045d5cc02fb76320c7ecb8df284bd98056dc37ce262d178e883e7ddef84c42d1ff7ae7b6fc8364e645c2ed48ffb91cb9115a922cf52517caf4d660555e432a2eaf986e3af8e90fe9c89d54c920911a39eaa47518799a2e3bfa8691ba1caeb4699d9273fad8936f2115c0f49cf11ec26a56e608a926f07caefcdd23c06e954c6efa32e7fcca7d5af5d07014d1b44b2c0216570357d81bf91e3cce5d5a006f924be74f05e2667b4df27e7be5c0be626f9f917090eb895ad5698b2dc438f9c113e3cb38c7c434188276a5e6b43a30d3f4caae94b39263f5821a730c4dffeb54b7f2f37cd5f5251d42e7be6c40eb78679378d0b29d117e1f1572a62ea12c339a252438e4896a0c345a312f1ddf1d9430fb24162e6f72e16d701ff8acaddcac4547b735a96444880f01b48bbb6acc75d1846274ad4aa1b0bff114678437dcd4f2e42b38dbd2f2fc127aacd68258c334f57a9016115a42efb7c8a738a34d7e06005ec453f89de5a777d9438df63f815c50eb3222c4d3faa6d05f76124477783e24f716f78dd800fbfc2959b9e56098c8a2b4df3d7e47450d05165c215d23ea305d809ac7078a7d5b7bf3be6520aa6468df5dea2e26167d02b7e3c6345b92b778fcfbd1364ce4128239358b1edd2c77b46287e4dee4a4561bf9c0bdd8683d1244b142189d8b428475a0215ff3ea129d2cd6fc7ba7b444ef2e895a71db276846af7121151146cc171d28e287be882712e22abe54d132a8085ef506b275390f06f874220adfe773862cd1a8eaab2602d9e91d283c0c79b658af4448e0fa0c6d3053ae27b0d6888adaa00e34bd29eacc12b2b8ebebf201fed062a063db72b3cc3c8a333a7eee73d28af952d79094f08376cadf81b5a18bc6c413bf0662810ad537cd9f22ebac0a7acf7d0bb6a538ff8d76315bdd08708abace2513c71d301a3bbfdcf3d16377abb9402e1deedefa7527437b4a976a3e3c1f031789b7ed45f6dbc6131c49fa7da221ef1172d9f88728f883d63a6652b73ef60a02fee83269429d9a0c00d08217c6e16ed475ee912eed39f15e70b45970a1e31b9f6ebe5e2e5144130dbf22e3cbac96aa6b7c7cd8ecc0e727a81f10b286a1325571f3926db583c120d3f50e8a8c99f7dd20e06cac9829743fd9ed3fd19f9279d67cafeb1cf6f826ed2da00f1bb8e26edc76f22c074d3af8e597e627f762739a08fab681daebca1700acd7dc23d07b6b0b04bcd293f952d1606d865751ad5de5b3f76a71cf3c42cd2fbb1197b75e05cf4ed31474921debd74a0852019699f7ac2b8e6f1f1e2970db6269158616e3437cb7e0a0bf9da089dd6fb55684e775d2eea9f7f7c5278248f32d44da0fea62dc21c77bf1cc45e484773717ff4f6bbe509cc8c071e8eb3cfea137a8cd515ee0903ff2072c58a118cada663dc1e00d015f0bef74ebd20fee51d76a4ede0b7b60fa1e3e96922c247ed8b5acf26aaa510ae22a98624e42b0347f785f23a4f047ff6ab3b48fa67eb14ae1fa76825bdaec6f30f012d6e19e4514d53cb8f11b06dd5ce116ef779e0edf06099653c4291cb7d0fcd19d66d163072eb581a757b9fb383e2f8ab830dc3d3f6312dcf92b6b2cae567883ca010b6f47cc0858cad58f90373820e41185a0541df63f1bb64de44da330155e7f931cf46e9f8b1c2af92f02d71f23d24c3ac22c4808f6828e1a54017918e213df57447c32516cc668a3f0d5725a475de7fbce88591805bebd0cc58fb07629a0348781544d50babb45d739eafb75391f19d4771721ebca75d29286d6c1e99a5e6505ce4a89bc5389b6590e2558b9bb9f3a0d62cacd85159453b4e6494ab77ffd36c74e80721b599ec9c93b6427f32cd23c0b3b46cad92c024e9a8af6a886f675b6b378d8e7f3e87c077652ddf1b2519fc488c573cc324ec79a29a574767f3ffdb65d35fc3c304b1ca313e70de86466a73c19e2aa50c816dd2ac7686c81da7084fbabc349f2c22432b0ef39f5b8474e55a4aa6db80771404831b715602fcab2f760c071bc4a151d2d49575d0006869ef2d571c02341a99770b4102027644bb92bcc02bb9d18131ff62f65f778d1f484ed189c29d7758422cd34eefb4183d03ffa55516d9ec59be5357acfa37ceeb645787348fb1372392704c397d8d083f32164ad89f3954091c62cdee8199cba0566523e06c56cea129ac33e0ddef59a2aa7649732d28a4c157842d92dc4d0ac26d9477928939365f69391b6c818a722788ff492adf32783c87a64ab1cece9d638c6e97ce30b19f1b2ce4eb9c85660de51be4013b05bd5621e0ab815793420d5709d7d94498a5a7b15e6f70f0dbd3817cb8fff098b5b93decf407601ceb7af6cec8e2514a22a7493d4bc9ab50bca2664e938612c8649b3ccddaef9394dbdf2bd11e1a16efecf50c353ab70f1737414d003583b58a6d5c852f72a3ec86d0c596593d5725ca840fb002bef19219a92a6cf4a774eee230b71a47edceca3c47f327aa3b45080f6a68a9404b79c825e1d47ad0315c50c903c6ab2fd5552fef399b0efa7c56e9e70b63c9d3714554733e992b59c1845aa8382f7bd57d902662ee2514fe1888f5f65ba2ba351d4364f9ebd7546d6c60dcefa7ce1e31fb1d868efb3141c5c97a9c909c415124d3d4df631f3aed371962bee4b2d95d6443b84a8c8edae1a99f0f94e767a295a77b25e6dfbc37ed7546ed445e2c9fc75d5b3b0c14a71e52b449dcb0a45d1266c0bd28f118bc45f36626145d88c7b12677b50c41107e9bcd9b589fde9f1f916e61ba44922dec23472fc0e97ffa4fb0c810e704f83d9805c7937aa95543a51259068d4540530da8e34d618d01d1ff133be245ea0095b904aee1d9f1cf95cdc13e2e5c60ea4b925aefd2c9b1511f1b2f0a0b13101f3df5f23cd4bf5eb36ccb37e134a6d09631f1afefba9d391705a0dce50bd2e44bb3fabbb86398931e1d35af87cdf250df0627065218fdcdee1cd0480c788864e06f21bab2c8c4e3a56ca0eee1a0b24757041bf37073ec04533bd9e05a7d97a1b3510ceadb339c3d531b4b718a870077a9286bd87d9c1fd882b2001c63ed3ba8c8c32cc70a5b09be8fdd9762ff309666978daf2945dbb392f78fe6c55eee66f7dacfd759b97fc4bde28e4a66cc435c90a8c6868c70d97f69cad45c75b35f0d3bac257fe97a40f79a2e08afe762168067f5c411198270836b420b0cd30f4d1dfd522bde0467ac3fb2c73479485077abf13acd381f534267ecca2430fa8f091de005c61abe2c0decd0913e14275444c22237468f42f2725874e910c9405753e88357770798091d11b2f39b1550dfa40d650df4de57b05fe877855ed45ff7659ccc9d17094ea09d6e05cd4875798847e2509ad233ac9af42515bca9334c1eb705d236809f2afdecdac5fb6e9f93c3cbb2fc14e1ea28349cc7f6e58b4ac756f81726ea975d70d6962515deee64ca418130a0a2b49a713466bbe6ae379ba594ea4e1cf592bee0ff0f46502383c137fa32c3466ae9fac480c2e273a2955797cb0ffba71d279178261fe904413286e21d3e74e41b586d5d6eb13e4be85aa86744bd518c7cace263dddc4d341f9f2d63a3bc660f161e71d16a9dc08d3b9ee59fc00583fd11b958f5aabbd2368bd9c5af5c494da01df1e951ddecf76cdad0eedc384b59ba6fcf5c46d66d2badc88e231256e49928e6652feae56aaa2394f2be5133258e0e0ab6f97d398a51b80d4310027e43d677082f61f9216a4ebf14d8777f84ab67f19e80c460714a52d88277d11480b597ac1428307ee59b15e1db9c3b84af96affea00fada29bcd3fd6141b3ad2855958f63d019dbf89c4540322af266132d9e6210fc47f5d49f95a51434f168d565731952111962f64db13a98bfd741ba591d4869767c4c5f82d00359efe16e21", 0xf43}], 0x3) r5 = dup3(r1, r4, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r4, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x20000860) mmap(&(0x7f0000312000/0x1000)=nil, 0x1000, 0x0, 0x110, 0xffffffffffffffff, 0x100000000) r7 = socket(0x11, 0x2, 0x0) setsockopt(r7, 0x107, 0x1, &(0x7f0000000080)="010000000300060000071a80000001cc", 0x10) fsmount(0xffffffffffffffff, 0x1, 0x3) clock_settime(0xcd1f6467c1540c16, &(0x7f00000000c0)) close_range(r6, 0xffffffffffffffff, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000001f00)=""/4106, 0xfffffffffffffccb, 0x0, 0x0}, &(0x7f0000000080)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000001400)=""/200, 0xfffffffffffffecd, 0x0, 0x0}, &(0x7f0000001380)=0x40) r8 = syz_usb_connect$cdc_ecm(0x0, 0x7b, &(0x7f0000000440)={{0x12, 0x1, 0x25c810697533d003, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x69, 0x1, 0x1, 0x9, 0x80, 0xf5, [{{0x9, 0x4, 0x0, 0x40, 0x3, 0x2, 0x6, 0x0, 0x3, {{0x7, 0x24, 0x6, 0x0, 0x0, "b2ab"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0x101, 0x7, 0x4, 0xf}, [@country_functional={0xc, 0x24, 0x7, 0xd, 0x8, [0xb, 0x8, 0x400]}, @network_terminal={0x7, 0x24, 0xa, 0x4, 0x40, 0xf9}, @mbim={0xc, 0x24, 0x1b, 0x6, 0x96c5, 0xa, 0x7, 0xfff, 0x4}, @acm={0x4, 0x24, 0x2, 0x3}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x40, 0x6, 0x5, 0x4}}], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x4, 0x7, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x5, 0x7, 0x7}}}}}]}}]}}, &(0x7f0000000800)={0xa, &(0x7f00000003c0)={0xa, 0x6, 0x200, 0x2, 0x8, 0xc, 0x20, 0x9}, 0x8, &(0x7f00000004c0)={0x5, 0xf, 0x8, 0x1, [@ptm_cap={0x3}]}, 0x6, [{0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x437}}, {0x9a, &(0x7f0000000580)=@string={0x9a, 0x3, "fb09c04fc75e86b5c3f1ee4f935e7041f7beb0048b7455ddf45e35d9d21d64815b7c0e41f7f3adc891bcf7be014c3eecfb0647e081eb3d39c1af7fa5dbc0475a7de4eb80fc271a7c11b87fa7ca7a69213837c2e4fe10556dfe933acd645fa5875740a78d4b0371487d08e454796a260288df5473562baec0c996cb36773b1d495c81696c5db24c1c60fe9304fcf7a39953f1e563b4b91f81"}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x860}}, {0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x420}}, {0xb8, &(0x7f0000000740)=@string={0xb8, 0x3, "f5112751d402a01fa351c8514eb0896751437e2d1b5038e27b903ae8435205e36d904768941b31cb886bcb3d21b335c5d846f95f09b06c7626bc5e6a45acffba13feed6703ceac1bf3b6b0203e24b2f2b2fb80096d85689a25f21b4f5f4349fcfc1bcd08a0b01495498be87fbc45c8ec884c3bbf05d52f012042855e6c03dfd8f493a3af0fc3ccf0cee50a239ca3056655ce78fafea442f3de0de5d0693230f6248cb8a653192cace318ada182245772c85d12012c5d"}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x8a0}}]}) syz_usb_control_io$cdc_ecm(r8, &(0x7f00000009c0)={0x14, &(0x7f0000000880)={0x20, 0x31, 0xe3, {0xe3, 0x3c, "b3537bcc7006a82c69d5c1f14c3dc3b26e7c475635af3abebd4c65198575dad0ddf1ced394c4ea6f09d6415291ebe85ab2f62f4fab349d660074a30e16fd333ce7ce992a2acaca2eeae05c2ce5e3fdee869d516b8afa0467684fb87dde939f9ef1f80861c45f400fe3dc4653fcdfdd26d7bc1791376187ad0ed9e6c59969b78d44cdb0803c54aec9e607b57ca8c7f11609fbcf468015c35036d0e58ba046e2cc1ce9ac33286b0563abc3d42f2b2878e2eaebc1803ee256ea9d1b5d32b35225f8a6f654787a8764de226ef04a82dd278c4f0151c0bceff89176037a5ff6b18eb0ef"}}, &(0x7f0000000980)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000b40)={0x1c, &(0x7f0000000a80)={0x40, 0x10, 0x4f, "075b1c9b239a46c78054607d89af7710a7b1c1b5455b2c8ab4e087c832fb4647da27e1642bbac002a2abc246a94aabb5db3691fe65d9b01cf7bd58d8c246483ebbc7734e5e4a987d40acb1f17e2da6"}, &(0x7f0000000a00)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000b00)={0x0, 0x8, 0x1, 0x5}}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000400)=0x40) syz_clone3(&(0x7f0000001280)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 99.242209ms ago: executing program 2 (id=41): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000009800)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, &(0x7f0000003640)=[{&(0x7f00000007c0)=""/4104, 0x1008}, {&(0x7f0000003180)=""/171, 0xab}, {&(0x7f0000003240)=""/106, 0x6a}, {&(0x7f0000000780)=""/18, 0x12}, {&(0x7f00000032c0)=""/246, 0xf6}, {&(0x7f00000001c0)=""/231, 0xe7}], 0x6}, 0x81}, {{0x0, 0x0, 0x0}, 0x8}], 0x4, 0x2100, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='comm\x00') exit(0x1ff) write$UHID_INPUT(r4, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000700)={0xbc, 0x0, &(0x7f0000000580)=[@reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000100)={@flat, @flat=@binder={0x73622a85, 0xb, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000040)=""/128, 0x80, 0x0, 0x37}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}}, @acquire={0x40046305, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x70, 0x18, &(0x7f00000001c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/138, 0x8a, 0x0, 0x3d}, @ptr={0x70742a85, 0x0, &(0x7f0000000440)=""/148, 0x94, 0x1, 0x11}, @fda={0x66646185, 0x8, 0x0, 0x9}}, &(0x7f0000000540)={0x0, 0x28, 0x50}}}, @decrefs={0x40046307, 0x1}, @acquire_done={0x40106309, 0x3}, @decrefs={0x40046307, 0x3}], 0x9f, 0x0, &(0x7f0000000640)="2c458a18a7a6486161465c52d0a00974fe4ab820e81ef0c7861f9b1f057adf58bc67609be4a226410963b23dc36d1a7808f50c7f2f0a4e7ba42137990526e0fcf61472264e04cc63b86b2c5ae272a3f06945b11b8ed27a934041bb6a9f50855ae5467a1c2473ca91c1e77ebebc4a273295268e7e444481ac46919693b328a418690a0d9e4d2610acf6f65084a3656b3d167edaabc96683a7db0d5552a4aed5"}) pipe(0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000240)="580000001403192360834f80040d8c560a067fbc45ff810500000000000058070b080400945f6400947e570028925a015000000000000000004bd5b7f0fffeffe809000000fff5dd0000000800030002081000ff582bf3c8c4ea772a06f88dfd6a5a69a518ce99fc9692ac1d835f75726a1438ab0557875413b60f7744ddc48070926ca9ace23a76d81064fef0a2923ec131a755682b5594c4eb0afb30155b6a0738dd43395bd62f30ad2cca3ba5179b2e372d920e18e1579312c2d1f8b28fc5234ef078b04defa46a710a6e684a627489d2f5ca4e84807c924f73a8e27ee8ea567df7c97ea1b5f4d19c6779cf20456f531341e832df1c96e5e272b93bc540cd7bb8cc7bf79be83e6e8c26520ecfc770", 0x110}], 0x1) ioctl$ASHMEM_SET_NAME(r0, 0x40087708, 0x0) 98.153419ms ago: executing program 3 (id=42): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x9, 0x80800) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x400008001, 0x0, 0x1, r2, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000900)={0x0, 0x0, 0x1, r2, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000080)={0x0, 0x0, 0x4, r2, 0x5}) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x88901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') mount$incfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) close(0xffffffffffffffff) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0406618, 0x0) move_mount(r4, &(0x7f00000001c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000280)='./file0/../file0/../file0/../file0\x00', 0x2) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000000c0)='./file0/../file0/../file0/../file0/../file0\x00') r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x1, &(0x7f0000000180)=0x20000001, 0x4) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x304, 0x36}, "1a88ef816c4b42ed", "a5fdeb69a751e94df50ad7e9fb434d1665e9298b01e49419567b443803cf578f", '\x00\t\x00', "066580001e00"}, 0x38) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x7, 0xf, 0x17f, 0x7, 0x0, 0xf1, 0xcc26, 0x9, 0x5, 0x2000000000000, 0x9, 0x200000000000, 0x100000000, 0x0, 0xbd9], 0xffff1000, 0x3c4210}) syz_open_procfs(0x0, &(0x7f0000000040)='net/raw6\x00') r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000002200"], 0x1c}], 0x1}, 0x0) 0s ago: executing program 3 (id=43): r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000480)='./binderfs/binder-control\x00', 0x2, 0x0) (async) r1 = open(&(0x7f00000001c0)='./file1\x00', 0x14927e, 0x20) fallocate(r1, 0x0, 0x0, 0x1001f0) (async) read$FUSE(r1, 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x32, 0xffffffffffffffff, 0x2ec37000) (async) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, &(0x7f0000000540)={'binder1\x00'}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.202' (ED25519) to the list of known hosts. [ 21.534459][ T36] audit: type=1400 audit(1750731946.910:64): avc: denied { mounton } for pid=281 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.535940][ T281] cgroup: Unknown subsys name 'net' [ 21.557119][ T36] audit: type=1400 audit(1750731946.910:65): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.584424][ T36] audit: type=1400 audit(1750731946.940:66): avc: denied { unmount } for pid=281 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.584660][ T281] cgroup: Unknown subsys name 'devices' [ 21.710663][ T281] cgroup: Unknown subsys name 'hugetlb' [ 21.716277][ T281] cgroup: Unknown subsys name 'rlimit' [ 21.872428][ T36] audit: type=1400 audit(1750731947.250:67): avc: denied { setattr } for pid=281 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.895658][ T36] audit: type=1400 audit(1750731947.250:68): avc: denied { mounton } for pid=281 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 21.915134][ T283] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 21.920634][ T36] audit: type=1400 audit(1750731947.250:69): avc: denied { mount } for pid=281 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.942097][ T281] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.952523][ T36] audit: type=1400 audit(1750731947.310:70): avc: denied { relabelto } for pid=283 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.986291][ T36] audit: type=1400 audit(1750731947.310:71): avc: denied { write } for pid=283 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.011926][ T36] audit: type=1400 audit(1750731947.320:72): avc: denied { read } for pid=281 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.037440][ T36] audit: type=1400 audit(1750731947.320:73): avc: denied { open } for pid=281 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.746666][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.768111][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.775234][ T288] bridge_slave_0: entered allmulticast mode [ 22.783201][ T288] bridge_slave_0: entered promiscuous mode [ 22.789852][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.796903][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.804017][ T288] bridge_slave_1: entered allmulticast mode [ 22.810395][ T288] bridge_slave_1: entered promiscuous mode [ 22.934701][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.941841][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.949129][ T293] bridge_slave_0: entered allmulticast mode [ 22.955369][ T293] bridge_slave_0: entered promiscuous mode [ 22.976138][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.983335][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.990521][ T293] bridge_slave_1: entered allmulticast mode [ 22.996778][ T293] bridge_slave_1: entered promiscuous mode [ 23.022640][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.029731][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.036864][ T294] bridge_slave_0: entered allmulticast mode [ 23.043186][ T294] bridge_slave_0: entered promiscuous mode [ 23.050471][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.057609][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.064734][ T294] bridge_slave_1: entered allmulticast mode [ 23.071269][ T294] bridge_slave_1: entered promiscuous mode [ 23.103221][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.110315][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.117601][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.124666][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.147954][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.155101][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.162472][ T292] bridge_slave_0: entered allmulticast mode [ 23.168925][ T292] bridge_slave_0: entered promiscuous mode [ 23.175462][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.182549][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.189706][ T292] bridge_slave_1: entered allmulticast mode [ 23.195964][ T292] bridge_slave_1: entered promiscuous mode [ 23.315148][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.322223][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.329528][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.336565][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.350813][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.357913][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.365236][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.372283][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.393317][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.400399][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.407788][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.414846][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.424422][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.431765][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.440090][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.447302][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.455043][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.462337][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.469622][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.476832][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.497972][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.505052][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.513326][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.520386][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.555229][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.562308][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.569968][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.577002][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.584692][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.591754][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.622342][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.629410][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.648021][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.655116][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.666567][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.673653][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.683162][ T294] veth0_vlan: entered promiscuous mode [ 23.695608][ T288] veth0_vlan: entered promiscuous mode [ 23.718870][ T294] veth1_macvtap: entered promiscuous mode [ 23.729923][ T293] veth0_vlan: entered promiscuous mode [ 23.761228][ T293] veth1_macvtap: entered promiscuous mode [ 23.771345][ T288] veth1_macvtap: entered promiscuous mode [ 23.789014][ T292] veth0_vlan: entered promiscuous mode [ 23.815543][ T294] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.842678][ T292] veth1_macvtap: entered promiscuous mode [ 23.880892][ T310] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.004876][ T325] FAT-fs (rnullb0): bogus number of reserved sectors [ 24.012463][ T325] FAT-fs (rnullb0): Can't find a valid FAT filesystem [ 24.045527][ T327] fuse: Unknown parameter 'ÿÿ0x0000000000000004' [ 24.076332][ T329] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 24.090930][ T329] x_tables: duplicate underflow at hook 2 [ 24.099308][ T329] syz.0.9 uses obsolete (PF_INET,SOCK_PACKET) [ 24.112105][ T334] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:5 [ 24.112947][ T9] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 24.146575][ T9] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 24.232015][ T352] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 24.245260][ T354] SELinux: failed to load policy [ 24.435039][ T364] erofs: (device rnullb0): erofs_read_superblock: cannot find valid erofs superblock [ 24.498029][ T369] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 24.501498][ T372] rust_binder: Failed to claim space for a BINDER_TYPE_PTR. (offset: 128, limit: 144, size: 266) [ 24.511900][ T372] rust_binder: Error while translating object. [ 24.524197][ T372] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 24.531965][ T372] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:10 [ 24.542978][ T376] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 24.569101][ T381] ======================================================= [ 24.569101][ T381] WARNING: The mand mount option has been deprecated and [ 24.569101][ T381] and is ignored by this kernel. Remove the mand [ 24.569101][ T381] option from the mount to silence this warning. [ 24.569101][ T381] ======================================================= [ 24.610718][ T381] SELinux: security_context_str_to_sid (sytem_uÝGй) failed with errno=-22 [ 24.644323][ T387] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 24.644346][ T387] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:16 [ 24.673954][ T390] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:18 [ 24.878253][ T338] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 25.039226][ T338] usb 4-1: config 1 interface 0 has no altsetting 0 [ 25.047428][ T338] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 25.056641][ T338] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.064847][ T338] usb 4-1: Product: syz [ 25.069288][ T338] usb 4-1: Manufacturer: syz [ 25.073899][ T338] usb 4-1: SerialNumber: syz [ 25.287202][ T385] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.309158][ T385] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.351990][ T397] binder: Unknown parameter '0x0000000000000004' [ 25.541614][ T405] netlink: 12 bytes leftover after parsing attributes in process `syz.3.30'. [ 25.554727][ T405] rust_binder: Failed to allocate buffer. len:4294966472, is_oneway:false [ 25.554766][ T405] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 25.564370][ T405] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:26 [ 25.644164][ T416] exFAT-fs (rnullb0): invalid boot record signature [ 25.652180][ T418] tmpfs: Unknown parameter 'subj_type' [ 25.654013][ T416] exFAT-fs (rnullb0): failed to read boot sector [ 25.673473][ T416] exFAT-fs (rnullb0): failed to recognize exfat type [ 25.682315][ T416] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 25.792037][ T426] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 25.792417][ T426] rust_binder: Error in use_page_slow: ESRCH [ 25.808186][ T422] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=422 comm=syz.1.38 [ 25.826554][ T426] rust_binder: use_range failure ESRCH [ 25.826583][ T426] rust_binder: Failed to allocate buffer. len:168, is_oneway:false [ 25.838863][ T426] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 25.856740][ T426] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:47 [ 25.983059][ T434] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.030226][ T434] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.065251][ T434] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 26.088117][ T61] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 26.100469][ T434] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 26.259394][ T61] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 26.273187][ T61] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 26.302020][ T61] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 26.312233][ T61] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 26.325613][ T61] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 26.325763][ T338] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 26.334948][ T61] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.355260][ T61] usb 2-1: config 0 descriptor?? [ 26.389552][ T338] usb 4-1: USB disconnect, device number 2 [ 26.396698][ T338] usblp0: removed [ 26.700184][ T36] kauditd_printk_skb: 105 callbacks suppressed [ 26.700202][ T36] audit: type=1400 audit(1750731952.080:179): avc: denied { mounton } for pid=438 comm="syz.3.42" path="/file0" dev="incremental-fs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 26.731782][ T440] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=788 sclass=netlink_tcpdiag_socket pid=440 comm=syz.2.41 [ 26.764581][ T61] plantronics 0003:047F:FFFF.0002: ignoring exceeding usage max [ 26.772573][ T36] audit: type=1400 audit(1750731952.140:180): avc: denied { write } for pid=292 comm="syz-executor" name="/" dev="incremental-fs" ino=79 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 26.796148][ T36] audit: type=1400 audit(1750731952.140:181): avc: denied { remove_name } for pid=292 comm="syz-executor" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 26.799005][ T61] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 26.821872][ T36] audit: type=1400 audit(1750731952.140:182): avc: denied { unlink } for pid=292 comm="syz-executor" name=".pending_reads" dev="incremental-fs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 26.830014][ T61] plantronics 0003:047F:FFFF.0002: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 26.919423][ T292] ------------[ cut here ]------------ [ 26.925059][ T292] WARNING: CPU: 0 PID: 292 at fs/inode.c:340 drop_nlink+0xce/0x110 [ 26.933043][ T292] Modules linked in: [ 26.936984][ T292] CPU: 0 UID: 0 PID: 292 Comm: syz-executor Not tainted 6.12.30-syzkaller-g1d4f4d446dbd #0 c93aecf919cd453af8c9b0d1ce6d9747cbb4dbdf [ 26.950601][ T292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 26.960713][ T292] RIP: 0010:drop_nlink+0xce/0x110 [ 26.965787][ T292] Code: 04 00 00 be 08 00 00 00 e8 cf 55 ee ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 a2 5f 98 ff <0f> 0b eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 59 ff ff ff 4c [ 26.985436][ T292] RSP: 0018:ffffc9000b667a80 EFLAGS: 00010293 [ 26.991574][ T292] RAX: ffffffff81ed3d2e RBX: ffff888113c307e0 RCX: ffff888102b92600 [ 26.999593][ T292] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.007592][ T292] RBP: ffffc9000b667aa8 R08: 0000000000000003 R09: 0000000000000004 [ 27.015651][ T292] R10: dffffc0000000000 R11: fffff520016ccf40 R12: dffffc0000000000 [ 27.023878][ T292] R13: 1ffff11022786105 R14: ffff888113c30828 R15: 0000000000000000 [ 27.031915][ T292] FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 27.040906][ T292] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.047508][ T292] CR2: 000055ae21cf9d00 CR3: 000000010d30c000 CR4: 00000000003526b0 [ 27.055543][ T292] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.063565][ T292] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.071595][ T292] Call Trace: [ 27.074904][ T292] [ 27.077876][ T292] shmem_rmdir+0x5f/0x90 [ 27.082178][ T292] vfs_rmdir+0x3e0/0x560 [ 27.086443][ T292] incfs_kill_sb+0x109/0x230 [ 27.091165][ T292] deactivate_locked_super+0xd5/0x2a0 [ 27.096566][ T292] deactivate_super+0xb8/0xe0 [ 27.101610][ T292] cleanup_mnt+0x3f1/0x480 [ 27.106064][ T292] __cleanup_mnt+0x1d/0x40 [ 27.110527][ T292] task_work_run+0x1e0/0x250 [ 27.115174][ T292] ? __cfi_task_work_run+0x10/0x10 [ 27.120342][ T292] ? free_nsproxy+0x223/0x290 [ 27.125045][ T292] do_exit+0x9b4/0x2630 [ 27.129253][ T292] ? __cfi_do_exit+0x10/0x10 [ 27.133863][ T292] ? __kasan_check_write+0x18/0x20 [ 27.139017][ T292] ? _raw_spin_lock_irq+0x8d/0x120 [ 27.144158][ T292] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 27.149753][ T292] ? __cfi_ksys_write+0x10/0x10 [ 27.154626][ T292] ? zap_other_threads+0x334/0x370 [ 27.159770][ T292] do_group_exit+0x22a/0x300 [ 27.164392][ T292] __x64_sys_exit_group+0x43/0x50 [ 27.169464][ T292] x64_sys_call+0x2ed2/0x2ee0 [ 27.174166][ T292] do_syscall_64+0x58/0xf0 [ 27.178753][ T292] ? clear_bhb_loop+0x50/0xa0 [ 27.183460][ T292] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.189406][ T292] RIP: 0033:0x7fdd87f8e929 [ 27.193857][ T292] Code: Unable to access opcode bytes at 0x7fdd87f8e8ff. [ 27.200911][ T292] RSP: 002b:00007ffd22ad6348 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 27.209379][ T292] RAX: ffffffffffffffda RBX: 00007fdd88010985 RCX: 00007fdd87f8e929 [ 27.217368][ T292] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 27.225369][ T292] RBP: 0000000000000009 R08: 00007ffd22ad40e7 R09: 00007ffd22ad7600 [ 27.233407][ T292] R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffd22ad7600 [ 27.241421][ T292] R13: 00007fdd88010925 R14: 00005555886f74a8 R15: 00007ffd22ad86d0 [ 27.249442][ T292] [ 27.252477][ T292] ---[ end trace 0000000000000000 ]--- [ 27.258106][ T292] ================================================================== [ 27.266207][ T292] BUG: KASAN: null-ptr-deref in ihold+0x24/0x70 [ 27.272459][ T292] Write of size 4 at addr 0000000000000168 by task syz-executor/292 [ 27.280443][ T292] [ 27.282769][ T292] CPU: 1 UID: 0 PID: 292 Comm: syz-executor Tainted: G W 6.12.30-syzkaller-g1d4f4d446dbd #0 c93aecf919cd453af8c9b0d1ce6d9747cbb4dbdf [ 27.282795][ T292] Tainted: [W]=WARN [ 27.282800][ T292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 27.282810][ T292] Call Trace: [ 27.282816][ T292] [ 27.282822][ T292] __dump_stack+0x21/0x30 [ 27.282845][ T292] dump_stack_lvl+0x10c/0x190 [ 27.282863][ T292] ? __cfi_dump_stack_lvl+0x10/0x10 [ 27.282883][ T292] print_report+0x3d/0x70 [ 27.282897][ T292] kasan_report+0x163/0x1a0 [ 27.282921][ T292] ? ihold+0x24/0x70 [ 27.282943][ T292] ? _raw_spin_unlock+0x45/0x60 [ 27.282967][ T292] ? ihold+0x24/0x70 [ 27.282988][ T292] kasan_check_range+0x299/0x2a0 [ 27.283013][ T292] __kasan_check_write+0x18/0x20 [ 27.283031][ T292] ihold+0x24/0x70 [ 27.283053][ T292] vfs_rmdir+0x26a/0x560 [ 27.283069][ T292] incfs_kill_sb+0x109/0x230 [ 27.283088][ T292] deactivate_locked_super+0xd5/0x2a0 [ 27.283105][ T292] deactivate_super+0xb8/0xe0 [ 27.283120][ T292] cleanup_mnt+0x3f1/0x480 [ 27.283143][ T292] __cleanup_mnt+0x1d/0x40 [ 27.283165][ T292] task_work_run+0x1e0/0x250 [ 27.283181][ T292] ? __cfi_task_work_run+0x10/0x10 [ 27.283209][ T292] ? free_nsproxy+0x223/0x290 [ 27.283227][ T292] do_exit+0x9b4/0x2630 [ 27.283244][ T292] ? __cfi_do_exit+0x10/0x10 [ 27.283259][ T292] ? __kasan_check_write+0x18/0x20 [ 27.283276][ T292] ? _raw_spin_lock_irq+0x8d/0x120 [ 27.283297][ T292] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 27.283324][ T292] ? __cfi_ksys_write+0x10/0x10 [ 27.283342][ T292] ? zap_other_threads+0x334/0x370 [ 27.283356][ T292] do_group_exit+0x22a/0x300 [ 27.283372][ T292] __x64_sys_exit_group+0x43/0x50 [ 27.283388][ T292] x64_sys_call+0x2ed2/0x2ee0 [ 27.283408][ T292] do_syscall_64+0x58/0xf0 [ 27.283429][ T292] ? clear_bhb_loop+0x50/0xa0 [ 27.283445][ T292] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.283460][ T292] RIP: 0033:0x7fdd87f8e929 [ 27.283473][ T292] Code: Unable to access opcode bytes at 0x7fdd87f8e8ff. [ 27.283480][ T292] RSP: 002b:00007ffd22ad6348 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 27.283496][ T292] RAX: ffffffffffffffda RBX: 00007fdd88010985 RCX: 00007fdd87f8e929 [ 27.283508][ T292] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 27.283517][ T292] RBP: 0000000000000009 R08: 00007ffd22ad40e7 R09: 00007ffd22ad7600 [ 27.283527][ T292] R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffd22ad7600 [ 27.283537][ T292] R13: 00007fdd88010925 R14: 00005555886f74a8 R15: 00007ffd22ad86d0 [ 27.283550][ T292] [ 27.283556][ T292] ================================================================== [ 27.546615][ T305] bridge_slave_1: left allmulticast mode [ 27.549118][ T292] Disabling lock debugging due to kernel taint [ 27.558697][ T292] BUG: kernel NULL pointer dereference, address: 0000000000000168 [ 27.558699][ T305] bridge_slave_1: left promiscuous mode [ 27.558715][ T292] #PF: supervisor write access in kernel mode [ 27.558727][ T292] #PF: error_code(0x0002) - not-present page [ 27.578482][ T36] audit: type=1400 audit(1750731952.940:183): avc: denied { read } for pid=91 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 27.584108][ T292] PGD 800000010df4f067 P4D 800000010df4f067 PUD 0 [ 27.606212][ T305] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.612325][ T292] Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI [ 27.612351][ T292] CPU: 1 UID: 0 PID: 292 Comm: syz-executor Tainted: G B W 6.12.30-syzkaller-g1d4f4d446dbd #0 c93aecf919cd453af8c9b0d1ce6d9747cbb4dbdf [ 27.620434][ T36] audit: type=1400 audit(1750731952.940:184): avc: denied { search } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.625451][ T292] Tainted: [B]=BAD_PAGE, [W]=WARN [ 27.625461][ T292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 27.625475][ T292] RIP: 0010:ihold+0x2a/0x70 [ 27.641257][ T36] audit: type=1400 audit(1750731952.940:185): avc: denied { write } for pid=91 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.661814][ T292] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 8d 56 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 8c 4c ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 9d [ 27.661837][ T292] RSP: 0018:ffffc9000b667ac0 EFLAGS: 00010246 [ 27.661858][ T292] RAX: ffff888102b92600 RBX: 0000000000000000 RCX: ffff888102b92600 [ 27.667281][ T36] audit: type=1400 audit(1750731952.940:186): avc: denied { add_name } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.676936][ T292] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.676952][ T292] RBP: ffffc9000b667ad0 R08: ffffffff88957947 R09: 1ffffffff112af28 [ 27.676968][ T292] R10: dffffc0000000000 R11: fffffbfff112af29 R12: ffff888113c307ec [ 27.676985][ T292] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 27.681937][ T36] audit: type=1400 audit(1750731952.940:187): avc: denied { create } for pid=91 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.702651][ T292] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 27.702672][ T292] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 27.702688][ T292] CR2: 0000000000000168 CR3: 00000001222d6000 CR4: 00000000003526b0 [ 27.832623][ T292] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 27.840602][ T292] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 27.848665][ T292] Call Trace: [ 27.851963][ T292] [ 27.854908][ T292] vfs_rmdir+0x26a/0x560 [ 27.859170][ T292] incfs_kill_sb+0x109/0x230 [ 27.863917][ T292] deactivate_locked_super+0xd5/0x2a0 [ 27.869314][ T292] deactivate_super+0xb8/0xe0 [ 27.874017][ T292] cleanup_mnt+0x3f1/0x480 [ 27.878466][ T292] __cleanup_mnt+0x1d/0x40 [ 27.882901][ T292] task_work_run+0x1e0/0x250 [ 27.887517][ T292] ? __cfi_task_work_run+0x10/0x10 [ 27.892650][ T292] ? free_nsproxy+0x223/0x290 [ 27.897349][ T292] do_exit+0x9b4/0x2630 [ 27.901514][ T292] ? __cfi_do_exit+0x10/0x10 [ 27.906111][ T292] ? __kasan_check_write+0x18/0x20 [ 27.911241][ T292] ? _raw_spin_lock_irq+0x8d/0x120 [ 27.916380][ T292] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 27.921949][ T292] ? __cfi_ksys_write+0x10/0x10 [ 27.926823][ T292] ? zap_other_threads+0x334/0x370 [ 27.931944][ T292] do_group_exit+0x22a/0x300 [ 27.936635][ T292] __x64_sys_exit_group+0x43/0x50 [ 27.941673][ T292] x64_sys_call+0x2ed2/0x2ee0 [ 27.946362][ T292] do_syscall_64+0x58/0xf0 [ 27.950800][ T292] ? clear_bhb_loop+0x50/0xa0 [ 27.955487][ T292] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 27.961382][ T292] RIP: 0033:0x7fdd87f8e929 [ 27.965802][ T292] Code: Unable to access opcode bytes at 0x7fdd87f8e8ff. [ 27.972816][ T292] RSP: 002b:00007ffd22ad6348 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 27.981234][ T292] RAX: ffffffffffffffda RBX: 00007fdd88010985 RCX: 00007fdd87f8e929 [ 27.989233][ T292] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 [ 27.997214][ T292] RBP: 0000000000000009 R08: 00007ffd22ad40e7 R09: 00007ffd22ad7600 [ 28.005202][ T292] R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffd22ad7600 [ 28.013181][ T292] R13: 00007fdd88010925 R14: 00005555886f74a8 R15: 00007ffd22ad86d0 [ 28.021167][ T292] [ 28.024196][ T292] Modules linked in: [ 28.028107][ T292] CR2: 0000000000000168 [ 28.032264][ T292] ---[ end trace 0000000000000000 ]--- [ 28.037730][ T292] RIP: 0010:ihold+0x2a/0x70 [ 28.042253][ T292] Code: f3 0f 1e fa 55 48 89 e5 41 56 53 48 89 fb e8 8d 56 98 ff 48 8d bb 68 01 00 00 be 04 00 00 00 e8 8c 4c ee ff 41 be 01 00 00 00 44 0f c1 b3 68 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 9d [ 28.061866][ T292] RSP: 0018:ffffc9000b667ac0 EFLAGS: 00010246 [ 28.067952][ T292] RAX: ffff888102b92600 RBX: 0000000000000000 RCX: ffff888102b92600 [ 28.075935][ T292] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.084004][ T292] RBP: ffffc9000b667ad0 R08: ffffffff88957947 R09: 1ffffffff112af28 [ 28.092071][ T292] R10: dffffc0000000000 R11: fffffbfff112af29 R12: ffff888113c307ec [ 28.100050][ T292] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 [ 28.108026][ T292] FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 28.116958][ T292] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.123548][ T292] CR2: 0000000000000168 CR3: 00000001222d6000 CR4: 00000000003526b0 [ 28.131528][ T292] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.139501][ T292] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.147475][ T292] Kernel panic - not syncing: Fatal exception [ 28.153818][ T292] Kernel Offset: disabled [ 28.158158][ T292] Rebooting in 86400 seconds..