last executing test programs: 2.166094168s ago: executing program 0 (id=384): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="580000000002010300000000000000000a00000004000180040003803c000280"], 0x58}, 0x1, 0x0, 0x0, 0x20008004}, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x1c1842, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r3, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r3, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x42, 0x4}}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000300)={0x42, 0x3}, 0x10) bind$tipc(r4, &(0x7f00000001c0)=@id={0x1e, 0x3, 0x1, {0x4e24}}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r6, &(0x7f0000000380)={&(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x4}}}, 0x10, 0x0}, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'macvtap0\x00', 0x7101}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r9 = dup3(r2, r7, 0x80000) r10 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)='blkio.throttle.io_service_bytes_recursive\x00', 0x0, 0x0) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)=ANY=[@ANYRES32=r9, @ANYRES64=r1, @ANYRESOCT=r8], 0x11c}, 0x1, 0x0, 0x0, 0x4010}, 0x2) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000002400070dfeffffff0000000001"], 0x3c}, 0x1, 0x0, 0x0, 0x4048011}, 0x4044000) syz_kvm_setup_cpu$x86(r9, r10, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, &(0x7f0000000280)="b8010000000f01c18f89c092f2400fc7997b1208da66460f12941501180000440f01cff226b20066baa100ec660f3a0b0bae40ffcf48b8e6750000000000000f23c80f21f8350400e0000f23f8", 0x4d}], 0x1, 0x0, &(0x7f0000000340)=[@cr0={0x0, 0x40000}, @dstype0], 0x2) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) prctl$PR_SET_VMA(0x41555856, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0) close(r8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000000)={'syzkaller0\x00'}) write$cgroup_devices(r7, &(0x7f0000000200)=ANY=[@ANYRESHEX=r12], 0xffdd) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(0xffffffffffffffff, 0xf505, 0x0) 2.017085001s ago: executing program 0 (id=385): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='fd\x00') exit(0x7) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000021a01", @ANYBLOB, @ANYRESOCT, @ANYRES16=r1], 0x1c}, 0x1, 0x0, 0x0, 0x20040840}, 0x0) fstat(r3, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) recvmsg(r5, 0x0, 0x40012140) getpeername$packet(r5, 0x0, &(0x7f0000007480)) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r2) epoll_create(0x3) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) rt_sigsuspend(0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="7c000000000101040000000000000000020000002400018014000180080001000000000000000000008014000c0002800500010000000000240002800c00028005000100000000001400018008000100e0000002080002000a01010008000740000000001800068000000380060002004e23000008000100e0000001996b72ca616ae04148a01488866c0bf1b41c4273cf56cba86fc516a22736fa85612b5f40b1608760d7e378a3f4de566b275089569af825e24820caf0ca1e8df406e665ef5235c248306a9d8670bffa4838849f2137750d58"], 0x7c}}, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) mkdirat(r3, &(0x7f00000000c0)='./file0/file0\x00', 0x4) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='fd\x00') exit(0x7) fstat(r7, 0x0) mount$incfs(&(0x7f0000000580)='./file0\x00', &(0x7f0000000380)='./file0\x00', &(0x7f00000005c0), 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8c) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)) openat$incfs(r8, &(0x7f0000000000)='.pending_reads\x00', 0x200, 0x80) r9 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r10 = fcntl$dupfd(r9, 0x0, r9) ioctl$USBDEVFS_SUBMITURB(r10, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x0, 0xb, 0x0, 0x0, 0x7995}, 0xfcb5, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) close_range(r0, 0xffffffffffffffff, 0x0) 1.58057173s ago: executing program 3 (id=398): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000540)={0x73622a85, 0x7cab6ced6415609}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) r1 = mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) socket$key(0xf, 0x3, 0x2) (async) socket$key(0xf, 0x3, 0x2) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) creat(&(0x7f0000000200)='./file0\x00', 0x1c4) (async) r2 = creat(&(0x7f0000000200)='./file0\x00', 0x1c4) io_setup(0x7f, &(0x7f0000000100)=0x0) r4 = eventfd(0x8e) r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='fd\x00') getdents64(r5, &(0x7f0000000480)=""/27, 0x1b) (async) getdents64(r5, &(0x7f0000000480)=""/27, 0x1b) getdents64(r5, 0xfffffffffffffffe, 0x64) r6 = gettid() r7 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffffb]}, 0x8, 0x0) prctl$PR_SCHED_CORE(0x23, 0x0, 0xffffffffffffffff, 0x0, 0x0) readv(r7, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/247, 0xf7}], 0x1) (async) readv(r7, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/247, 0xf7}], 0x1) rt_sigqueueinfo(r6, 0x21, &(0x7f0000000180)={0x30, 0x40000020, 0xfffffffb}) io_submit(r3, 0x1, &(0x7f0000000380)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r4}]) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000300)={@fda={0x66646185, 0x0, 0x0, 0x1f}, @flat=@binder={0x73622a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x100a, 0x1003}}, &(0x7f0000000000)={0x0, 0x20, 0x38}}}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000300)={@fda={0x66646185, 0x0, 0x0, 0x1f}, @flat=@binder={0x73622a85, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x100a, 0x1003}}, &(0x7f0000000000)={0x0, 0x20, 0x38}}}], 0x0, 0x0, 0x0}) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000180), 0x8000) r9 = socket$igmp(0x2, 0x3, 0x2) getsockopt$inet_IP_XFRM_POLICY(r9, 0x0, 0x11, &(0x7f0000000600)={{{@in=@local, @in6=@initdev}}, {{@in=@multicast1}, 0x0, @in6=@private0}}, &(0x7f0000000280)=0xe8) (async) getsockopt$inet_IP_XFRM_POLICY(r9, 0x0, 0x11, &(0x7f0000000600)={{{@in=@local, @in6=@initdev}}, {{@in=@multicast1}, 0x0, @in6=@private0}}, &(0x7f0000000280)=0xe8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) 1.451139742s ago: executing program 3 (id=399): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000000000)={0x1f, @none}, 0x8) bind$bt_sco(r0, &(0x7f0000000040)={0x1f, @none}, 0x8) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r3, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x37}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xc5}, 0x800) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x7c, r3, 0x10, 0x70bd27, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x59}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xf5f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x401}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfff}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xd}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x40}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xd}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xe}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x4) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r2, 0x8983, &(0x7f0000000380)) socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f00000003c0)=0xde, &(0x7f0000000400)=0x2) getsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000440)=0x3, &(0x7f0000000480)=0x2) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f0000000580)={0x14, &(0x7f00000004c0)={0x20, 0x3, 0x4c, {0x4c, 0x31, "e5426661063fa4d36439a934f74b0b3f5ddc56c26434a34a018b4a1753f24a3d55817727d989a3b370d9eca31f0f3f12cd4467d3752ed1b1c87f5b430b3fe6b524a9d1299ce330c07fd4"}}, &(0x7f0000000540)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000840)={0x44, &(0x7f00000005c0)={0x40, 0x15, 0xa8, "34324a585d04b5c1b296e025baad65bd86a56c575e1de22354289b1e88810022ad51e95abeeeebb914f99746f7273bf33c02bcae83c0783517f4bc000e79e57a85467ac4a6b116bfe5936b11dc14a5c1a86237dc514e599504ad345c4feaf8069230a59bdd2c9001585e75f6e2d1bee4c30b7b38f8a57368fca775109304df6b8ff3e271d8b08977d7671747db15c7bcadbff14b5047020d7eaf12589b07e9ff7aa3fc215d7165d9"}, &(0x7f0000000680)={0x0, 0xa, 0x1, 0x33}, &(0x7f00000006c0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000700)={0x20, 0x80, 0x1c, {0x4, 0x2, 0x5, 0x4, 0x1b7, 0x2, 0x0, 0x3, 0x0, 0x9, 0x400, 0x6}}, &(0x7f0000000740)={0x20, 0x85, 0x4, 0x101}, &(0x7f0000000780)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000007c0)={0x20, 0x87, 0x2, 0x4}, &(0x7f0000000800)={0x20, 0x89, 0x2}}) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x28) ioctl$KVM_CAP_SPLIT_IRQCHIP(r4, 0x4068aea3, &(0x7f00000008c0)={0x79, 0x0, 0xdd9}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000980), r2) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r2, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)={0x60, r5, 0x800, 0x70bd26, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x7, 0x2e}}}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0x2}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xfff}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x1}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x69}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x7}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x3d}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x1}]]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r2, &(0x7f0000000bc0)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000b80)={&(0x7f0000000b00)={0x4c, r5, 0x100, 0x70bd29, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x1e}, @NL80211_ATTR_SSID={0x19, 0x34, @random="af81210895d09adf9492bdca33611d3711b566e6e3"}, @NL80211_ATTR_PMKID={0x14, 0x55, "bc0dfe58ffe129daa1fdb44844730728"}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4004801}, 0x40) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) r7 = geteuid() sendmsg$nl_xfrm(r6, &(0x7f0000000fc0)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000f80)={&(0x7f0000000c40)=@newae={0x334, 0x1e, 0x4, 0x70bd2c, 0x25dfdbfc, {{@in=@local, 0x4d3, 0xa, 0xff}, @in6=@local}, [@algo_auth={0xa0, 0x1, {{'wp384\x00'}, 0x2c0, "fa38b4fe636903564baed07e6894f40638b680bb94e3ead50f19458988ff972251aa69f6d56099b66f61e72f54d52e82f1734ee37294504cabac00094869613b991bd5a54c8679a8c7753af97a2e4c9fce4a9abd2fe366c5"}}, @tmpl={0x104, 0x5, [{{@in=@remote, 0x4d6, 0xe}, 0xa, @in6=@local, 0x3507, 0x4, 0x3, 0x9, 0x8f9, 0x8, 0x9}, {{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x4d4, 0x2b}, 0x0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3502, 0x2, 0x2, 0x9, 0xffff, 0x5, 0x9}, {{@in=@private=0xa010101, 0x4d3, 0x6c}, 0xa, @in6=@dev={0xfe, 0x80, '\x00', 0x2b}, 0x0, 0x2, 0x1, 0x8, 0x4, 0x4, 0x6}, {{@in=@multicast1, 0x4d5, 0x6c}, 0x2, @in6=@private0, 0x3505, 0x2, 0x1, 0x7, 0x5, 0x3, 0x7}]}, @policy={0xac, 0x7, {{@in=@loopback, @in=@remote, 0x4e23, 0x8, 0x4e24, 0x0, 0xa, 0xc0, 0x0, 0x62, 0x0, r7}, {0xffffffffffffffff, 0xce1, 0xa, 0xa30, 0x9, 0xa000, 0x4, 0x9}, {0x800000000000000, 0x4, 0x3, 0x1}, 0x4, 0x0, 0x1, 0x1, 0x2}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0xfffffffc}, @address_filter={0x28, 0x1a, {@in=@empty, @in=@remote, 0x2, 0x47, 0x4}}, @algo_auth={0x62, 0x1, {{'wp384\x00'}, 0xd0, "faa30107529e37aec11e001305a16d571455ac268361557b7d2a"}}, @replay_val={0x10, 0xa, {0x70bd29, 0x70bd26, 0x6}}]}, 0x334}, 0x1, 0x0, 0x0, 0x4008020}, 0x40000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000001000)={'wlan1\x00', 0x200}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$team(&(0x7f0000001080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000010c0)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000001180)={'syztnl0\x00', &(0x7f0000001100)={'syztnl2\x00', 0x0, 0x29, 0x4, 0xf7, 0x0, 0x41, @mcast2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x10, 0x80, 0x3ff, 0x4}}) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000011c0)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000001280)={'ip6tnl0\x00', &(0x7f0000001200)={'ip6tnl0\x00', 0x0, 0x0, 0x47, 0x7, 0xfffffffd, 0x12, @empty, @private0, 0x700, 0x7, 0x8001, 0x9}}) sendmsg$TEAM_CMD_OPTIONS_SET(r8, &(0x7f0000002500)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000024c0)={&(0x7f0000001d40)={0x76c, r9, 0x2, 0x70bd2c, 0x25dfdbfd, {}, [{{0x8, 0x1, r10}, {0x18c, 0x2, 0x0, 0x1, [{0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0xfff, 0x8, 0x6, 0x8}, {0x6, 0xc, 0x3, 0x8}, {0xa, 0x6, 0xd, 0x1}, {0x10, 0x7, 0xd, 0xfffffbff}, {0x5, 0x0, 0xff, 0xbf7}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xff}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xe}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x10000}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r11}}}]}}, {{0x8, 0x1, r12}, {0x12c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r13}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x78, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8}, {0xf8, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}]}}, {{0x8}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}]}}, {{0x8}, {0x84, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}]}}, {{0x8}, {0x160, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @name={{0x24}, {0x5}, {0xb, 0x4, 'random\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0xa}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}, {{0x8}, {0xc0, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x135}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}]}}, {{0x8}, {0x4}}]}, 0x76c}, 0x1, 0x0, 0x0, 0x8043}, 0x4004) 1.369869084s ago: executing program 2 (id=404): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) r1 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$selinux_user(r1, &(0x7f0000000040)={'system_u:object_r:crond_initrc_exec_t:s0', 0x20, 'root\x00'}, 0x2e) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000080)={0x4, 0x10ffff, 0x9}) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) 1.362489694s ago: executing program 2 (id=405): r0 = socket$unix(0x1, 0x1, 0x0) (async) r1 = socket$inet6(0xa, 0x80002, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000000084000040"]) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f00000000c0)={@remote, r6}, 0x14) (async, rerun: 32) close_range(r0, 0xffffffffffffffff, 0x0) (rerun: 32) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x2c, r8, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x2c}}, 0x0) (async, rerun: 64) socket$inet6_udplite(0xa, 0x2, 0x88) (async, rerun: 64) r9 = syz_open_dev$loop(&(0x7f0000000240), 0x3e, 0x6542) (async) r10 = socket(0x10, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r10, 0x8946, &(0x7f0000000080)={'bridge_slave_0\x00', &(0x7f0000000040)=@ethtool_cmd={0x26, 0x0, 0x40004, 0x86cc, 0x81, 0xf4, 0x4, 0x4, 0xc0, 0x14, 0x2, 0xa5, 0xa, 0x6, 0x5, 0xcc, [0xf6000000, 0x1]}}) (async, rerun: 32) r11 = socket$inet_udp(0x2, 0x2, 0x0) (rerun: 32) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r11, 0x89f3, &(0x7f0000001840)={'sit0\x00', &(0x7f00000017c0)={'sit0\x00', 0x0, 0x7800, 0x786, 0x40, 0x8000, {{0x15, 0x4, 0x1, 0x4, 0x54, 0x66, 0x0, 0xa, 0x29, 0x0, @empty, @empty, {[@lsrr={0x83, 0x2b, 0xf4, [@loopback, @loopback, @broadcast, @multicast2, @multicast2, @broadcast, @local, @loopback, @multicast1, @dev={0xac, 0x14, 0x14, 0x44}]}, @generic={0x44, 0x12, "d70867214d15683392734e3527dcdbab"}]}}}}}) (async) r12 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r9, 0x4c0a, &(0x7f0000000080)={r12, 0x0, {0x0, 0x0, 0x0, 0x6, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06d29f3d9e234b30c50997d3bef409ff21e70c7f3f800b2f7b6aa54cc50aff7f00", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0x7]}}) (async) r13 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) syz_usb_control_io$hid(r13, &(0x7f0000000180)={0x24, &(0x7f0000000000)={0x0, 0x9, 0x4c, {0x4c, 0xbcfd5ea04c22d6fa, "8294d4fb1cf6423220914eb85103d343051070ccd91f6ba637ba844ad07003006b5e25f1ab839467a351e59ed5a349b1ab37c62d9a82fcc9adcb49d687e85763f53b0e5a2ca18c98fd0e"}}, 0x0, 0x0, 0x0}, 0x0) (async) ioctl$LOOP_SET_DIRECT_IO(r9, 0x4c08, 0x2) 1.177142028s ago: executing program 0 (id=406): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$selinux_attr(r0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$netlink(r1, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000002080)=[{&(0x7f0000001d80)={0x10, 0x10, 0x821, 0x70bd28, 0x25dfdbfd}, 0x10}], 0x1, 0x0, 0x0, 0x4000}, 0x40000) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt(r2, 0x0, 0xf, 0x0, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0xff, @none}, 0xe) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0xc0002160, 0x0) ioctl$BINDER_FREEZE(r4, 0x400c620e, &(0x7f0000000080)={0xffffffffffffffff, 0x1, 0x10001}) 1.176944808s ago: executing program 0 (id=407): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) unshare(0x62040200) r1 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001000000082505a8a440000102030109021b00010104a00009040000010701010009050102000200fc00"], 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000100)={@private2={0xfc, 0x2, '\x00', 0x1}, @dev={0xfe, 0x80, '\x00', 0x2e}, @mcast1, 0x1, 0x6, 0x0, 0x0, 0x3, 0x867000c0, r4}) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000800)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xb}}, @private0={0xfc, 0x0, '\x00', 0x3}, 0x1, 0x6, 0x0, 0x100, 0x6, 0x580107, r4}) syz_usb_control_io$printer(r1, 0x0, &(0x7f00000006c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x0, 0x1}}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)=0x0) timer_settime(r7, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, 0xffffffffffffffff, 0x0) pwritev(r5, &(0x7f00000008c0)=[{&(0x7f0000000180)="ff", 0x1}], 0x10000000000000e4, 0x0, 0x0) unshare(0x4050200) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, 0x0, 0xc0044) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x27) close_range(r0, 0xffffffffffffffff, 0x0) 936.745312ms ago: executing program 3 (id=410): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) creat(&(0x7f0000000bc0)='./file0\x00', 0xecf86c37d53049cc) lsetxattr$security_capability(&(0x7f0000000200)='./file0\x00', &(0x7f0000000fc0), 0x0, 0x0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x51, 0x0, &(0x7f0000000400)="c6547e22bade76f1a03b79e954ee20b943f7fe47218a02ff8ba942478a7b6946e9a6000055002cc15e854564e7d309f20d222f9220c8d9b1b0d196137252587ab1794808000000000000000e647c2e7094"}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000400) r1 = socket$nl_generic(0x10, 0x3, 0x10) openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x2, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x401, 0x20}}}}, ["", "", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x10) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40000) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40002042, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 852.798724ms ago: executing program 3 (id=412): socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, 0x0) mount$binderfs(0x0, &(0x7f0000000080)='./binderfs\x00', 0x0, 0x2010860, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYRESOCT=r0]) 852.582324ms ago: executing program 1 (id=413): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000240)="390000001300034700ab65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) mount$binderfs(0x0, &(0x7f00000000c0)='./binderfs\x00', &(0x7f0000000140), 0x1000, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0]) socket$netlink(0x10, 0x3, 0x0) (async) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000240)="390000001300034700ab65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) (async) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) (async) mount$binderfs(0x0, &(0x7f00000000c0)='./binderfs\x00', &(0x7f0000000140), 0x1000, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0]) (async) 837.005665ms ago: executing program 2 (id=414): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x4143, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000380)={@ptr={0x70742a85, 0x2, 0x0, 0xfffffffffffffffe}, @ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/228, 0xe4, 0x2, 0x34}, @fd}, &(0x7f0000000080)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 833.666685ms ago: executing program 3 (id=415): keyctl$instantiate(0xc, 0x0, 0xfffffffffffffffe, 0x2d, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x7cab6ced6415608, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_setup(0x4506, &(0x7f0000000240)={0x0, 0x500a, 0x132d8, 0x100002, 0xef}, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x80002, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x200c8004, &(0x7f0000000280)={0xa, 0xe20, 0x0, @remote}, 0x1c) sendto$inet6(r4, &(0x7f00000009c0)="c7cfcaaa22e10542fca5c0195350f15147657e0bfc59d383a47190db88690e6fedc3040ab5809ae02a54cd429cc3338c5afa0c9dce3f91950d1f567f358ac21154159130e88cbb6c43197813b2f23f3e442f80877490b393408142ebcfea6821f543e5ee9e27032e2b75d78f1b79f5a6bb6f0645e267770ef7e8f3a92148091217450ce8581e54223eeb6486205a209bf1fe854d211c03f8c3140fc3979d824082990d119473d20e94f253c9621fac339560ae46cb24b88bf2d01559bb658e343257b90f233b81bc5c398be3bbddb23a1e", 0xffd6, 0xc001, 0x0, 0xffffffffffffff0c) setsockopt$inet6_mtu(r4, 0x29, 0x17, &(0x7f0000000640)=0x3, 0x4) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x1b, &(0x7f00000000c0)={@remote, 0x0, 0x2, 0x2, 0x4}, 0x20) setsockopt$inet6_udp_int(r4, 0x88, 0x1, &(0x7f0000000080), 0x4) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x1b, &(0x7f00000000c0)={@remote, 0x0, 0x2, 0x2, 0x4}, 0x20) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x0, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5c, 0x9, 0x3, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0x1ff, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xffffffff, 0xbc, 0x0, 0x71, 0x2, 0x6, 0x3, 0x2, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x4, 0x1, 0x20000000, 0x82, 0x4, 0x7, 0x7, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x5, 0x1000, 0xfffffffc, 0x0, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0x8000, 0x9, 0x3fe, 0x401, 0xfff, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0x4, 0x1, 0x2, 0x2, 0x20009, 0x4, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0xffffffff, 0x7, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x40000100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0xa, 0x5, 0x1005, 0x0, 0x1f0, 0xfffffffd, 0x2, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfaf, 0x1000, 0xa2, 0x7, 0x53cf697b, 0xfffffff9, 0x6, 0xac8, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x0, 0x6, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0xfffffffe, 0x6, 0x5, 0x0, 0x3, 0x80ce7, 0x1ff, 0x3, 0x7, 0x5, 0x1003, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0x7, 0x4, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x4, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0x8, 0x30b1d693, 0x5a2d, 0xc, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x1000) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x25, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 819.770865ms ago: executing program 2 (id=416): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001000000000000000000e0000002000000000000000000000000ac1414aa00000000000000000000000000000000000000000a0000000000c000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400002000000000000080000000000000000000100000000000044000500ac1414aa000000000000000000000000000000003c00000000000000ffffffff0000000000000000000000000200000004"], 0xfc}}, 0x0) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000200)={0x6c, 0x2, 0x1, 0x401, 0x0, 0x0, {0x7, 0x0, 0x9}, [@CTA_SEQ_ADJ_ORIG={0x14, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x6a}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x1c}]}, @CTA_FILTER={0x2c, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x400}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x8}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x218}, @CTA_FILTER_ORIG_FLAGS={0x8}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x21}]}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x6}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}, @CTA_ID={0x8}]}, 0x6c}, 0x1, 0x0, 0x0, 0x10040041}, 0x4000000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) (async) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=@migrate={0xa0, 0x21, 0x1, 0x0, 0x0, {{@in6=@private2, @in=@rand_addr=0x64010102, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x4}, [@migrate={0x50, 0x11, [{@in=@local, @in=@broadcast, @in=@multicast2, @in6=@local, 0x3c, 0x4, 0x0, 0x2, 0xa, 0x2}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000080)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/233, 0xe9, 0x2, 0x4}, @fda={0x66646185, 0x0, 0x0, 0x24}, @fd}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000440)={0x0, 0x0, {}, {0x0, @struct, 0x0}, {0x0, @struct}}) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000840)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000c40)={0x0, 0x9, 0x821c, 0x1}) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f0000001040)={0x11, 0x1, {0x6, @usage=0x5, r4, 0x9, 0x8, 0x8, 0x39a, 0xffffffff, 0x459, @struct={0x1, 0xff}, 0x8, 0xc, [0x0, 0x9, 0xf, 0x7fff, 0x1, 0xfffffffffffffff3]}, {0x0, @usage=0x10, r5, 0xfffffffffffffffd, 0x800, 0x80000001, 0x8, 0xcc, 0x41, @usage=0x3, 0x9, 0x3, [0x9, 0x10, 0xfffffffffffffffc, 0x4, 0x81, 0xc2f]}, {0x8, @usage, r6, 0x2, 0x8, 0x4, 0x7, 0x9, 0x8, @struct={0x1, 0xc}, 0x2, 0x9, [0x3ff, 0x1, 0x515, 0x7e0, 0x8000000000000001, 0x100000001]}, {0x9, 0x2, 0x3ff}}) 772.125156ms ago: executing program 2 (id=417): r0 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) fstatfs(r0, &(0x7f0000000040)=""/61) r1 = openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000080), 0x2, 0x0) write$cgroup_freezer_state(r1, &(0x7f00000000c0)='FREEZING\x00', 0x9) getresgid(&(0x7f0000000100)=0x0, &(0x7f0000000140), &(0x7f0000000180)) setgroups(0x1, &(0x7f00000001c0)=[r2]) (async) setgroups(0x1, &(0x7f00000001c0)=[r2]) ioctl$BTRFS_IOC_GET_FEATURES(r0, 0x80189439, &(0x7f0000000200)) r3 = add_key$keyring(&(0x7f0000000240), &(0x7f0000000280)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) openat$vsock(0xffffffffffffff9c, &(0x7f0000000340), 0x20000, 0x0) (async) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000340), 0x20000, 0x0) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x2, &(0x7f0000000440)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r5}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@allow_other}], [{@func={'func', 0x3d, 'CREDS_CHECK'}}, {@appraise}, {@fowner_gt={'fowner>', 0xffffffffffffffff}}, {@flag='rw'}]}}) openat$dir(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x0, 0x8a) (async) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x0, 0x8a) mkdirat(r6, &(0x7f0000000540)='./file0\x00', 0x40) (async) mkdirat(r6, &(0x7f0000000540)='./file0\x00', 0x40) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000005c0), r4) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r4, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r7, 0x8, 0x70bd28, 0x25dfdbfb}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) (async) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r4, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x1c, r7, 0x8, 0x70bd28, 0x25dfdbfb}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) ioctl$F2FS_IOC_FLUSH_DEVICE(r6, 0x4008f50a, &(0x7f00000006c0)={0xe5, 0x6}) ioctl$TIOCSCTTY(r4, 0x540e, 0x8) (async) ioctl$TIOCSCTTY(r4, 0x540e, 0x8) add_key$keyring(&(0x7f0000000700), &(0x7f0000000740)={'syz', 0x0}, 0x0, 0x0, r3) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000007c0)={0x0, 0x0, 0x0}, &(0x7f0000000800)=0xc) sendmsg$nl_xfrm(r4, &(0x7f0000000a80)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000840)=@newsa={0x1fc, 0x10, 0x200, 0x70bd26, 0x25dfdbfd, {{@in6=@loopback, @in6=@mcast2, 0x4e20, 0x0, 0x4e22, 0x0, 0x2, 0x80, 0xa0, 0x8, 0x0, r8}, {@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4d4, 0x6c}, @in6=@dev={0xfe, 0x80, '\x00', 0x33}, {0x100000001, 0x100000001, 0x0, 0x9, 0xffffffff, 0x10001, 0x480, 0x9}, {0x7fffffff, 0x378, 0x6, 0x57c9}, {0x16e00, 0x9cc0, 0x10}, 0x70bd29, 0x3504, 0xa, 0x1, 0x7, 0x20}, [@tmpl={0x104, 0x5, [{{@in6=@loopback, 0x4d5, 0x32}, 0xa, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x2, 0x0, 0x67, 0x1ff, 0x8, 0x400}, {{@in=@remote, 0x4d2, 0x32}, 0x811cf50747951fca, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3504, 0x1, 0x1, 0x3, 0x6, 0x0, 0x3}, {{@in=@broadcast, 0x4d3, 0x2b}, 0xa, @in=@local, 0x3502, 0x0, 0x1, 0x7, 0x9, 0xffff, 0x9}, {{@in6=@local, 0x4d4, 0x6c}, 0xa, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x3503, 0x3, 0x1, 0x6, 0x8, 0x3, 0x800}]}, @etimer_thresh={0x8, 0xc, 0x7}]}, 0x1fc}, 0x1, 0x0, 0x0, 0x20000040}, 0x8890) ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x4004f50d, &(0x7f0000000ac0)) (async) ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x4004f50d, &(0x7f0000000ac0)) pipe(&(0x7f0000000b00)={0xffffffffffffffff, 0xffffffffffffffff}) mount$fuseblk(&(0x7f0000000b40), &(0x7f0000000b80)='./file0\x00', &(0x7f0000000bc0), 0x1, &(0x7f0000000c00)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r5}, 0x2c, {'group_id', 0x3d, r9}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}], [{@uid_eq={'uid', 0x3d, r5}}, {@fowner_lt={'fowner<', r5}}]}}) (async) mount$fuseblk(&(0x7f0000000b40), &(0x7f0000000b80)='./file0\x00', &(0x7f0000000bc0), 0x1, &(0x7f0000000c00)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r5}, 0x2c, {'group_id', 0x3d, r9}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}], [{@uid_eq={'uid', 0x3d, r5}}, {@fowner_lt={'fowner<', r5}}]}}) sendmsg$AUDIT_DEL_RULE(r11, &(0x7f00000011c0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001180)={&(0x7f0000000d40)={0x440, 0x3f4, 0x10, 0xfffff800, 0x25dfdbfb, {0x2, 0x0, 0x29, [0x6, 0x7, 0x5, 0x7fffffff, 0x3, 0x7, 0x8, 0x4, 0x1200000, 0x6, 0x0, 0x80000000, 0xa, 0x10000, 0x7, 0xc, 0x3, 0x0, 0x80, 0x4, 0xa, 0x8, 0x6, 0x7, 0x4, 0x9, 0x80000001, 0x402, 0x7, 0xf6, 0xfffffffe, 0x7, 0xfffffffe, 0x9, 0x2, 0x101, 0xf, 0xfffffff8, 0x1, 0x80000000, 0x2, 0x1, 0x1c1, 0x3, 0x76, 0x9, 0x81, 0x1000, 0x1ff, 0xb, 0x6, 0x7fffffff, 0x3, 0x3, 0x7, 0x40, 0x9, 0x4, 0x39, 0x4, 0x1000, 0x2, 0x7, 0x2], [0x7635, 0x6, 0x5, 0x6, 0x3, 0x7f, 0x9, 0x9, 0x5, 0xd0d3, 0x9041, 0x7fff, 0x9, 0x3, 0x3, 0xb, 0x8, 0xffff0000, 0xd20, 0xd9c8, 0x10001, 0x0, 0x31a, 0x3, 0xa, 0x2, 0x1, 0x5, 0x7f, 0x77d9, 0x2, 0x92e4, 0x7, 0x1, 0x4, 0x5, 0x1, 0x1, 0x1, 0x9, 0x9, 0x2, 0xc, 0xa562, 0x59, 0x4, 0x8f, 0x9, 0x1, 0xc8, 0x8, 0x864, 0x80, 0xa3, 0x7, 0x3ff, 0x0, 0x8, 0x5, 0x6, 0xffffffff, 0x5f, 0x0, 0x9], [0x7fffffff, 0x3, 0x6, 0x9, 0x2, 0x0, 0xe64, 0x129, 0x4, 0x7, 0x2, 0x8, 0xb1, 0x4, 0x9, 0xffffffff, 0x4b03, 0x3, 0x5, 0x1, 0x0, 0x1, 0x7, 0x5, 0x8, 0x5, 0x3ff, 0x6, 0xffff6178, 0xfffff21f, 0x9, 0xfffffff9, 0x5, 0x7, 0x6, 0x0, 0x6, 0x1, 0x2, 0x3, 0xef4f, 0x10001, 0xcccb, 0x780, 0x6, 0x1, 0xd6, 0xf, 0x3, 0xffff, 0x80000000, 0x8, 0xff, 0x6, 0x1, 0x6677, 0x9, 0xee0, 0xeb, 0x1, 0x5a7, 0x6, 0x3, 0xe99], [0x57f, 0x1000, 0xa9, 0x1, 0x5, 0x0, 0x80000000, 0x3c3, 0x9, 0x5, 0x9, 0xb0d1, 0xffffffff, 0x0, 0x6, 0x401, 0xa, 0x1, 0x3, 0x5, 0x9c7c34, 0x7, 0x8, 0x9, 0x0, 0x5, 0x8, 0xfffffffa, 0x101, 0x5, 0x15, 0x3, 0x3, 0x45, 0x80, 0x9c8e, 0x100, 0x0, 0xfe23, 0x92b, 0x5, 0x1, 0x3, 0x1c000, 0x33215e07, 0x80, 0x6, 0x2, 0x2, 0x0, 0x101, 0x5, 0x6, 0x9, 0x0, 0x9, 0x6, 0xcc23, 0x0, 0x1, 0x85, 0xfffffff7, 0x8e, 0x5], 0x1d, ['-\x11],))#\x00', '^}*#\'!%\\b[#*{\x00', '\x16}\'\x00', 'uid']}, ["", "", "", "", "", ""]}, 0x440}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) preadv(r4, &(0x7f0000001380)=[{&(0x7f0000001200)=""/144, 0x90}, {&(0x7f00000012c0)=""/114, 0x72}, {&(0x7f0000001340)=""/46, 0x2e}], 0x3, 0xc32, 0x818) r12 = syz_genetlink_get_family_id$smc(&(0x7f0000001400), r11) sendmsg$SMC_PNETID_DEL(r10, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x3c, r12, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10000}, 0x11) (async) sendmsg$SMC_PNETID_DEL(r10, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x3c, r12, 0x10, 0x70bd27, 0x25dfdbfe, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10000}, 0x11) mount$incfs(&(0x7f0000001500)='./file0\x00', &(0x7f0000001540)='./file0\x00', &(0x7f0000001580), 0x11005, &(0x7f00000015c0)={[{@read_timeout_ms={'read_timeout_ms', 0x3d, 0x4795}}, {@no_bf_readahead}, {@rlog_wakeup_cnt={'rlog_wakeup_cnt', 0x3d, 0x7}}], [{@dont_measure}, {@fowner_gt={'fowner>', r8}}]}) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r4, &(0x7f0000001740)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x50014205}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x2c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x6}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000) (async) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r4, &(0x7f0000001740)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x50014205}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x2c, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x6}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000) ioctl$IOC_PR_PREEMPT(r10, 0x401870cb, &(0x7f0000001780)={0x4, 0x7ff, 0x1, 0x81}) 771.870686ms ago: executing program 2 (id=418): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x800000001fe, 0x82) r1 = dup(r0) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000080)={0x23, 0x3, 0x1c, 0x2004, 0x0, 0x7, 0x0}) (async, rerun: 32) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 32) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0xfffffffc, @local, 0x9}, 0x1c) (async) setsockopt$sock_int(r3, 0x1, 0x14, &(0x7f0000000040), 0x50) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r4, 0x29, 0x3, 0x0, &(0x7f0000000040)) (async) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) (async) ioprio_set$pid(0x1, 0x0, 0x0) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@textreal={0x8, 0x0, 0x1d}], 0x1, 0x2c, 0x0, 0x0) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000000000008004"]) (async) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) (async) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000080)=0x2, 0x4) (async) sendto$inet6(r2, &(0x7f0000000240)="c62ee5d6a89f2387cb4093532f7c0a22ce", 0xffffffffffffff69, 0x8040, 0x0, 0x0) (async, rerun: 32) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 32) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r12, 0x0, r10, 0x0, 0xf3a, 0x0) (async) write$binfmt_elf64(r11, &(0x7f0000000380)=ANY=[], 0x18c6) (async) read$FUSE(r9, &(0x7f00000021c0)={0x2020}, 0x2020) (async, rerun: 64) r13 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (rerun: 64) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r13, 0x0) epoll_ctl$EPOLL_CTL_ADD(r13, 0x1, r5, &(0x7f0000000100)={0x1}) 771.492735ms ago: executing program 3 (id=419): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xfffffffffffffff5]}, 0x8, 0x80000) readv(r0, &(0x7f0000000180)=[{&(0x7f00000001c0)=""/262, 0x106}], 0x1) (async) syz_clone(0x140011, 0x0, 0x0, 0x0, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) r1 = gettid() rt_sigaction(0x16, &(0x7f0000000380)={0x0, 0x90000000, 0x0}, 0x0, 0x8, &(0x7f0000000180)) (async) tkill(r1, 0x16) (async, rerun: 32) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='vfat\x00', 0x808081, 0x0) (rerun: 32) 721.142546ms ago: executing program 1 (id=420): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x20048000) r1 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000280)='syz1\x00', 0x200002, 0x0) syz_clone3(&(0x7f00000002c0)={0x10000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080), {0x15}, &(0x7f0000000100)=""/6, 0x6, &(0x7f0000000140)=""/91, &(0x7f00000001c0), 0x0, {r1}}, 0x58) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) writev(r2, &(0x7f0000000240)=[{&(0x7f00000020c0)="bbf73d0c1e2044a11659f21eff48036983349dc43874210e104912bffb8f598101112dcc8dcf8700a489490d63", 0x2d}], 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 714.163487ms ago: executing program 1 (id=421): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) fchdir(r0) (async) fchdir(r0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') (async) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') read$FUSE(r1, &(0x7f00000005c0)={0x2020}, 0x2020) 706.847967ms ago: executing program 1 (id=422): r0 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r0, &(0x7f0000000140), 0x10) listen(r0, 0x5) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212"], 0x0) syz_usb_connect$cdc_ecm(0x1, 0x52, &(0x7f0000000100)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x40, 0x1, 0x1, 0x4, 0x90, 0x5, [{{0x9, 0x4, 0x0, 0x1, 0x2, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0xff6b}, {0xd, 0x24, 0xf, 0x1, 0xf, 0x4, 0x2, 0xab}, [@obex={0x5, 0x24, 0x15, 0xd5}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x1f, 0x0, 0xff}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0xc, 0xd, 0xcf}}}}}]}}]}}, &(0x7f0000000280)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x200, 0x6, 0x0, 0x7, 0xff, 0x3}, 0x0, 0x0}) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x402, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x19) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x72c}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000000000/0xc00000)=nil, 0xc00000}, 0x3}) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="54000000eb5066bc443f25380000000000000000000000feff00000000000000060000000000000000000000000000000900000000000004", @ANYRES32=0x0, @ANYBLOB="0000000000000000fffffff0000000000800030011000000"], 0x54}}, 0x0) dup3(r2, r3, 0x80000) syz_usb_control_io$sierra_net(r1, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x4}, 0x10) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f407000904001f000000ff02000200", 0x19) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r5, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000440)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00200000000000000018000280080002000a00000004000100080004387936c01f0738ebec61fad586623a1214b832d0c8794fd0bb2d541dce137a661c559d0ce0790859eb51643d4b1c910cdaef8223fd8f541a69c80b3e8599545c5fd662a5d2b8859b44d8170dd21df66ac2657cc7972b05cf9f4609212eff0bcfcbc4b503a6d1ca8ff9ac0777fde95207362495d0c932ace8bdf7341903f001e897f3b406e5ace96d9067bf0ae77efd1e6917260bba3b6b9d8134d506"], 0x44}}, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x1002, 0x0) pipe(&(0x7f00000001c0)) r8 = socket$netlink(0x10, 0x3, 0x9) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f0000000040)={0x2, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, 0x0) sendmsg$NFT_MSG_GETOBJ(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)={0x14, 0x13, 0xa, 0x5, 0x0, 0x0, {0x3, 0x0, 0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c005}, 0x20004010) close_range(r7, 0xffffffffffffffff, 0x0) 101.174479ms ago: executing program 1 (id=423): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) mknod(0x0, 0x836fac3ed7542db, 0x2) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x20048000) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x5e1920, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 99.848189ms ago: executing program 1 (id=424): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x401) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0}) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newae={0x40, 0x1e, 0x1, 0x70bd26, 0x25dfdbfe, {{@in6=@private2, 0x4d3, 0xa, 0x33}, @in=@broadcast, 0x4, 0x3505}}, 0x40}}, 0x90) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TCSETSF2(r2, 0x402c542d, &(0x7f0000000100)={0x80000000, 0xe7, 0x2, 0xff, 0x7, "ea71061d0000000001000200", 0x0, 0x7}) prlimit64(0x0, 0x6, &(0x7f0000000140), 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x100) setreuid(0xee01, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setresuid(0xee01, 0x0, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x1) r3 = userfaultfd(0x80801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000507000/0x2000)=nil, 0x2000}}) ioctl$int_in(r3, 0x5421, &(0x7f0000000040)=0x76) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x604082, 0x0) read$ptp(r4, &(0x7f0000000380)=""/63, 0x3f) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x18, 0x0, &(0x7f00000004c0)=[@request_death, @release={0x40046306, 0x1000}], 0x0, 0x0, 0x0}) 9.128021ms ago: executing program 0 (id=425): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) mmap(&(0x7f000001b000/0x2000)=nil, 0x2000, 0xa8ca3411d3c2600f, 0x50, r0, 0x22e7c000) 0s ago: executing program 0 (id=426): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/custom0\x00', 0x1800, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000010c0), 0x80, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CAP_DISABLE_QUIRKS2(r2, 0x4068aea3, &(0x7f0000000000)={0xd5, 0x0, 0xbf}) r3 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0), 0x10000, 0x0) ioctl$EXT4_IOC_GETSTATE(r2, 0x40046629, &(0x7f0000000140)) r4 = open_tree(r3, &(0x7f0000000100)='./file0\x00', 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="a400000000010104000000000000000002000000380001801400018008000100ac1e000108000200e00000010c00028005000100000000001400018008000100e0000001080002000a010101240002800c000280050001000000000014000180080001000000000008000200e00000020800074000000000080008400000000008001540"], 0xa4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$can_bcm(r4, 0x0, 0x4000044) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC(r3, 0x4068aea3, &(0x7f0000000180)) close_range(r0, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 14.068522][ T36] kauditd_printk_skb: 48 callbacks suppressed [ 14.068537][ T36] audit: type=1400 audit(1757405475.379:59): avc: denied { transition } for pid=232 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.072940][ T36] audit: type=1400 audit(1757405475.379:60): avc: denied { noatsecure } for pid=232 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.075776][ T36] audit: type=1400 audit(1757405475.379:61): avc: denied { write } for pid=232 comm="sh" path="pipe:[1518]" dev="pipefs" ino=1518 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 14.079184][ T36] audit: type=1400 audit(1757405475.379:62): avc: denied { rlimitinh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.082517][ T36] audit: type=1400 audit(1757405475.379:63): avc: denied { siginh } for pid=232 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.157' (ED25519) to the list of known hosts. [ 21.258375][ T36] audit: type=1400 audit(1757405482.569:64): avc: denied { mounton } for pid=282 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.259601][ T282] cgroup: Unknown subsys name 'net' [ 21.281045][ T36] audit: type=1400 audit(1757405482.569:65): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.308427][ T36] audit: type=1400 audit(1757405482.599:66): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.308574][ T282] cgroup: Unknown subsys name 'devices' [ 21.494788][ T282] cgroup: Unknown subsys name 'hugetlb' [ 21.500446][ T282] cgroup: Unknown subsys name 'rlimit' [ 21.673538][ T36] audit: type=1400 audit(1757405482.989:67): avc: denied { setattr } for pid=282 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.695920][ T284] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.696951][ T36] audit: type=1400 audit(1757405482.989:68): avc: denied { mounton } for pid=282 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.730142][ T36] audit: type=1400 audit(1757405482.989:69): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 21.735502][ T282] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 21.753296][ T36] audit: type=1400 audit(1757405483.019:70): avc: denied { relabelto } for pid=284 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.787373][ T36] audit: type=1400 audit(1757405483.019:71): avc: denied { write } for pid=284 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.813354][ T36] audit: type=1400 audit(1757405483.049:72): avc: denied { read } for pid=282 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 21.839059][ T36] audit: type=1400 audit(1757405483.049:73): avc: denied { open } for pid=282 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.605181][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.612256][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.619334][ T291] bridge_slave_0: entered allmulticast mode [ 22.625833][ T291] bridge_slave_0: entered promiscuous mode [ 22.632427][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.639460][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.646597][ T291] bridge_slave_1: entered allmulticast mode [ 22.652911][ T291] bridge_slave_1: entered promiscuous mode [ 22.701455][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.708558][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.715967][ T289] bridge_slave_0: entered allmulticast mode [ 22.722246][ T289] bridge_slave_0: entered promiscuous mode [ 22.736354][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.743430][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.750531][ T289] bridge_slave_1: entered allmulticast mode [ 22.756815][ T289] bridge_slave_1: entered promiscuous mode [ 22.767817][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.774891][ T290] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.781942][ T290] bridge_slave_0: entered allmulticast mode [ 22.788288][ T290] bridge_slave_0: entered promiscuous mode [ 22.794573][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.801588][ T290] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.808719][ T290] bridge_slave_1: entered allmulticast mode [ 22.814968][ T290] bridge_slave_1: entered promiscuous mode [ 22.842694][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.849741][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.856881][ T292] bridge_slave_0: entered allmulticast mode [ 22.863068][ T292] bridge_slave_0: entered promiscuous mode [ 22.869399][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.876599][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.883693][ T292] bridge_slave_1: entered allmulticast mode [ 22.889830][ T292] bridge_slave_1: entered promiscuous mode [ 23.018347][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.025555][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.032868][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.039881][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.067291][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.074806][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.082081][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.089142][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.098255][ T290] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.105325][ T290] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.112604][ T290] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.119617][ T290] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.129093][ T292] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.136153][ T292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.143440][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.150460][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.181872][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.189663][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.197764][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.205755][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.213018][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.220228][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.227869][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.235094][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.255761][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.262826][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.270347][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.277384][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.285236][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.292282][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.306184][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.313272][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.320865][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.327928][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.343325][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.350364][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.381465][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.388546][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.396610][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.403666][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.417079][ T290] veth0_vlan: entered promiscuous mode [ 23.438861][ T289] veth0_vlan: entered promiscuous mode [ 23.454106][ T290] veth1_macvtap: entered promiscuous mode [ 23.471322][ T289] veth1_macvtap: entered promiscuous mode [ 23.500625][ T292] veth0_vlan: entered promiscuous mode [ 23.507696][ T291] veth0_vlan: entered promiscuous mode [ 23.514833][ T290] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.519391][ T291] veth1_macvtap: entered promiscuous mode [ 23.556923][ T333] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 23.573088][ T333] bpf: Bad value for 'uid' [ 23.585586][ T292] veth1_macvtap: entered promiscuous mode [ 23.619010][ T342] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 23.832282][ T45] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 23.942198][ T66] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 23.982026][ T368] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=61 sclass=netlink_route_socket pid=368 comm=syz.0.12 [ 23.992206][ T45] usb 2-1: Using ep0 maxpacket: 8 [ 24.003133][ T45] usb 2-1: unable to get BOS descriptor or descriptor too short [ 24.011688][ T45] usb 2-1: config 6 has an invalid interface number: 248 but max is 0 [ 24.020212][ T45] usb 2-1: config 6 has no interface number 0 [ 24.026802][ T45] usb 2-1: config 6 interface 248 has no altsetting 0 [ 24.035315][ T45] usb 2-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 24.053021][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.061211][ T45] usb 2-1: Product: syz [ 24.072284][ T45] usb 2-1: Manufacturer: syz [ 24.077116][ T45] usb 2-1: SerialNumber: syz [ 24.092175][ T66] usb 4-1: Using ep0 maxpacket: 8 [ 24.099771][ T66] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 24.111427][ T66] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 24.121324][ T66] usb 4-1: Product: syz [ 24.125687][ T66] usb 4-1: Manufacturer: syz [ 24.134694][ T66] usb 4-1: SerialNumber: syz [ 24.147619][ T377] rust_binder: 377 RLIMIT_NICE not set [ 24.161373][ T331] rust_binder: 376: removing orphan mapping 0:1192 [ 24.287411][ T381] rust_binder: Write failure EFAULT in pid:2 [ 24.288272][ T382] bpf: Bad value for 'uid' [ 24.307827][ T45] ums-karma 2-1:6.248: USB Mass Storage device detected [ 24.356792][ T45] usb 2-1: USB disconnect, device number 2 [ 24.369528][ T66] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 24.556446][ T345] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 24.565265][ T345] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 24.583102][ T66] usb 4-1: USB disconnect, device number 2 [ 24.587003][ T405] netlink: 4 bytes leftover after parsing attributes in process `syz.1.22'. [ 24.598222][ T66] usblp0: removed [ 24.864693][ T10] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 25.043372][ T10] usb 3-1: descriptor type invalid, skip [ 25.049601][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 25.058160][ T10] usb 3-1: config 0 has no interfaces? [ 25.065625][ T10] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 25.074837][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 25.082928][ T66] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 25.090645][ T10] usb 3-1: Product: syz [ 25.094945][ T10] usb 3-1: Manufacturer: syz [ 25.099670][ T10] usb 3-1: SerialNumber: syz [ 25.105434][ T10] usb 3-1: config 0 descriptor?? [ 25.128216][ T418] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:4 [ 25.262206][ T66] usb 1-1: Using ep0 maxpacket: 16 [ 25.279767][ T416] binder: Bad value for 'max' [ 25.285253][ T66] usb 1-1: unable to get BOS descriptor or descriptor too short [ 25.293751][ T66] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 25.301325][ T66] usb 1-1: can't read configurations, error -71 [ 25.314802][ T407] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.323586][ T407] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.333350][ T45] usb 3-1: USB disconnect, device number 2 [ 25.572219][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 25.723263][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 25.734315][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 25.744712][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 25.757581][ T10] usb 4-1: New USB device found, idVendor=0eef, idProduct=72d0, bcdDevice= 0.00 [ 25.766642][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.775222][ T10] usb 4-1: config 0 descriptor?? [ 26.132237][ T66] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 26.183866][ T10] hid-multitouch 0003:0EEF:72D0.0001: hidraw0: USB HID v0.00 Device [HID 0eef:72d0] on usb-dummy_hcd.3-1/input0 [ 26.282181][ T66] usb 1-1: Using ep0 maxpacket: 8 [ 26.288658][ T66] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 26.297816][ T66] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 26.306653][ T66] usb 1-1: config 0 descriptor?? [ 26.384770][ T422] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 26.393920][ T10] usb 4-1: USB disconnect, device number 3 [ 26.498876][ T36] kauditd_printk_skb: 103 callbacks suppressed [ 26.498892][ T36] audit: type=1400 audit(1757405487.809:177): avc: denied { block_suspend } for pid=431 comm="syz.2.32" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 26.527015][ T66] asix 1-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 26.544847][ T36] audit: type=1400 audit(1757405487.859:178): avc: denied { setopt } for pid=433 comm="syz.2.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 26.545170][ T434] Zero length message leads to an empty skb [ 26.574238][ T36] audit: type=1400 audit(1757405487.889:179): avc: denied { create } for pid=433 comm="syz.2.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 26.593431][ T36] audit: type=1400 audit(1757405487.889:180): avc: denied { write } for pid=433 comm="syz.2.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 26.625654][ T36] audit: type=1400 audit(1757405487.939:181): avc: denied { read } for pid=433 comm="syz.2.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 26.627353][ T435] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 26.652210][ T435] rust_binder: BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 26.663576][ T36] audit: type=1400 audit(1757405487.979:182): avc: denied { mount } for pid=433 comm="syz.2.33" name="/" dev="configfs" ino=1161 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 26.685994][ T36] audit: type=1400 audit(1757405487.979:183): avc: denied { search } for pid=433 comm="syz.2.33" name="/" dev="configfs" ino=1161 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 26.702192][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 26.707987][ T413] Bluetooth: hci0: command 0x1003 tx timeout [ 26.899264][ T36] audit: type=1400 audit(1757405488.209:184): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 26.919468][ T36] audit: type=1400 audit(1757405488.229:185): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 27.182285][ T45] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 27.333264][ T45] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.343390][ T45] usb 4-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 27.352700][ T45] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.361657][ T45] usb 4-1: config 0 descriptor?? [ 27.395868][ T36] audit: type=1400 audit(1757405488.709:186): avc: denied { name_bind } for pid=443 comm="syz.2.36" src=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket permissive=1 [ 27.592166][ T10] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 27.770996][ T45] usbhid 4-1:0.0: can't add hid device: -71 [ 27.780847][ T45] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 27.789935][ T45] usb 4-1: USB disconnect, device number 4 [ 27.888376][ T465] netlink: 'syz.2.44': attribute type 4 has an invalid length. [ 27.957014][ T473] netlink: 8 bytes leftover after parsing attributes in process `syz.2.45'. [ 28.144775][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 28.151349][ T13] Bluetooth: hci0: Frame reassembly failed (-84) [ 28.299401][ T477] netlink: 20 bytes leftover after parsing attributes in process `syz.3.47'. [ 28.309154][ T477] exFAT-fs (rnullb0): invalid boot record signature [ 28.315810][ T477] exFAT-fs (rnullb0): failed to read boot sector [ 28.322309][ T477] exFAT-fs (rnullb0): failed to recognize exfat type [ 28.341073][ T479] Invalid logical block size (1) [ 28.346779][ T479] Invalid logical block size (1) [ 28.490147][ T490] rust_binder: 490 RLIMIT_NICE not set [ 28.494077][ T411] rust_binder: 489: removing orphan mapping 0:1192 [ 29.691722][ T516] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 30.222205][ T413] Bluetooth: hci0: command 0x1003 tx timeout [ 30.228256][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 30.236130][ T66] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 30.246764][ T66] asix 1-1:0.0: probe with driver asix failed with error -71 [ 30.260778][ T66] usb 1-1: USB disconnect, device number 3 [ 30.309142][ T531] capability: warning: `syz.2.66' uses deprecated v2 capabilities in a way that may be insecure [ 30.323517][ T531] overlayfs: failed to clone upperpath [ 30.331979][ T535] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 30.331999][ T535] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 30.338936][ T531] overlayfs: failed to clone upperpath [ 30.351406][ T45] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 30.359715][ T535] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 30.359742][ T535] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 30.367303][ T535] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 30.381427][ T535] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 30.381446][ T535] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 30.448817][ T555] netlink: 28 bytes leftover after parsing attributes in process `syz.0.73'. [ 30.458213][ T555] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:36 [ 30.523185][ T45] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 30.542758][ T45] usb 4-1: config 0 has no interfaces? [ 30.548310][ T45] usb 4-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 30.557469][ T45] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.566021][ T45] usb 4-1: config 0 descriptor?? [ 30.773279][ T519] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 30.781834][ T519] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 30.967573][ T562] netlink: 'syz.2.76': attribute type 58 has an invalid length. [ 31.043169][ T564] netlink: 12 bytes leftover after parsing attributes in process `syz.1.77'. [ 31.290495][ T579] overlayfs: failed to resolve './file1': -2 [ 31.307796][ T581] rust_binder: inc_ref_done called when no active inc_refs [ 31.367898][ T584] rust_binder: 583 RLIMIT_NICE not set [ 31.378376][ T9] rust_binder: 582: removing orphan mapping 0:4248 [ 31.402166][ T10] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 31.516704][ T601] netlink: 'syz.2.90': attribute type 12 has an invalid length. [ 31.525449][ T601] : Can't lookup blockdev [ 31.552168][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 31.562541][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 31.570957][ T10] usb 2-1: config 3 has an invalid interface number: 44 but max is 1 [ 31.579353][ T10] usb 2-1: config 3 has an invalid interface number: 57 but max is 1 [ 31.587668][ T10] usb 2-1: config 3 has an invalid interface descriptor of length 2, skipping [ 31.588183][ T607] netlink: 'syz.2.93': attribute type 4 has an invalid length. [ 31.596676][ T10] usb 2-1: config 3 has no interface number 0 [ 31.610365][ T10] usb 2-1: config 3 has no interface number 1 [ 31.616499][ T10] usb 2-1: config 3 interface 44 altsetting 127 endpoint 0x6 has invalid wMaxPacketSize 0 [ 31.626412][ T10] usb 2-1: config 3 interface 44 altsetting 127 endpoint 0xF has invalid wMaxPacketSize 0 [ 31.636367][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 31.643880][ T10] usb 2-1: config 3 interface 44 has no altsetting 0 [ 31.650552][ T10] usb 2-1: config 3 interface 57 has no altsetting 0 [ 31.658679][ T10] usb 2-1: New USB device found, idVendor=0424, idProduct=9900, bcdDevice=ad.87 [ 31.667933][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.676007][ T10] usb 2-1: Product: syz [ 31.680165][ T10] usb 2-1: Manufacturer: syz [ 31.684777][ T10] usb 2-1: SerialNumber: syz [ 31.802172][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 31.808490][ T9] usb 1-1: config 0 has an invalid interface number: 224 but max is 0 [ 31.816750][ T9] usb 1-1: config 0 has no interface number 0 [ 31.822882][ T9] usb 1-1: config 0 interface 224 has no altsetting 0 [ 31.830994][ T9] usb 1-1: New USB device found, idVendor=0471, idProduct=060d, bcdDevice=76.cd [ 31.840292][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.848312][ T9] usb 1-1: Product: syz [ 31.852525][ T9] usb 1-1: Manufacturer: syz [ 31.857169][ T9] usb 1-1: SerialNumber: syz [ 31.862415][ T9] usb 1-1: config 0 descriptor?? [ 31.892653][ T10] smsc95xx v2.0.0 [ 31.896315][ T10] smsc95xx 2-1:3.44 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 31.906606][ T10] smsc95xx 2-1:3.44: probe with driver smsc95xx failed with error -22 [ 31.915878][ T10] smsc95xx v2.0.0 [ 31.919549][ T10] smsc95xx 2-1:3.57 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 31.929636][ T10] smsc95xx 2-1:3.57: probe with driver smsc95xx failed with error -22 [ 31.940091][ T10] usb 2-1: USB disconnect, device number 4 [ 32.143245][ T36] kauditd_printk_skb: 41 callbacks suppressed [ 32.143261][ T36] audit: type=1400 audit(1757405493.459:228): avc: denied { bind } for pid=612 comm="syz.2.95" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 32.168448][ T36] audit: type=1400 audit(1757405493.459:229): avc: denied { listen } for pid=612 comm="syz.2.95" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 32.187684][ T36] audit: type=1400 audit(1757405493.479:230): avc: denied { accept } for pid=612 comm="syz.2.95" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 32.417645][ T36] audit: type=1400 audit(1757405493.729:231): avc: denied { relabelfrom } for pid=637 comm="syz.1.103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 32.437746][ T36] audit: type=1400 audit(1757405493.729:232): avc: denied { relabelto } for pid=637 comm="syz.1.103" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 32.492249][ T36] audit: type=1400 audit(1757405493.809:233): avc: denied { write } for pid=641 comm="syz.1.104" name="001" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 32.762164][ T45] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 32.913254][ T45] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 32.922554][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.931425][ T45] usb 2-1: config 0 descriptor?? [ 33.100150][ T646] usb 4-1: USB disconnect, device number 5 [ 33.117936][ T36] audit: type=1400 audit(1757405494.429:234): avc: denied { read write } for pid=651 comm="syz.3.107" name="uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 33.142702][ T36] audit: type=1400 audit(1757405494.429:235): avc: denied { open } for pid=651 comm="syz.3.107" path="/dev/uinput" dev="devtmpfs" ino=194 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 33.151113][ T45] usb 2-1: Cannot set MAC address [ 33.177844][ T36] audit: type=1400 audit(1757405494.489:236): avc: denied { remount } for pid=585 comm="syz.0.85" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.199635][ T45] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 33.213335][ T36] audit: type=1400 audit(1757405494.489:237): avc: denied { remount } for pid=651 comm="syz.3.107" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 33.216062][ T45] usb 2-1: USB disconnect, device number 5 [ 33.253314][ T666] loop2: detected capacity change from 0 to 7 [ 33.273810][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.282986][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 33.292071][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.301241][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 33.309098][ T666] loop2: unable to read partition table [ 33.315542][ T666] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 33.329130][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.338276][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 33.346430][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.355682][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 33.363643][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.372791][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 33.380849][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.390017][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 33.398090][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.407241][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 33.415280][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.424414][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 33.432347][ T674] loop2: unable to read partition table [ 33.434725][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 33.447144][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 33.622153][ T45] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 33.792149][ T45] usb 2-1: Using ep0 maxpacket: 8 [ 33.804399][ T45] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 33.817952][ T45] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.832227][ T45] usb 2-1: Product: syz [ 33.837604][ T45] usb 2-1: Manufacturer: syz [ 33.845987][ T45] usb 2-1: SerialNumber: syz [ 34.063464][ T45] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 6 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 34.078199][ T691] netlink: 8 bytes leftover after parsing attributes in process `syz.2.117'. [ 34.090308][ T691] capability: warning: `syz.2.117' uses 32-bit capabilities (legacy support in use) [ 34.193782][ T702] netlink: 'syz.2.119': attribute type 4 has an invalid length. [ 34.212223][ T702] netlink: 'syz.2.119': attribute type 4 has an invalid length. [ 34.247831][ T706] SELinux: Context system_u:object_r:xen_device_t:s0 is not valid (left unmapped). [ 34.271241][ T673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.280642][ T673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.299462][ T9] usb 2-1: USB disconnect, device number 6 [ 34.307526][ T711] netlink: 'syz.2.122': attribute type 39 has an invalid length. [ 34.309350][ T9] usblp0: removed [ 34.329292][ T717] netlink: 'syz.2.122': attribute type 39 has an invalid length. [ 34.414379][ T66] usb 1-1: USB disconnect, device number 4 [ 34.453629][ T732] syzkaller0: entered promiscuous mode [ 34.469375][ T732] syzkaller0: entered allmulticast mode [ 34.483082][ T734] cgroup: Invalid name [ 34.490364][ T737] rust_binder: Error in use_page_slow: ESRCH [ 34.490388][ T737] rust_binder: use_range failure ESRCH [ 34.497666][ T737] rust_binder: Failed to allocate buffer. len:1048, is_oneway:false [ 34.503573][ T737] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 34.514143][ T737] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:60 [ 34.593490][ T741] netlink: 48 bytes leftover after parsing attributes in process `syz.3.131'. [ 34.828435][ T746] rust_binder: 66: no such ref 3 [ 34.838899][ T746] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 0 [ 34.846330][ T746] rust_binder: Write failure EINVAL in pid:66 [ 34.846565][ T746] rust_binder: BC_CLEAR_FREEZE_NOTIFICATION invalid ref 0 [ 34.860179][ T746] rust_binder: Write failure EINVAL in pid:66 [ 34.872237][ T66] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 34.887275][ T748] binder: Unknown parameter 'defcontext01777777777777777777777' [ 35.032145][ T66] usb 1-1: Using ep0 maxpacket: 16 [ 35.038691][ T66] usb 1-1: config index 0 descriptor too short (expected 6674, got 18) [ 35.048657][ T66] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 35.058003][ T66] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.066059][ T66] usb 1-1: Product: syz [ 35.070217][ T66] usb 1-1: Manufacturer: syz [ 35.074827][ T66] usb 1-1: SerialNumber: syz [ 35.081681][ T66] r8152-cfgselector 1-1: Unknown version 0x0000 [ 35.087973][ T66] r8152-cfgselector 1-1: config 0 descriptor?? [ 35.232176][ T758] overlayfs: failed to clone upperpath [ 35.502884][ T743] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.511454][ T743] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.602807][ T66] r8152-cfgselector 1-1: USB disconnect, device number 5 [ 35.832156][ T769] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.832182][ T769] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.838691][ T769] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.845305][ T769] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.851608][ T769] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 35.851680][ T9] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 35.858281][ T769] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 36.023197][ T9] usb 4-1: config 0 has an invalid interface number: 189 but max is 0 [ 36.052162][ T9] usb 4-1: config 0 has no interface number 0 [ 36.058307][ T9] usb 4-1: config 0 interface 189 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 36.070436][ T9] usb 4-1: config 0 interface 189 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 36.082698][ T9] usb 4-1: config 0 interface 189 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 64 [ 36.094058][ T9] usb 4-1: config 0 interface 189 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 36.104071][ T9] usb 4-1: config 0 interface 189 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 36.119270][ T9] usb 4-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 36.133967][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.142307][ T9] usb 4-1: Product: syz [ 36.146590][ T9] usb 4-1: Manufacturer: syz [ 36.151246][ T9] usb 4-1: SerialNumber: syz [ 36.160343][ T9] usb 4-1: config 0 descriptor?? [ 36.165890][ T765] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 36.378461][ T765] input: syz1 as /devices/virtual/input/input5 [ 36.391194][ T9] ums-alauda 4-1:0.189: USB Mass Storage device detected [ 36.392155][ T45] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 36.412185][ T9] scsi host1: usb-storage 4-1:0.189 [ 36.421084][ T9] usb 4-1: USB disconnect, device number 6 [ 36.564514][ T45] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 36.573619][ T45] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.581717][ T45] usb 1-1: Product: syz [ 36.585918][ T45] usb 1-1: Manufacturer: syz [ 36.590520][ T45] usb 1-1: SerialNumber: syz [ 36.925397][ T787] pim6reg1: entered promiscuous mode [ 36.930815][ T787] pim6reg1: entered allmulticast mode [ 37.024172][ T793] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem [ 37.362248][ T45] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 37.412186][ T9] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 37.513360][ T45] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 37.523308][ T45] usb 4-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 37.532391][ T45] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 37.540898][ T45] usb 4-1: config 0 descriptor?? [ 37.572175][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 37.578675][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 37.587490][ T9] usb 2-1: config 6 has an invalid interface number: 248 but max is 0 [ 37.595750][ T9] usb 2-1: config 6 has no interface number 0 [ 37.601928][ T9] usb 2-1: config 6 interface 248 has no altsetting 0 [ 37.610367][ T9] usb 2-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 37.619481][ T9] usb 2-1: New USB device strings: Mfr=3, Product=2, SerialNumber=3 [ 37.627500][ T9] usb 2-1: Product: syz [ 37.631662][ T9] usb 2-1: Manufacturer: syz [ 37.636381][ T9] usb 2-1: SerialNumber: syz [ 37.846221][ T9] ums-karma 2-1:6.248: USB Mass Storage device detected [ 37.914217][ T9] usb 2-1: USB disconnect, device number 7 [ 37.948526][ T36] kauditd_printk_skb: 54 callbacks suppressed [ 37.948542][ T36] audit: type=1400 audit(1757405499.259:292): avc: denied { read } for pid=797 comm="syz.3.149" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 37.977737][ T45] usbhid 4-1:0.0: can't add hid device: -71 [ 37.985220][ T45] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 37.993813][ T45] usb 4-1: USB disconnect, device number 7 [ 38.245541][ T36] audit: type=1400 audit(1757405499.559:293): avc: denied { name_bind } for pid=807 comm="syz.2.152" src=65530 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 38.614408][ T816] rust_binder: 815 RLIMIT_NICE not set [ 38.617554][ T9] rust_binder: 814: removing orphan mapping 0:4248 [ 38.893356][ T845] rust_binder: 95: no such ref 0 [ 38.901363][ T845] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 38.908910][ T845] rust_binder: 95: no such ref 0 [ 38.932164][ T45] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 38.958809][ T852] netlink: 'syz.1.166': attribute type 6 has an invalid length. [ 38.966835][ T852] IPv6: NLM_F_CREATE should be specified when creating new route [ 38.975477][ T856] overlayfs: failed to clone upperpath [ 39.001457][ T858] af_packet: tpacket_rcv: packet too big, clamped from 1 to 4294967272. macoff=96 [ 39.024639][ T862] raw_sendmsg: syz.1.170 forgot to set AF_INET. Fix it! [ 39.024645][ T36] audit: type=1400 audit(1757405500.339:294): avc: denied { read } for pid=95 comm="acpid" name="mouse4" dev="devtmpfs" ino=478 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 39.024669][ T36] audit: type=1400 audit(1757405500.339:295): avc: denied { open } for pid=95 comm="acpid" path="/dev/input/mouse4" dev="devtmpfs" ino=478 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 39.075908][ T36] audit: type=1400 audit(1757405500.339:296): avc: denied { ioctl } for pid=95 comm="acpid" path="/dev/input/mouse4" dev="devtmpfs" ino=478 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=root:object_r:device_t tclass=file permissive=1 [ 39.102329][ T868] rust_binder: 104: no such ref 3 [ 39.107894][ T868] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 39.107986][ T868] rust_binder: Write failure EFAULT in pid:104 [ 39.132162][ T45] usb 4-1: device descriptor read/64, error -71 [ 39.154928][ T31] usb 1-1: USB disconnect, device number 6 [ 39.180525][ T872] netlink: 4 bytes leftover after parsing attributes in process `syz.0.174'. [ 39.189412][ T874] netlink: 'syz.1.175': attribute type 4 has an invalid length. [ 39.213212][ T874] netlink: 'syz.1.175': attribute type 17 has an invalid length. [ 39.229740][ T36] audit: type=1400 audit(1757405500.539:297): avc: denied { listen } for pid=873 comm="syz.1.175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 39.335836][ T36] audit: type=1326 audit(1757405500.649:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=888 comm="syz.2.181" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc9b878ebe9 code=0x0 [ 39.392191][ T45] usb 4-1: device descriptor read/64, error -71 [ 39.592177][ T66] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 39.632213][ T45] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 39.642207][ T9] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 39.742154][ T66] usb 2-1: Using ep0 maxpacket: 8 [ 39.748495][ T66] usb 2-1: unable to get BOS descriptor or descriptor too short [ 39.756898][ T66] usb 2-1: config 4 has an invalid interface number: 147 but max is 0 [ 39.762181][ T45] usb 4-1: device descriptor read/64, error -71 [ 39.765086][ T66] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 39.781517][ T66] usb 2-1: config 4 has no interface number 0 [ 39.789553][ T66] usb 2-1: string descriptor 0 read error: -22 [ 39.795793][ T66] usb 2-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 39.804896][ T66] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.814034][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 39.825622][ T9] usb 1-1: config 0 has no interfaces? [ 39.831109][ T9] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 39.840180][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.849005][ T9] usb 1-1: config 0 descriptor?? [ 40.002182][ T45] usb 4-1: device descriptor read/64, error -71 [ 40.016594][ T898] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.025525][ T898] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.034731][ T36] audit: type=1400 audit(1757405501.349:299): avc: denied { ioctl } for pid=897 comm="syz.1.182" path="/dev/ppp" dev="devtmpfs" ino=86 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 40.056699][ T902] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.069062][ T902] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.102682][ T646] usb 2-1: USB disconnect, device number 8 [ 40.112312][ T45] usb usb4-port1: attempt power cycle [ 40.176421][ T36] audit: type=1400 audit(1757405501.489:300): avc: denied { watch_reads } for pid=903 comm="syz.2.185" path="/91" dev="tmpfs" ino=530 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 40.462204][ T45] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 40.483136][ T45] usb 4-1: device descriptor read/8, error -71 [ 40.618251][ T45] usb 4-1: device descriptor read/8, error -71 [ 40.675390][ T36] audit: type=1400 audit(1757405501.989:301): avc: denied { unmount } for pid=916 comm="syz.1.188" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 40.872149][ T45] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 40.903125][ T45] usb 4-1: device descriptor read/8, error -71 [ 41.043484][ T45] usb 4-1: device descriptor read/8, error -71 [ 41.152271][ T45] usb usb4-port1: unable to enumerate USB device [ 41.530314][ T953] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=953 comm=syz.1.202 [ 41.597508][ T963] netlink: 'syz.2.206': attribute type 12 has an invalid length. [ 41.606846][ T965] 9pnet_fd: Insufficient options for proto=fd [ 41.622085][ T968] 9pnet: p9_errstr2errno: server reported unknown error 184467440737 [ 41.668753][ T979] /dev/sr0: Can't lookup blockdev [ 41.688004][ T984] netlink: 'syz.2.213': attribute type 3 has an invalid length. [ 41.695765][ T984] netlink: 944 bytes leftover after parsing attributes in process `syz.2.213'. [ 41.716508][ T987] rust_binder: 91: no such ref 3 [ 41.725257][ T989] rust_binder: Write failure EINVAL in pid:91 [ 41.741095][ T993] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 41.747289][ T993] rust_binder: Read failure Err(EFAULT) in pid:95 [ 41.842411][ T1005] bpf: Bad value for 'mode' [ 41.853558][ T1005] bpf: Bad value for 'mode' [ 41.858128][ T1005] bpf: Bad value for 'mode' [ 41.862768][ T1005] bpf: Bad value for 'mode' [ 41.867383][ T1005] bpf: Bad value for 'mode' [ 41.871944][ T1005] bpf: Bad value for 'mode' [ 41.876550][ T1005] bpf: Bad value for 'mode' [ 41.881192][ T1005] bpf: Bad value for 'mode' [ 41.885956][ T1005] bpf: Bad value for 'mode' [ 41.890534][ T1005] bpf: Bad value for 'mode' [ 41.895174][ T1005] bpf: Bad value for 'mode' [ 41.895600][ T1006] loop2: detected capacity change from 0 to 7 [ 41.899737][ T1005] bpf: Bad value for 'mode' [ 41.910381][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 41.919541][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 41.927691][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 41.936922][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 41.944890][ T1006] loop2: unable to read partition table [ 41.953365][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 41.962178][ T1006] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 41.962543][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 41.984431][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 41.993727][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 42.002773][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 42.011918][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 42.020140][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 42.029349][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 42.038732][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 42.047926][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 42.072338][ T1018] rust_binder: Write failure EINVAL in pid:106 [ 42.408198][ T646] usb 1-1: USB disconnect, device number 7 [ 42.762234][ T646] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 42.882169][ T9] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 42.902155][ T646] usb 1-1: device descriptor read/64, error -71 [ 43.022202][ T9] usb 4-1: device descriptor read/64, error -71 [ 43.142168][ T646] usb 1-1: device descriptor read/64, error -71 [ 43.169685][ T1069] x_tables: duplicate underflow at hook 2 [ 43.176215][ T1069] fuse: Bad value for 'user_id' [ 43.181141][ T1069] fuse: Bad value for 'user_id' [ 43.204324][ T1071] netlink: 12 bytes leftover after parsing attributes in process `syz.2.243'. [ 43.262176][ T9] usb 4-1: device descriptor read/64, error -71 [ 43.382160][ T646] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 43.502180][ T9] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 43.522146][ T646] usb 1-1: device descriptor read/64, error -71 [ 43.537043][ T36] kauditd_printk_skb: 16 callbacks suppressed [ 43.537058][ T36] audit: type=1400 audit(1757405504.849:318): avc: denied { create } for pid=1100 comm="syz.1.253" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 43.574293][ T1106] syz.1.254 uses obsolete (PF_INET,SOCK_PACKET) [ 43.581508][ T36] audit: type=1400 audit(1757405504.889:319): avc: denied { accept } for pid=1105 comm="syz.1.254" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 43.632193][ T9] usb 4-1: device descriptor read/64, error -71 [ 43.643129][ T36] audit: type=1400 audit(1757405504.959:320): avc: denied { associate } for pid=1103 comm="syz.1.253" name="core" scontext=root:object_r:etc_runtime_t tcontext=system_u:object_r:root_t tclass=filesystem permissive=1 [ 43.762155][ T646] usb 1-1: device descriptor read/64, error -71 [ 43.872222][ T9] usb 4-1: device descriptor read/64, error -71 [ 43.872349][ T646] usb usb1-port1: attempt power cycle [ 43.982340][ T9] usb usb4-port1: attempt power cycle [ 44.199764][ T36] audit: type=1400 audit(1757405761.512:321): avc: denied { watch watch_reads } for pid=1123 comm="syz.1.261" path="/67/file0" dev="tmpfs" ino=377 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 44.223337][ T646] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 44.243203][ T646] usb 1-1: device descriptor read/8, error -71 [ 44.322201][ T9] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 44.343212][ T9] usb 4-1: device descriptor read/8, error -71 [ 44.373273][ T646] usb 1-1: device descriptor read/8, error -71 [ 44.473136][ T9] usb 4-1: device descriptor read/8, error -71 [ 44.612159][ T646] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 44.633279][ T646] usb 1-1: device descriptor read/8, error -71 [ 44.712174][ T9] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 44.733293][ T9] usb 4-1: device descriptor read/8, error -71 [ 44.763248][ T646] usb 1-1: device descriptor read/8, error -71 [ 44.863329][ T9] usb 4-1: device descriptor read/8, error -71 [ 44.872317][ T646] usb usb1-port1: unable to enumerate USB device [ 44.972308][ T9] usb usb4-port1: unable to enumerate USB device [ 52.240775][ T36] audit: type=1400 audit(1757405769.552:322): avc: denied { write } for pid=1137 comm="syz.3.267" path="socket:[7337]" dev="sockfs" ino=7337 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 52.266934][ T1138] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 52.282235][ T1138] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 52.290712][ T1138] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 52.303259][ T36] audit: type=1400 audit(1757405769.582:323): avc: denied { bind } for pid=1137 comm="syz.3.267" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 52.324186][ T1138] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 52.351187][ T1152] rust_binder: 128: no such ref 3 [ 52.530821][ T36] audit: type=1400 audit(1757405769.842:324): avc: denied { getopt } for pid=1155 comm="syz.0.272" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 52.550914][ T1156] netlink: 'syz.0.272': attribute type 4 has an invalid length. [ 52.571219][ T1161] input: syz0 as /devices/virtual/input/input6 [ 52.838704][ T36] audit: type=1400 audit(1757405770.152:325): avc: denied { ioctl } for pid=1165 comm="syz.0.274" path="/dev/fuse" dev="devtmpfs" ino=23 ioctlcmd=0x9418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 52.864338][ T36] audit: type=1400 audit(1757405770.182:326): avc: denied { nlmsg_read } for pid=1165 comm="syz.0.274" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 52.885280][ T36] audit: type=1400 audit(1757405770.192:327): avc: denied { map } for pid=1165 comm="syz.0.274" path="socket:[7508]" dev="sockfs" ino=7508 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 52.953167][ T1175] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=1175 comm=syz.1.277 [ 53.036522][ T1215] input: syz1 as /devices/virtual/input/input7 [ 53.051570][ T1185] cgroup: fork rejected by pids controller in /syz1 [ 53.103776][ T36] audit: type=1326 audit(1757405770.422:328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1141 comm="syz.2.269" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc9b878ebe9 code=0x7fc00000 [ 53.136781][ T36] audit: type=1326 audit(1757405770.422:329): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1141 comm="syz.2.269" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc9b878ebe9 code=0x7fc00000 [ 53.452183][ T9] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 53.582058][ T1275] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:113 [ 53.590818][ T1277] loop0: detected capacity change from 0 to 7 [ 53.606789][ C1] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 53.612137][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 53.615950][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 53.622499][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 53.639815][ C0] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 53.649006][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 53.656899][ T1149] loop0: unable to read partition table [ 53.657176][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 53.672576][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 53.685548][ T9] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 53.694668][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.695083][ C1] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 53.709318][ T9] usb 4-1: config 0 descriptor?? [ 53.711802][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 53.725841][ C1] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 53.735022][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 53.743850][ T1277] loop0: unable to read partition table [ 53.749978][ T1277] loop_reread_partitions: partition scan of loop0 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 53.775222][ T1279] Invalid logical block size (7) [ 53.781491][ C0] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 53.790680][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 53.798811][ C0] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 53.808002][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 53.815871][ T1149] loop0: unable to read partition table [ 53.829215][ C0] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 53.838411][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 53.847222][ C1] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 53.856456][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 53.866623][ C0] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 53.875813][ C0] Buffer I/O error on dev loop0, logical block 0, async page read [ 53.889628][ C1] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 53.898824][ C1] Buffer I/O error on dev loop0, logical block 0, async page read [ 53.927097][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 53.933100][ T36] audit: type=1400 audit(1757410123.242:330): avc: denied { map } for pid=1351 comm="syz.0.296" path="/dev/zero" dev="devtmpfs" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 53.959638][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 53.969873][ T9] usb 4-1: USB disconnect, device number 16 [ 53.980026][ T36] audit: type=1400 audit(1757410123.242:331): avc: denied { execute } for pid=1351 comm="syz.0.296" path="/dev/zero" dev="devtmpfs" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:zero_device_t tclass=chr_file permissive=1 [ 54.009595][ T1360] overlayfs: failed to clone upperpath [ 54.059319][ T1354] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 54.059343][ T1354] rust_binder: Read failure Err(EFAULT) in pid:122 [ 54.848605][ T1389] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 54.863337][ T1389] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 54.872116][ T1389] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 54.880021][ T1389] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 55.564413][ T1435] fuse: Bad value for 'fd' [ 55.609852][ T330] Bluetooth: hci0: Frame reassembly failed (-84) [ 56.514184][ T1511] tipc: Enabling of bearer rejected, failed to enable media [ 56.556198][ T1529] overlayfs: failed to clone upperpath [ 56.902201][ T9] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 57.052130][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 57.059971][ T9] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 57.069408][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.077784][ T9] usb 1-1: Product: syz [ 57.082275][ T9] usb 1-1: Manufacturer: syz [ 57.086928][ T9] usb 1-1: SerialNumber: syz [ 57.194487][ T1551] overlayfs: failed to clone upperpath [ 57.306177][ T9] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 12 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 57.542778][ T61] usb 1-1: USB disconnect, device number 12 [ 57.553035][ T61] usblp0: removed [ 57.662196][ T53] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 57.681748][ T1561] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.690250][ T1561] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.723676][ T1566] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 57.731599][ T1566] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 1th superblock [ 57.740198][ T1566] F2FS-fs (rnullb0): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 57.748138][ T1566] F2FS-fs (rnullb0): Can't find valid F2FS filesystem in 2th superblock [ 57.765709][ T1568] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 57.766887][ T1568] rust_binder: Error while translating object. [ 57.773391][ T1568] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 57.779548][ T1568] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:152 [ 57.811976][ T36] kauditd_printk_skb: 11 callbacks suppressed [ 57.811992][ T36] audit: type=1400 audit(1757410127.122:343): avc: denied { setattr } for pid=1574 comm="syz.3.366" name="urandom" dev="devtmpfs" ino=8 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 57.864948][ T330] syzkaller0: tun_net_xmit 76 [ 57.871605][ T330] syzkaller0: tun_net_xmit 48 [ 57.940258][ T36] audit: type=1400 audit(1757410127.252:344): avc: denied { connect } for pid=1578 comm="syz.3.368" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 57.960429][ T36] audit: type=1400 audit(1757410127.252:345): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 57.988278][ T36] audit: type=1400 audit(1757410127.302:346): avc: denied { name_bind } for pid=1583 comm="syz.3.370" src=3618 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 58.039516][ T1589] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 58.046782][ T1589] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:165 [ 58.089747][ T36] audit: type=1400 audit(1757410127.402:347): avc: denied { write } for pid=1593 comm="syz.0.373" name="ptp0" dev="devtmpfs" ino=196 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 58.233431][ T1616] binder: Bad value for 'stats' [ 58.248011][ T1621] exFAT-fs (rnullb0): invalid boot record signature [ 58.254811][ T1621] exFAT-fs (rnullb0): failed to read boot sector [ 58.261213][ T1621] exFAT-fs (rnullb0): failed to recognize exfat type [ 58.282179][ T1623] ======================================================= [ 58.282179][ T1623] WARNING: The mand mount option has been deprecated and [ 58.282179][ T1623] and is ignored by this kernel. Remove the mand [ 58.282179][ T1623] option from the mount to silence this warning. [ 58.282179][ T1623] ======================================================= [ 58.326588][ T1625] netlink: 56 bytes leftover after parsing attributes in process `syz.0.384'. [ 58.336318][ T36] audit: type=1400 audit(1757410127.652:348): avc: denied { bind } for pid=1624 comm="syz.0.384" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 58.374410][ T1625] netlink: 40 bytes leftover after parsing attributes in process `syz.0.384'. [ 58.488010][ T1628] netlink: 8 bytes leftover after parsing attributes in process `syz.0.385'. [ 58.834847][ T36] audit: type=1400 audit(1757410128.152:349): avc: denied { mounton } for pid=1666 comm="syz.3.396" path="/55/file0" dev="tmpfs" ino=318 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 58.860649][ T36] audit: type=1400 audit(1757410128.152:350): avc: denied { mounton } for pid=1666 comm="syz.3.396" path="/55/file0" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=file permissive=1 [ 59.073279][ T1691] netlink: 188 bytes leftover after parsing attributes in process `syz.2.403'. [ 59.084426][ T36] audit: type=1400 audit(1757410128.402:351): avc: denied { bpf } for pid=1690 comm="syz.2.403" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 59.274208][ T36] audit: type=1400 audit(1757410128.592:352): avc: denied { setcurrent } for pid=1698 comm="syz.0.406" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 59.553012][ T506] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 59.594548][ T1715] netlink: 20 bytes leftover after parsing attributes in process `syz.1.411'. [ 59.603942][ T1715] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=260 sclass=netlink_route_socket pid=1715 comm=syz.1.411 [ 59.629067][ T1718] binder: Unknown parameter '' [ 59.632299][ T1720] netlink: 'syz.1.413': attribute type 4 has an invalid length. [ 59.654844][ T1720] netlink: 'syz.1.413': attribute type 4 has an invalid length. [ 59.668892][ T1726] netlink: 'syz.1.413': attribute type 4 has an invalid length. [ 59.680957][ T1723] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EFAULT } [ 59.680989][ T1723] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EFAULT } my_pid:187 [ 59.690489][ T1725] netlink: 'syz.1.413': attribute type 4 has an invalid length. [ 59.702129][ T506] usb 1-1: Using ep0 maxpacket: 8 [ 59.718542][ T1738] sock: sock_set_timeout: `syz.2.418' (pid 1738) tries to set negative timeout [ 59.732564][ T506] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 59.741763][ T506] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 59.750132][ T506] usb 1-1: Product: syz [ 59.754414][ T506] usb 1-1: Manufacturer: syz [ 59.759080][ T506] usb 1-1: SerialNumber: syz [ 59.972303][ T506] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 13 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 59.985229][ T506] usb 1-1: USB disconnect, device number 13 [ 59.991935][ T506] usblp0: removed [ 60.495822][ T1761] netlink: 28 bytes leftover after parsing attributes in process `syz.0.426'. [ 60.528401][ T1760] ------------[ cut here ]------------ [ 60.534060][ T1760] WARNING: CPU: 1 PID: 1760 at kernel/rcu/srcutree.c:664 cleanup_srcu_struct+0x3e9/0x4c0 [ 60.543934][ T1760] Modules linked in: [ 60.547936][ T1760] CPU: 1 UID: 0 PID: 1760 Comm: syz.0.426 Not tainted syzkaller #0 1976820a860199aae9d2abf4727fc3b97aa7bbea [ 60.559460][ T1760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 60.569569][ T1760] RIP: 0010:cleanup_srcu_struct+0x3e9/0x4c0 [ 60.575607][ T1760] Code: 00 48 8b 5d a0 74 08 48 89 df e8 c2 4e 6e 00 48 c7 03 00 00 00 00 48 83 c4 40 5b 41 5c 41 5d 41 5e 41 5f 5d e9 18 e0 20 04 cc <0f> 0b eb e8 0f 0b eb e4 0f 0b eb e0 0f 0b eb 0e 0f 0b 4c 8b 75 d0 [ 60.595304][ T1760] RSP: 0018:ffffc9001085fc88 EFLAGS: 00010202 [ 60.601406][ T1760] RAX: 1ffffd1ffff85c1a RBX: ffffc900104728e8 RCX: ffffffff816dc9a9 [ 60.609424][ T1760] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffe8ffffc2e0d0 [ 60.617525][ T1760] RBP: ffffc9001085fcf0 R08: ffffe8ffffc2e0d7 R09: 1ffffd1ffff85c1a [ 60.625561][ T1760] R10: dffffc0000000000 R11: fffff91ffff85c1b R12: dffffc0000000000 [ 60.633788][ T1760] R13: dffffc0000000000 R14: 0000000000000000 R15: ffffe8ffffc2e0d0 [ 60.641860][ T1760] FS: 0000555559b5d500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 [ 60.650963][ T1760] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 60.657587][ T1760] CR2: 000000110c2f3771 CR3: 000000011ac84000 CR4: 00000000003526b0 [ 60.665593][ T1760] Call Trace: [ 60.668937][ T1760] [ 60.671953][ T1760] kvm_put_kvm+0x1100/0x12b0 [ 60.676610][ T1760] ? __cfi_kvm_vm_release+0x10/0x10 [ 60.681933][ T1760] kvm_vm_release+0x47/0x70 [ 60.686479][ T1760] __fput+0x1fe/0xa00 [ 60.690469][ T1760] ? __cfi__raw_spin_lock_irq+0x10/0x10 [ 60.696049][ T1760] ____fput+0x20/0x30 [ 60.700046][ T1760] task_work_run+0x1e3/0x250 [ 60.704786][ T1760] ? __cfi_task_work_run+0x10/0x10 [ 60.709900][ T1760] ? __kasan_check_write+0x18/0x20 [ 60.715070][ T1760] resume_user_mode_work+0x36/0x50 [ 60.720272][ T1760] syscall_exit_to_user_mode+0x64/0xb0 [ 60.725845][ T1760] do_syscall_64+0x64/0xf0 [ 60.730280][ T1760] ? clear_bhb_loop+0x50/0xa0 [ 60.735034][ T1760] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 60.741125][ T1760] RIP: 0033:0x7f5be858ebe9 [ 60.745569][ T1760] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 60.765378][ T1760] RSP: 002b:00007ffec83db158 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 60.774023][ T1760] RAX: 0000000000000000 RBX: 000000000000ec34 RCX: 00007f5be858ebe9 [ 60.782035][ T1760] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 60.790165][ T1760] RBP: 00007f5be87c7da0 R08: 0000000000000001 R09: 0000000fc83db44f [ 60.798178][ T1760] R10: 0000001b2dd20000 R11: 0000000000000246 R12: 00007f5be87c5fac [ 60.806182][ T1760] R13: 00007f5be87c5fa0 R14: ffffffffffffffff R15: 00007ffec83db270 [ 60.814205][ T1760] [ 60.817218][ T1760] ---[ end trace 0000000000000000 ]---