x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:42 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x870) [ 359.082193][T27602] binder: 27597:27602 unknown command 0 [ 359.094201][T27602] binder: 27597:27602 ioctl c0306201 20000240 returned -22 [ 359.114174][T27608] binder: 27597:27608 unknown command 0 [ 359.125533][T27608] binder: 27597:27608 ioctl c0306201 20000240 returned -22 23:09:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:42 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:42 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7e00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:42 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:42 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:42 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x888) [ 359.215670][T27616] binder: 27615:27616 unknown command 0 [ 359.236095][T27616] binder: 27615:27616 ioctl c0306201 20000240 returned -22 23:09:42 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 359.307516][T27629] binder: 27615:27629 unknown command 0 [ 359.328049][T27629] binder: 27615:27629 ioctl c0306201 20000240 returned -22 23:09:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x263044000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:42 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7e01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:42 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7a00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x8a0) 23:09:43 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 359.442667][T27641] binder: 27639:27641 unknown command 0 23:09:43 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7a01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 359.511536][T27641] binder: 27639:27641 ioctl c0306201 20000240 returned -22 [ 359.549162][T27655] binder: 27639:27655 unknown command 0 23:09:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 359.556241][T27655] binder: 27639:27655 ioctl c0306201 20000240 returned -22 23:09:43 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7f00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x8b8) [ 359.613502][T27664] binder: 27661:27664 unknown command 0 [ 359.625671][T27664] binder: 27661:27664 ioctl c0306201 20000240 returned -22 [ 359.681743][T27665] binder: 27661:27665 unknown command 0 23:09:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x363084000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:43 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7b00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 359.733562][T27665] binder: 27661:27665 ioctl c0306201 20000240 returned -22 23:09:43 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7f01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x8d0) [ 359.819212][T27682] binder: 27679:27682 unknown command 0 [ 359.832653][T27682] binder: 27679:27682 ioctl c0306201 20000240 returned -22 [ 359.855960][T27686] binder: 27679:27686 unknown command 0 23:09:43 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7b01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 359.885814][T27686] binder: 27679:27686 ioctl c0306201 20000240 returned -22 23:09:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:43 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 360.005240][T27704] binder: 27702:27704 unknown command 0 [ 360.021939][T27704] binder: 27702:27704 ioctl c0306201 20000240 returned -22 [ 360.044592][T27710] binder: 27702:27710 unknown command 0 [ 360.051411][T27710] binder: 27702:27710 ioctl c0306201 20000240 returned -22 23:09:43 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x8e8) 23:09:43 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7c00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x463044000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:43 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 360.192863][T27722] binder: 27717:27722 unknown command 0 [ 360.209278][T27722] binder: 27717:27722 ioctl c0306201 20000240 returned -22 23:09:43 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x900) [ 360.247091][T27732] binder: 27717:27732 unknown command 0 [ 360.265893][T27732] binder: 27717:27732 ioctl c0306201 20000240 returned -22 23:09:43 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7c01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:43 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:43 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x918) [ 360.437748][T27744] binder: 27743:27744 unknown command 0 [ 360.477676][T27744] binder: 27743:27744 ioctl c0306201 20000240 returned -22 23:09:44 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7d00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 360.499877][T27744] binder: BINDER_SET_CONTEXT_MGR already set [ 360.516833][T27762] binder: 27743:27762 unknown command 0 [ 360.524158][T27744] binder: 27743:27744 ioctl 40046207 0 returned -16 23:09:44 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x930) [ 360.547859][T27762] binder: 27743:27762 ioctl c0306201 20000240 returned -22 23:09:44 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:44 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7d01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8a00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 360.703877][T27781] binder: 27780:27781 unknown command 0 [ 360.719560][T27781] binder: 27780:27781 ioctl c0306201 20000240 returned -22 23:09:44 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x948) 23:09:44 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 360.774508][T27784] binder: 27780:27784 unknown command 0 23:09:44 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7e00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8a01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 360.826926][T27784] binder: 27780:27784 ioctl c0306201 20000240 returned -22 23:09:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:44 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x960) 23:09:44 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8b00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7e01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 360.949849][T27808] binder: 27807:27808 unknown command 0 [ 360.956688][T27808] binder: 27807:27808 ioctl c0306201 20000240 returned -22 [ 360.970008][T27809] binder: 27807:27809 unknown command 0 [ 360.975841][T27809] binder: 27807:27809 ioctl c0306201 20000240 returned -22 23:09:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x763044000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:44 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:44 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x978) [ 361.122731][T27828] binder: 27824:27828 unknown command 0 [ 361.128628][T27828] binder: 27824:27828 ioctl c0306201 20000240 returned -22 [ 361.139785][T27829] binder: 27824:27829 unknown command 0 [ 361.145565][T27829] binder: 27824:27829 ioctl c0306201 20000240 returned -22 23:09:44 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7f00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8b01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 361.215211][T27832] binder: 27831:27832 unknown command 0 [ 361.224755][T27832] binder: 27831:27832 ioctl c0306201 20000240 returned -22 23:09:44 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x863104000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 361.264080][T27833] binder: 27831:27833 unknown command 0 [ 361.299867][T27833] binder: 27831:27833 ioctl c0306201 20000240 returned -22 23:09:44 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8c00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:44 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x990) 23:09:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x963104000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 361.371387][T27851] binder: 27850:27851 unknown command 0 [ 361.377369][T27851] binder: 27850:27851 ioctl c0306201 20000240 returned -22 [ 361.389271][T27852] binder: 27850:27852 unknown command 0 [ 361.395064][T27852] binder: 27850:27852 ioctl c0306201 20000240 returned -22 23:09:45 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7f01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 361.471170][T27857] binder: 27853:27857 unknown command 0 [ 361.478442][T27857] binder: 27853:27857 ioctl c0306201 20000240 returned -22 23:09:45 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8c01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 361.512998][T27861] binder: 27853:27861 unknown command 0 [ 361.551907][T27861] binder: 27853:27861 ioctl c0306201 20000240 returned -22 23:09:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:45 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x9a8) 23:09:45 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 361.625968][T27877] binder: 27876:27877 unknown command 0 [ 361.631860][T27877] binder: 27876:27877 ioctl c0306201 20000240 returned -22 23:09:45 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8d00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 361.701051][T27878] binder: 27876:27878 unknown command 0 [ 361.711395][T27878] binder: 27876:27878 ioctl c0306201 20000240 returned -22 23:09:45 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0xa63084000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:45 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x9c0) [ 361.833721][T27898] binder: 27897:27898 unknown command 0 [ 361.860537][T27898] binder: 27897:27898 ioctl c0306201 20000240 returned -22 23:09:45 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8d01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 361.924458][T27904] binder: 27897:27904 unknown command 0 [ 361.943937][T27904] binder: 27897:27904 ioctl c0306201 20000240 returned -22 23:09:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0xb63000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:45 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8e00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x9d8) 23:09:45 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 362.037343][T27921] binder: 27919:27921 unknown command 0 [ 362.043094][T27921] binder: 27919:27921 ioctl c0306201 20000240 returned -22 [ 362.053957][T27924] binder: 27919:27924 unknown command 0 [ 362.069883][T27924] binder: 27919:27924 ioctl c0306201 20000240 returned -22 23:09:45 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0xc63000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:45 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x9f0) 23:09:45 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8e01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 362.221185][T27941] binder: 27940:27941 unknown command 0 [ 362.232581][T27941] binder: 27940:27941 ioctl c0306201 20000240 returned -22 [ 362.244128][T27944] binder: 27940:27944 unknown command 0 [ 362.252650][T27944] binder: 27940:27944 ioctl c0306201 20000240 returned -22 23:09:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0xd63000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:45 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:45 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8f00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xa08) [ 362.408371][T27960] binder: 27956:27960 unknown command 0 [ 362.424073][T27960] binder: 27956:27960 ioctl c0306201 20000240 returned -22 23:09:46 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 362.476401][T27968] binder: 27956:27968 unknown command 0 [ 362.503944][T27968] binder: 27956:27968 ioctl c0306201 20000240 returned -22 23:09:46 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8f01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0xe630c4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:46 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 362.649305][T27990] binder: 27987:27990 unknown command 0 [ 362.654922][T27990] binder: 27987:27990 ioctl c0306201 20000240 returned -22 [ 362.683860][T27991] binder: 27987:27991 unknown command 0 23:09:46 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xa20) 23:09:46 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 362.694882][T27991] binder: 27987:27991 ioctl c0306201 20000240 returned -22 23:09:46 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0xf630c4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:46 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xa38) 23:09:46 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 362.843213][T28007] binder: 28006:28007 unknown command 0 [ 362.855381][T28007] binder: 28006:28007 ioctl c0306201 20000240 returned -22 [ 362.887463][T28007] binder: BINDER_SET_CONTEXT_MGR already set [ 362.898880][T28007] binder: 28006:28007 ioctl 40046207 0 returned -16 23:09:46 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7a00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 362.928733][T28017] binder: 28006:28017 unknown command 0 [ 362.948562][T28017] binder: 28006:28017 ioctl c0306201 20000240 returned -22 23:09:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x1063084000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:46 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xa50) 23:09:46 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7a01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 363.112319][T28038] binder: 28033:28038 unknown command 0 [ 363.129027][T28038] binder: 28033:28038 ioctl c0306201 20000240 returned -22 [ 363.140715][T28040] binder: 28033:28040 unknown command 0 [ 363.146976][T28040] binder: 28033:28040 ioctl c0306201 20000240 returned -22 23:09:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x1163484000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:46 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xa68) 23:09:46 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7b00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x1200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:46 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8a00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 363.321020][T28056] binder: 28050:28056 unknown command 0 [ 363.330100][T28056] binder: 28050:28056 ioctl c0306201 20000240 returned -22 [ 363.344579][T28067] binder: 28050:28067 unknown command 0 [ 363.350366][T28067] binder: 28050:28067 ioctl c0306201 20000240 returned -22 23:09:46 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7b01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 363.406501][T28069] binder: 28068:28069 unknown command 0 [ 363.412111][T28069] binder: 28068:28069 ioctl c0306201 20000240 returned -22 23:09:47 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xa80) 23:09:47 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 363.461038][T28072] binder: 28068:28072 unknown command 0 [ 363.483828][T28072] binder: 28068:28072 ioctl c0306201 20000240 returned -22 23:09:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x1263484000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:47 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8a01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7c00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 363.583876][T28089] binder: 28088:28089 unknown command 0 [ 363.589800][T28089] binder: 28088:28089 ioctl c0306201 20000240 returned -22 [ 363.602433][T28090] binder: 28088:28090 unknown command 0 [ 363.609549][T28090] binder: 28088:28090 ioctl c0306201 20000240 returned -22 23:09:47 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xa98) 23:09:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:47 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8b00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7c01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xab0) [ 363.791892][T28109] binder: 28103:28109 unknown command 0 [ 363.805744][T28109] binder: 28103:28109 ioctl c0306201 20000240 returned -22 23:09:47 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x4000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 363.889904][T28117] binder: 28103:28117 unknown command 0 [ 363.913899][T28117] binder: 28103:28117 ioctl c0306201 20000240 returned -22 23:09:47 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7d00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8b01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 363.974030][T28129] binder: 28128:28129 unknown command 0 [ 363.980364][T28129] binder: 28128:28129 ioctl c0306201 20000240 returned -22 [ 363.992310][T28130] binder: 28128:28130 unknown command 0 [ 363.998402][T28130] binder: 28128:28130 ioctl c0306201 20000240 returned -22 23:09:47 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xac8) 23:09:47 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 364.043079][T28132] binder: 28131:28132 unknown command 0 [ 364.058042][T28132] binder: 28131:28132 ioctl c0306201 20000240 returned -22 23:09:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 364.123616][T28144] binder: 28131:28144 unknown command 0 [ 364.149097][T28144] binder: 28131:28144 ioctl c0306201 20000240 returned -22 23:09:47 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8c00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7d01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 364.202588][T28153] binder: 28152:28153 unknown command 0 23:09:47 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:47 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xae0) [ 364.249549][T28153] binder: 28152:28153 ioctl c0306201 20000240 returned -22 23:09:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:47 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7e00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 364.311109][T28163] binder: 28152:28163 unknown command 0 [ 364.331076][T28163] binder: 28152:28163 ioctl c0306201 20000240 returned -22 23:09:47 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8c01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xaf8) [ 364.393901][T28174] binder: 28172:28174 unknown command 0 [ 364.400107][T28174] binder: 28172:28174 ioctl c0306201 20000240 returned -22 [ 364.432202][T28178] binder: 28172:28178 unknown command 0 23:09:48 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7e01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 364.488394][T28178] binder: 28172:28178 ioctl c0306201 20000240 returned -22 23:09:48 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8d00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:48 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xb10) [ 364.649481][T28200] binder: 28197:28200 unknown command 0 [ 364.655190][T28200] binder: 28197:28200 ioctl c0306201 20000240 returned -22 [ 364.668014][T28202] binder: 28197:28202 unknown command 0 [ 364.673729][T28202] binder: 28197:28202 ioctl c0306201 20000240 returned -22 23:09:48 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8d01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7f00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 364.750901][T28204] binder: 28203:28204 unknown command 0 [ 364.790586][T28204] binder: 28203:28204 ioctl c0306201 20000240 returned -22 23:09:48 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xb28) 23:09:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 364.851864][T28219] binder: 28203:28219 unknown command 0 [ 364.861660][T28219] binder: 28203:28219 ioctl c0306201 20000240 returned -22 23:09:48 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8e00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7f01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xb40) [ 365.000415][T28228] binder: 28227:28228 unknown command 0 [ 365.031573][T28228] binder: 28227:28228 ioctl c0306201 20000240 returned -22 23:09:48 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8e01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 365.063792][T28228] binder: BINDER_SET_CONTEXT_MGR already set [ 365.079432][T28228] binder: 28227:28228 ioctl 40046207 0 returned -16 [ 365.089795][T28247] binder: 28227:28247 unknown command 0 [ 365.098883][T28247] binder: 28227:28247 ioctl c0306201 20000240 returned -22 23:09:48 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:48 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xb58) 23:09:48 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 365.253041][T28265] binder: 28264:28265 unknown command 0 [ 365.265820][T28265] binder: 28264:28265 ioctl c0306201 20000240 returned -22 [ 365.281982][T28268] binder: 28264:28268 unknown command 0 23:09:48 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8f00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0xff00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 365.302204][T28268] binder: 28264:28268 ioctl c0306201 20000240 returned -22 23:09:48 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xb70) 23:09:48 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:49 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8f01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 365.448370][T28287] binder: 28282:28287 unknown command 0 [ 365.454996][T28287] binder: 28282:28287 ioctl c0306201 20000240 returned -22 [ 365.473696][T28292] binder: 28282:28292 unknown command 0 [ 365.479839][T28292] binder: 28282:28292 ioctl c0306201 20000240 returned -22 23:09:49 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8a00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xb88) 23:09:49 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 365.527093][T28297] binder: 28296:28297 unknown command 0 [ 365.532921][T28297] binder: 28296:28297 ioctl c0306201 20000240 returned -22 23:09:49 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 365.624582][T28304] binder: 28296:28304 unknown command 0 [ 365.655437][T28304] binder: 28296:28304 ioctl c0306201 20000240 returned -22 23:09:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:49 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8a01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xba0) 23:09:49 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 365.784873][T28322] binder: 28321:28322 unknown command 0 [ 365.791411][T28322] binder: 28321:28322 ioctl c0306201 20000240 returned -22 [ 365.803257][T28329] binder: 28321:28329 unknown command 0 [ 365.809069][T28329] binder: 28321:28329 ioctl c0306201 20000240 returned -22 23:09:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:49 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8b00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xbb8) [ 365.982162][T28348] binder: 28345:28348 unknown command 0 [ 365.998928][T28348] binder: 28345:28348 ioctl c0306201 20000240 returned -22 [ 366.018611][T28351] binder: 28345:28351 unknown command 0 [ 366.024421][T28351] binder: 28345:28351 ioctl c0306201 20000240 returned -22 23:09:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:49 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8b01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 366.116074][T28361] binder: 28360:28361 unknown command 0 [ 366.122180][T28361] binder: 28360:28361 ioctl c0306201 20000240 returned -22 23:09:49 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xbd0) [ 366.156973][T28368] binder: 28360:28368 unknown command 0 [ 366.165747][T28368] binder: 28360:28368 ioctl c0306201 20000240 returned -22 23:09:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:49 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8c00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:49 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 366.305106][T28382] binder: 28380:28382 unknown command 0 [ 366.314714][T28382] binder: 28380:28382 ioctl c0306201 20000240 returned -22 [ 366.327781][T28389] binder: 28380:28389 unknown command 0 [ 366.333550][T28389] binder: 28380:28389 ioctl c0306201 20000240 returned -22 23:09:49 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xbe8) 23:09:49 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:49 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8c01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9a00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:50 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xc00) [ 366.480009][T28398] binder: 28397:28398 unknown command 0 [ 366.491891][T28398] binder: 28397:28398 ioctl c0306201 20000240 returned -22 [ 366.509372][T28407] binder: 28397:28407 unknown command 0 [ 366.515020][T28407] binder: 28397:28407 ioctl c0306201 20000240 returned -22 23:09:50 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8d00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 366.629078][T28414] binder: 28413:28414 unknown command 0 [ 366.639694][T28414] binder: 28413:28414 ioctl c0306201 20000240 returned -22 [ 366.651962][T28420] binder: 28413:28420 unknown command 0 [ 366.660825][T28420] binder: 28413:28420 ioctl c0306201 20000240 returned -22 23:09:50 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9a01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xc18) 23:09:50 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 366.764105][T28433] binder: 28430:28433 unknown command 0 [ 366.774185][T28433] binder: 28430:28433 ioctl c0306201 20000240 returned -22 23:09:50 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8d01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 366.819922][T28439] binder: 28430:28439 unknown command 0 23:09:50 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9b00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 366.864079][T28439] binder: 28430:28439 ioctl c0306201 20000240 returned -22 23:09:50 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xc30) 23:09:50 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8e00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 366.948369][T28455] binder: 28452:28455 unknown command 0 [ 366.955192][T28455] binder: 28452:28455 ioctl c0306201 20000240 returned -22 23:09:50 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9b01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 367.054827][T28467] binder: 28452:28467 unknown command 0 [ 367.071626][T28467] binder: 28452:28467 ioctl c0306201 20000240 returned -22 23:09:50 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xc48) 23:09:50 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8e01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9c00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 367.122466][T28476] binder: 28475:28476 unknown command 0 [ 367.130484][T28476] binder: 28475:28476 ioctl c0306201 20000240 returned -22 [ 367.155152][T28477] binder: 28475:28477 unknown command 0 23:09:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 367.220795][T28477] binder: 28475:28477 ioctl c0306201 20000240 returned -22 23:09:50 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8f00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9c01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 367.282995][T28497] binder: 28496:28497 unknown command 0 [ 367.289537][T28497] binder: 28496:28497 ioctl c0306201 20000240 returned -22 [ 367.318549][T28498] binder: 28496:28498 unknown command 0 23:09:50 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:50 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xc60) [ 367.365005][T28498] binder: 28496:28498 ioctl c0306201 20000240 returned -22 23:09:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:51 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9d00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8f01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 367.483773][T28518] binder: 28517:28518 unknown command 0 [ 367.491689][T28518] binder: 28517:28518 ioctl c0306201 20000240 returned -22 [ 367.506805][T28519] binder: 28517:28519 unknown command 0 [ 367.512601][T28519] binder: 28517:28519 ioctl c0306201 20000240 returned -22 23:09:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:51 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xc78) 23:09:51 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9d01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 367.646048][T28533] binder: 28532:28533 unknown command 0 [ 367.665465][T28533] binder: 28532:28533 ioctl c0306201 20000240 returned -22 23:09:51 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xc90) [ 367.707337][T28540] binder: 28532:28540 unknown command 0 [ 367.718678][T28540] binder: 28532:28540 ioctl c0306201 20000240 returned -22 23:09:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:51 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9e00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 367.889259][T28559] binder: 28558:28559 unknown command 0 [ 367.894866][T28559] binder: 28558:28559 ioctl c0306201 20000240 returned -22 [ 367.909955][T28563] binder: 28558:28563 unknown command 0 [ 367.915906][T28563] binder: 28558:28563 ioctl c0306201 20000240 returned -22 23:09:51 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xca8) 23:09:51 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:51 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9e01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 368.067513][T28581] binder: 28580:28581 unknown command 0 [ 368.074259][T28581] binder: 28580:28581 ioctl c0306201 20000240 returned -22 [ 368.101701][T28583] binder: 28580:28583 unknown command 0 23:09:51 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xcc0) 23:09:51 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9f00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 368.132709][T28583] binder: 28580:28583 ioctl c0306201 20000240 returned -22 23:09:51 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 368.222131][T28594] binder: 28593:28594 unknown command 0 [ 368.248196][T28594] binder: 28593:28594 ioctl c0306201 20000240 returned -22 23:09:51 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 368.284508][T28603] binder: 28593:28603 unknown command 0 [ 368.301597][T28603] binder: 28593:28603 ioctl c0306201 20000240 returned -22 23:09:51 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xcd8) 23:09:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:51 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9f01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8a00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:51 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 368.420728][T28612] binder: 28611:28612 unknown command 0 [ 368.464301][T28612] binder: 28611:28612 ioctl c0306201 20000240 returned -22 [ 368.490986][T28625] binder: 28611:28625 unknown command 0 23:09:52 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8a01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 368.508317][T28625] binder: 28611:28625 ioctl c0306201 20000240 returned -22 23:09:52 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:52 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xcf0) 23:09:52 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 368.654007][T28636] binder: 28634:28636 unknown command 0 [ 368.659911][T28636] binder: 28634:28636 ioctl c0306201 20000240 returned -22 [ 368.690113][T28648] binder: 28634:28648 unknown command 0 23:09:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:52 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 368.697560][T28648] binder: 28634:28648 ioctl c0306201 20000240 returned -22 23:09:52 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8b00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 368.741901][T28652] binder: 28651:28652 unknown command 0 [ 368.747743][T28652] binder: 28651:28652 ioctl c0306201 20000240 returned -22 [ 368.759486][T28655] binder: 28651:28655 unknown command 0 [ 368.765193][T28655] binder: 28651:28655 ioctl c0306201 20000240 returned -22 23:09:52 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xd08) 23:09:52 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 368.894867][T28670] binder: 28665:28670 unknown command 0 [ 368.900666][T28670] binder: 28665:28670 ioctl c0306201 20000240 returned -22 [ 368.930688][T28673] binder: 28665:28673 unknown command 0 [ 368.936533][T28673] binder: 28665:28673 ioctl c0306201 20000240 returned -22 23:09:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:52 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8b01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xd20) 23:09:52 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8c00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 369.062402][T28685] binder: 28684:28685 unknown command 0 [ 369.079360][T28685] binder: 28684:28685 ioctl c0306201 20000240 returned -22 [ 369.124653][T28685] binder: BINDER_SET_CONTEXT_MGR already set [ 369.155049][T28685] binder: 28684:28685 ioctl 40046207 0 returned -16 [ 369.155716][T28705] binder: 28684:28705 unknown command 0 23:09:52 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xb63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:52 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xd38) [ 369.177412][T28705] binder: 28684:28705 ioctl c0306201 20000240 returned -22 23:09:52 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8c01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:52 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9a00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 369.281098][T28711] binder: 28710:28711 unknown command 0 [ 369.286855][T28711] binder: 28710:28711 ioctl c0306201 20000240 returned -22 [ 369.303179][T28715] binder: 28710:28715 unknown command 0 [ 369.319845][T28715] binder: 28710:28715 ioctl c0306201 20000240 returned -22 23:09:52 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xd50) 23:09:52 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xc63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:53 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9a01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 369.478966][T28734] binder: 28733:28734 unknown command 0 [ 369.489211][T28734] binder: 28733:28734 ioctl c0306201 20000240 returned -22 23:09:53 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8d00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xd68) 23:09:53 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xd63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 369.576106][T28741] binder: 28733:28741 unknown command 0 [ 369.582070][T28741] binder: 28733:28741 ioctl c0306201 20000240 returned -22 23:09:53 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8d01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xd80) 23:09:53 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9b00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 369.648378][T28754] binder: 28753:28754 unknown command 0 [ 369.654020][T28754] binder: 28753:28754 ioctl c0306201 20000240 returned -22 23:09:53 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x1200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 369.748807][T28758] binder: 28753:28758 unknown command 0 [ 369.783373][T28758] binder: 28753:28758 ioctl c0306201 20000240 returned -22 23:09:53 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xd98) [ 369.835457][T28774] binder: 28773:28774 unknown command 0 [ 369.841170][T28774] binder: 28773:28774 ioctl c0306201 20000240 returned -22 [ 369.852362][T28776] binder: 28773:28776 unknown command 0 [ 369.858341][T28776] binder: 28773:28776 ioctl c0306201 20000240 returned -22 23:09:53 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9b01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8e00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:53 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xdb0) 23:09:53 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 370.046284][T28792] binder: 28789:28792 unknown command 0 [ 370.054528][T28792] binder: 28789:28792 ioctl c0306201 20000240 returned -22 [ 370.082460][T28799] binder: 28789:28799 unknown command 0 23:09:53 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9c00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8e01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 370.102546][T28799] binder: 28789:28799 ioctl c0306201 20000240 returned -22 23:09:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:53 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xdc8) 23:09:53 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9c01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 370.236436][T28812] binder: 28806:28812 unknown command 0 [ 370.262381][T28812] binder: 28806:28812 ioctl c0306201 20000240 returned -22 23:09:53 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8f00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:53 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xde0) 23:09:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 370.321005][T28822] binder: 28806:28822 unknown command 0 [ 370.328563][T28822] binder: 28806:28822 ioctl c0306201 20000240 returned -22 23:09:53 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9d00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8f01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 370.492953][T28840] binder: 28839:28840 unknown command 0 [ 370.515471][T28840] binder: 28839:28840 ioctl c0306201 20000240 returned -22 23:09:54 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xdf8) 23:09:54 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 370.544074][T28846] binder: 28839:28846 unknown command 0 [ 370.582991][T28846] binder: 28839:28846 ioctl c0306201 20000240 returned -22 23:09:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:54 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9d01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xe10) [ 370.674290][T28860] binder: 28859:28860 unknown command 0 [ 370.680247][T28860] binder: 28859:28860 ioctl c0306201 20000240 returned -22 [ 370.693013][T28864] binder: 28859:28864 unknown command 0 [ 370.704496][T28864] binder: 28859:28864 ioctl c0306201 20000240 returned -22 23:09:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:54 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9e00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xe28) [ 370.807004][T28877] binder: 28876:28877 unknown command 0 [ 370.812789][T28877] binder: 28876:28877 ioctl c0306201 20000240 returned -22 [ 370.825131][T28878] binder: 28876:28878 unknown command 0 [ 370.846494][T28878] binder: 28876:28878 ioctl c0306201 20000240 returned -22 23:09:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x630b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:54 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 370.946054][T28892] binder: 28889:28892 unknown command 0 [ 370.951825][T28892] binder: 28889:28892 ioctl c0306201 20000240 returned -22 23:09:54 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9e01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 370.998323][T28897] binder: 28889:28897 unknown command 0 [ 371.013682][T28897] binder: 28889:28897 ioctl c0306201 20000240 returned -22 23:09:54 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xe40) 23:09:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x630c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:54 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 371.145143][T28912] binder: 28911:28912 unknown command 0 [ 371.171247][T28912] binder: 28911:28912 ioctl c0306201 20000240 returned -22 23:09:54 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9f00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xe58) 23:09:54 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 371.192941][T28924] binder: 28911:28924 unknown command 0 [ 371.198620][T28924] binder: 28911:28924 ioctl c0306201 20000240 returned -22 23:09:54 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x630d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:54 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9a00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:54 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9f01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 371.349589][T28935] binder: 28933:28935 unknown command 0 [ 371.363892][T28935] binder: 28933:28935 ioctl c0306201 20000240 returned -22 23:09:54 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xe70) [ 371.397167][T28946] binder: 28933:28946 unknown command 0 [ 371.403101][T28946] binder: 28933:28946 ioctl c0306201 20000240 returned -22 23:09:55 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:55 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9a01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 371.544919][T28959] binder: 28955:28959 unknown command 0 [ 371.555991][T28959] binder: 28955:28959 ioctl c0306201 20000240 returned -22 23:09:55 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xe88) 23:09:55 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9b00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 371.619278][T28966] binder: 28955:28966 unknown command 0 [ 371.624887][T28966] binder: 28955:28966 ioctl c0306201 20000240 returned -22 23:09:55 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9b01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 371.741757][T28983] binder: 28982:28983 unknown command 0 [ 371.747797][T28983] binder: 28982:28983 ioctl c0306201 20000240 returned -22 [ 371.762656][T28984] binder: 28982:28984 unknown command 0 [ 371.771608][T28984] binder: 28982:28984 ioctl c0306201 20000240 returned -22 23:09:55 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xea0) 23:09:55 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 371.895687][T28998] binder: 28991:28998 unknown command 0 [ 371.908269][T28998] binder: 28991:28998 ioctl c0306201 20000240 returned -22 [ 371.924421][T29003] binder: 28991:29003 unknown command 0 [ 371.930676][T29003] binder: 28991:29003 ioctl c0306201 20000240 returned -22 23:09:55 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9c00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xeb8) 23:09:55 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 372.025451][T29007] binder: 29005:29007 unknown command 0 [ 372.058089][T29007] binder: 29005:29007 ioctl c0306201 20000240 returned -22 23:09:55 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 372.109752][T29007] binder: BINDER_SET_CONTEXT_MGR already set [ 372.128717][T29020] binder: 29005:29020 unknown command 0 [ 372.136047][T29020] binder: 29005:29020 ioctl c0306201 20000240 returned -22 [ 372.142356][T29007] binder: 29005:29007 ioctl 40046207 0 returned -16 23:09:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:55 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9c01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xed0) [ 372.210261][T29032] binder: 29031:29032 unknown command 0 [ 372.216397][T29032] binder: 29031:29032 ioctl c0306201 20000240 returned -22 [ 372.229026][T29033] binder: 29031:29033 unknown command 0 [ 372.234733][T29033] binder: 29031:29033 ioctl c0306201 20000240 returned -22 23:09:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x634040, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:55 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:56 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaa00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 372.398937][T29047] binder: 29044:29047 unknown command 0 [ 372.404945][T29047] binder: 29044:29047 ioctl c0306201 20000240 returned -22 [ 372.420483][T29053] binder: 29044:29053 unknown command 0 [ 372.427567][T29053] binder: 29044:29053 ioctl c0306201 20000240 returned -22 23:09:56 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9d00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xee8) 23:09:56 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaa01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 372.571722][T29063] binder: 29057:29063 unknown command 0 [ 372.594845][T29063] binder: 29057:29063 ioctl c0306201 20000240 returned -22 23:09:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x1634040, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 372.618030][T29069] binder: 29057:29069 unknown command 0 [ 372.623644][T29069] binder: 29057:29069 ioctl c0306201 20000240 returned -22 23:09:56 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9d01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 372.693065][T29077] binder: 29074:29077 unknown command 0 [ 372.704110][T29077] binder: 29074:29077 ioctl c0306201 20000240 returned -22 23:09:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 372.738054][T29082] binder: 29074:29082 unknown command 0 [ 372.752850][T29082] binder: 29074:29082 ioctl c0306201 20000240 returned -22 23:09:56 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xab00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xf00) [ 372.789150][T29089] binder: 29088:29089 unknown command 0 [ 372.794997][T29089] binder: 29088:29089 ioctl c0306201 20000240 returned -22 [ 372.819532][T29091] binder: 29088:29091 unknown command 0 23:09:56 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 372.835730][T29091] binder: 29088:29091 ioctl c0306201 20000240 returned -22 23:09:56 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9e00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x2630440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:56 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xab01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 372.981408][T29108] binder: 29107:29108 unknown command 0 [ 372.987304][T29108] binder: 29107:29108 ioctl c0306201 20000240 returned -22 [ 373.020071][T29112] binder: 29107:29112 unknown command 0 23:09:56 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xf18) 23:09:56 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9e01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 373.029985][T29112] binder: 29107:29112 ioctl c0306201 20000240 returned -22 23:09:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:56 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xac00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xf30) 23:09:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x3630840, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:56 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9f00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 373.227479][T29129] binder: 29125:29129 unknown command 0 [ 373.235355][T29129] binder: 29125:29129 ioctl c0306201 20000240 returned -22 [ 373.256404][T29140] binder: 29125:29140 unknown command 0 [ 373.262300][T29140] binder: 29125:29140 ioctl c0306201 20000240 returned -22 23:09:56 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xac01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:56 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xf48) [ 373.350274][T29144] binder: 29141:29144 unknown command 0 [ 373.363931][T29144] binder: 29141:29144 ioctl c0306201 20000240 returned -22 [ 373.377802][T29147] binder: 29141:29147 unknown command 0 [ 373.383546][T29147] binder: 29141:29147 ioctl c0306201 20000240 returned -22 23:09:57 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9f01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:57 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xad00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 373.512057][T29166] binder: 29163:29166 unknown command 0 [ 373.525527][T29166] binder: 29163:29166 ioctl c0306201 20000240 returned -22 [ 373.547214][T29167] binder: 29163:29167 unknown command 0 23:09:57 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xf60) 23:09:57 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 373.573400][T29167] binder: 29163:29167 ioctl c0306201 20000240 returned -22 23:09:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x4630440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:57 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xad01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 373.703071][T29186] binder: 29185:29186 unknown command 0 [ 373.710741][T29186] binder: 29185:29186 ioctl c0306201 20000240 returned -22 [ 373.722098][T29188] binder: 29185:29188 unknown command 0 [ 373.727975][T29188] binder: 29185:29188 ioctl c0306201 20000240 returned -22 23:09:57 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:57 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xf78) 23:09:57 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 373.928909][T29203] binder: 29202:29203 unknown command 0 [ 373.934591][T29203] binder: 29202:29203 ioctl c0306201 20000240 returned -22 23:09:57 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xae00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xf90) 23:09:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 373.993126][T29214] binder: 29202:29214 unknown command 0 [ 374.001799][T29214] binder: 29202:29214 ioctl c0306201 20000240 returned -22 23:09:57 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 374.129747][T29225] binder: 29224:29225 unknown command 0 [ 374.142935][T29225] binder: 29224:29225 ioctl c0306201 20000240 returned -22 23:09:57 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xfa8) 23:09:57 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 374.185064][T29233] binder: 29224:29233 unknown command 0 [ 374.195112][T29233] binder: 29224:29233 ioctl c0306201 20000240 returned -22 23:09:57 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xae01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:57 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9a00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 374.331072][T29250] binder: 29247:29250 unknown command 0 [ 374.344016][T29250] binder: 29247:29250 ioctl c0306201 20000240 returned -22 23:09:57 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x7630440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:57 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xfc0) [ 374.375170][T29255] binder: 29247:29255 unknown command 0 [ 374.387299][T29255] binder: 29247:29255 ioctl c0306201 20000240 returned -22 23:09:58 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9a01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 374.564513][T29277] binder: 29274:29277 unknown command 0 [ 374.575439][T29277] binder: 29274:29277 ioctl c0306201 20000240 returned -22 [ 374.600284][T29277] binder: BINDER_SET_CONTEXT_MGR already set 23:09:58 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9b00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xfd8) [ 374.609311][T29277] binder: 29274:29277 ioctl 40046207 0 returned -16 [ 374.630063][T29284] binder: 29274:29284 unknown command 0 23:09:58 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9b01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 374.698316][T29284] binder: 29274:29284 ioctl c0306201 20000240 returned -22 23:09:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:58 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xff0) [ 374.814117][T29306] binder: 29305:29306 unknown command 0 [ 374.824202][T29306] binder: 29305:29306 ioctl c0306201 20000240 returned -22 23:09:58 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9c00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 374.864529][T29310] binder: 29305:29310 unknown command 0 [ 374.893891][T29310] binder: 29305:29310 ioctl c0306201 20000240 returned -22 23:09:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x8631040, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:58 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1008) 23:09:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x9631040, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 374.998049][T29325] binder: 29324:29325 unknown command 0 [ 375.005911][T29325] binder: 29324:29325 ioctl c0306201 20000240 returned -22 [ 375.033778][T29327] binder: 29324:29327 unknown command 0 [ 375.040824][T29327] binder: 29324:29327 ioctl c0306201 20000240 returned -22 23:09:58 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9c01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 375.115174][T29334] binder: 29333:29334 unknown command 0 [ 375.124656][T29334] binder: 29333:29334 ioctl c0306201 20000240 returned -22 [ 375.161206][T29336] binder: 29333:29336 unknown command 0 [ 375.168721][T29336] binder: 29333:29336 ioctl c0306201 20000240 returned -22 23:09:58 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1020) 23:09:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:58 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 375.292894][T29355] binder: 29354:29355 unknown command 0 23:09:58 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9d00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:58 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 375.334472][T29355] binder: 29354:29355 ioctl c0306201 20000240 returned -22 23:09:58 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1038) 23:09:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xa630840, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 375.380410][T29359] binder: 29354:29359 unknown command 0 [ 375.402644][T29359] binder: 29354:29359 ioctl c0306201 20000240 returned -22 23:09:59 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9d01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 375.544275][T29377] binder: 29374:29377 unknown command 0 [ 375.558599][T29377] binder: 29374:29377 ioctl c0306201 20000240 returned -22 23:09:59 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9e00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaa00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1050) 23:09:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xb630000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 375.616466][T29386] binder: 29374:29386 unknown command 0 [ 375.637104][T29386] binder: 29374:29386 ioctl c0306201 20000240 returned -22 23:09:59 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9e01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaa01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 375.814363][T29406] binder: 29399:29406 unknown command 0 [ 375.834125][T29406] binder: 29399:29406 ioctl c0306201 20000240 returned -22 [ 375.854300][T29413] binder: 29399:29413 unknown command 0 23:09:59 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1068) 23:09:59 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 375.890093][T29413] binder: 29399:29413 ioctl c0306201 20000240 returned -22 23:09:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xc630000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:59 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9f00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xab00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 376.009865][T29430] binder: 29429:29430 unknown command 0 [ 376.015670][T29430] binder: 29429:29430 ioctl c0306201 20000240 returned -22 [ 376.047808][T29431] binder: 29429:29431 unknown command 0 23:09:59 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1080) 23:09:59 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 376.057036][T29431] binder: 29429:29431 ioctl c0306201 20000240 returned -22 23:09:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xd630000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:59 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9f01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xab01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 376.199093][T29450] binder: 29447:29450 unknown command 0 [ 376.205356][T29450] binder: 29447:29450 ioctl c0306201 20000240 returned -22 [ 376.236766][T29454] binder: 29447:29454 unknown command 0 23:09:59 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1098) [ 376.242375][T29454] binder: 29447:29454 ioctl c0306201 20000240 returned -22 23:09:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xe630c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:09:59 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xac00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:09:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xf630c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:00 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x10b0) [ 376.384527][T29472] binder: 29466:29472 unknown command 0 [ 376.390225][T29472] binder: 29466:29472 ioctl c0306201 20000240 returned -22 [ 376.401972][T29474] binder: 29466:29474 unknown command 0 [ 376.407693][T29474] binder: 29466:29474 ioctl c0306201 20000240 returned -22 23:10:00 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xac01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x10630840, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 376.593259][T29485] binder: 29483:29485 unknown command 0 [ 376.611234][T29485] binder: 29483:29485 ioctl c0306201 20000240 returned -22 [ 376.628831][T29499] binder: 29483:29499 unknown command 0 [ 376.634665][T29499] binder: 29483:29499 ioctl c0306201 20000240 returned -22 23:10:00 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x10c8) 23:10:00 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xad00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 376.763407][T29508] binder: 29504:29508 unknown command 0 [ 376.796812][T29508] binder: 29504:29508 ioctl c0306201 20000240 returned -22 23:10:00 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x10e0) 23:10:00 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x11634840, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 376.850585][T29519] binder: 29504:29519 unknown command 0 [ 376.869704][T29519] binder: 29504:29519 ioctl c0306201 20000240 returned -22 23:10:00 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xad01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x10f8) 23:10:00 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 376.993279][T29530] binder: 29529:29530 unknown command 0 [ 377.014393][T29530] binder: 29529:29530 ioctl c0306201 20000240 returned -22 23:10:00 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x12000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:00 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xae00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 377.078923][T29543] binder: 29529:29543 unknown command 0 [ 377.092078][T29543] binder: 29529:29543 ioctl c0306201 20000240 returned -22 23:10:00 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1110) 23:10:00 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 377.148573][T29550] binder: 29549:29550 unknown command 0 [ 377.165745][T29550] binder: 29549:29550 ioctl c0306201 20000240 returned -22 23:10:00 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x12634840, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 377.237324][T29555] binder: 29549:29555 unknown command 0 [ 377.260997][T29555] binder: 29549:29555 ioctl c0306201 20000240 returned -22 23:10:00 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1128) [ 377.313935][T29571] binder: 29570:29571 unknown command 0 23:10:00 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xae01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:00 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 377.361611][T29571] binder: 29570:29571 ioctl c0306201 20000240 returned -22 [ 377.417682][T29571] binder: BINDER_SET_CONTEXT_MGR already set [ 377.442353][T29571] binder: 29570:29571 ioctl 40046207 0 returned -16 23:10:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 377.480614][T29586] binder: 29570:29586 unknown command 0 [ 377.488933][T29586] binder: 29570:29586 ioctl c0306201 20000240 returned -22 23:10:01 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1140) [ 377.522298][T29593] binder: 29592:29593 unknown command 0 [ 377.528252][T29593] binder: 29592:29593 ioctl c0306201 20000240 returned -22 [ 377.540233][T29594] binder: 29592:29594 unknown command 0 [ 377.555348][T29594] binder: 29592:29594 ioctl c0306201 20000240 returned -22 23:10:01 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaa00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:01 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x40046302, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:01 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaa01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 377.709949][T29612] binder: 29606:29612 unknown command 0 [ 377.716386][T29612] binder: 29606:29612 ioctl c0306201 20000240 returned -22 [ 377.729848][T29615] binder: 29606:29615 unknown command 0 [ 377.735973][T29615] binder: 29606:29615 ioctl c0306201 20000240 returned -22 23:10:01 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1158) [ 377.871928][T29623] binder: 29622:29623 unknown command 0 [ 377.893729][T29623] binder: 29622:29623 ioctl c0306201 20000240 returned -22 [ 377.909468][T29633] binder: 29622:29633 unknown command 0 [ 377.915192][T29633] binder: 29622:29633 ioctl c0306201 20000240 returned -22 23:10:01 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:01 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xab00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1170) [ 378.046488][T29643] binder: 29640:29643 unknown command 0 [ 378.052225][T29643] binder: 29640:29643 ioctl c0306201 20000240 returned -22 23:10:01 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x40046307, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 378.114247][T29652] binder: 29640:29652 unknown command 0 [ 378.136944][T29652] binder: 29640:29652 ioctl c0306201 20000240 returned -22 23:10:01 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xab01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1188) 23:10:01 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 378.298825][T29667] binder: 29664:29667 unknown command 0 [ 378.323264][T29667] binder: 29664:29667 ioctl c0306201 20000240 returned -22 23:10:01 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xac00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:01 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x11a0) 23:10:01 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xba00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 378.358744][T29681] binder: 29664:29681 unknown command 0 [ 378.383871][T29681] binder: 29664:29681 ioctl c0306201 20000240 returned -22 23:10:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x40086303, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:02 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xac01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x11b8) [ 378.564135][T29694] binder: 29693:29694 unknown command 0 [ 378.582023][T29694] binder: 29693:29694 ioctl c0306201 20000240 returned -22 23:10:02 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xba01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 378.614279][T29707] binder: 29693:29707 unknown command 0 [ 378.651595][T29707] binder: 29693:29707 ioctl c0306201 20000240 returned -22 23:10:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x4008630a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:02 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xad00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x11d0) [ 378.749567][T29715] binder: 29714:29715 unknown command 0 [ 378.793920][T29715] binder: 29714:29715 ioctl c0306201 20000240 returned -22 [ 378.821916][T29729] binder: 29714:29729 unknown command 0 23:10:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x40086310, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:02 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 378.847542][T29729] binder: 29714:29729 ioctl c0306201 20000240 returned -22 23:10:02 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xad01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 378.913721][T29736] binder: 29733:29736 unknown command 0 [ 378.936154][T29736] binder: 29733:29736 ioctl c0306201 20000240 returned -22 [ 378.951369][T29739] binder: 29733:29739 unknown command 0 23:10:02 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x11e8) [ 378.957144][T29739] binder: 29733:29739 ioctl c0306201 20000240 returned -22 23:10:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:02 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xae00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 379.103147][T29755] binder: 29753:29755 unknown command 0 [ 379.109398][T29755] binder: 29753:29755 ioctl c0306201 20000240 returned -22 [ 379.135193][T29759] binder: 29753:29759 unknown command 0 23:10:02 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x400c630f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 379.146270][T29759] binder: 29753:29759 ioctl c0306201 20000240 returned -22 23:10:02 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1200) 23:10:02 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 379.265245][T29767] binder: 29766:29767 unknown command 0 [ 379.283506][T29767] binder: 29766:29767 ioctl c0306201 20000240 returned -22 23:10:02 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xae01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:02 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 379.344083][T29781] binder: 29766:29781 unknown command 0 23:10:02 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1218) 23:10:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x40106308, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 379.386458][T29781] binder: 29766:29781 ioctl c0306201 20000240 returned -22 23:10:03 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 379.523446][T29800] binder: 29799:29800 unknown command 0 [ 379.530805][T29800] binder: 29799:29800 ioctl c0306201 20000240 returned -22 23:10:03 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1230) 23:10:03 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x40106309, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 379.609953][T29807] binder: 29799:29807 unknown command 0 [ 379.640931][T29807] binder: 29799:29807 ioctl c0306201 20000240 returned -22 23:10:03 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1248) [ 379.734871][T29822] binder: 29820:29822 unknown command 0 [ 379.771841][T29822] binder: 29820:29822 ioctl c0306201 20000240 returned -22 23:10:03 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x40406300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 379.828044][T29835] binder: 29820:29835 unknown command 0 [ 379.834131][T29835] binder: 29820:29835 ioctl c0306201 20000240 returned -22 23:10:03 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbe00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 379.894742][T29842] binder: 29841:29842 unknown command 0 [ 379.910023][T29842] binder: 29841:29842 ioctl c0306201 20000240 returned -22 23:10:03 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x40406301, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 379.940748][T29844] binder: 29841:29844 unknown command 0 [ 379.958174][T29844] binder: 29841:29844 ioctl c0306201 20000240 returned -22 23:10:03 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1260) 23:10:03 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbe01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 380.101290][T29862] binder: 29861:29862 unknown command 0 [ 380.109469][T29862] binder: 29861:29862 ioctl c0306201 20000240 returned -22 [ 380.128250][T29864] binder: 29861:29864 unknown command 0 [ 380.133871][T29864] binder: 29861:29864 ioctl c0306201 20000240 returned -22 23:10:03 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaa00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1278) 23:10:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x40486311, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:03 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:03 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 380.286939][T29876] binder: 29873:29876 unknown command 0 [ 380.321919][T29876] binder: 29873:29876 ioctl c0306201 20000240 returned -22 23:10:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x40486312, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:03 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 380.339815][T29891] binder: 29873:29891 unknown command 0 [ 380.345696][T29891] binder: 29873:29891 ioctl c0306201 20000240 returned -22 23:10:03 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1290) [ 380.389773][T29893] binder: 29892:29893 unknown command 0 [ 380.395767][T29893] binder: 29892:29893 ioctl c0306201 20000240 returned -22 [ 380.420073][T29894] binder: 29892:29894 unknown command 0 23:10:04 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaa01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 380.437967][T29894] binder: 29892:29894 ioctl c0306201 20000240 returned -22 23:10:04 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 380.566826][T29911] binder: 29905:29911 unknown command 0 [ 380.572883][T29911] binder: 29905:29911 ioctl c0306201 20000240 returned -22 [ 380.586966][T29914] binder: 29905:29914 unknown command 0 [ 380.592570][T29914] binder: 29905:29914 ioctl c0306201 20000240 returned -22 23:10:04 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x12a8) 23:10:04 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xab00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 380.631106][T29916] binder: 29915:29916 unknown command 0 [ 380.645408][T29916] binder: 29915:29916 ioctl c0306201 20000240 returned -22 [ 380.662062][T29917] binder: 29915:29917 unknown command 0 [ 380.671342][T29917] binder: 29915:29917 ioctl c0306201 20000240 returned -22 23:10:04 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:04 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xab01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 380.815070][T29936] binder: 29935:29936 unknown command 0 [ 380.834929][T29936] binder: 29935:29936 ioctl c0306201 20000240 returned -22 23:10:04 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x12c0) 23:10:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 380.890086][T29942] binder: 29935:29942 unknown command 0 [ 380.910141][T29942] binder: 29935:29942 ioctl c0306201 20000240 returned -22 23:10:04 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xac00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:04 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x12d8) [ 381.069416][T29964] binder: 29960:29964 unknown command 0 [ 381.075209][T29964] binder: 29960:29964 ioctl c0306201 20000240 returned -22 [ 381.088180][T29965] binder: 29960:29965 unknown command 0 [ 381.093813][T29965] binder: 29960:29965 ioctl c0306201 20000240 returned -22 23:10:04 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xac01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:04 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x12f0) [ 381.268504][T29974] binder: 29971:29974 unknown command 0 [ 381.274134][T29974] binder: 29971:29974 ioctl c0306201 20000240 returned -22 [ 381.289383][T29986] binder: 29971:29986 unknown command 0 [ 381.300467][T29986] binder: 29971:29986 ioctl c0306201 20000240 returned -22 23:10:04 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xad00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:04 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 381.408979][T29990] binder: 29987:29990 unknown command 0 [ 381.427307][T29990] binder: 29987:29990 ioctl c0306201 20000240 returned -22 23:10:05 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1308) 23:10:05 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 381.468761][T29998] binder: 29987:29998 unknown command 0 [ 381.491717][T29998] binder: 29987:29998 ioctl c0306201 20000240 returned -22 23:10:05 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:05 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xad01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xae00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 381.689336][T30020] binder: 30017:30020 unknown command 0 [ 381.702710][T30020] binder: 30017:30020 ioctl c0306201 20000240 returned -22 23:10:05 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1320) 23:10:05 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xff000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 381.749095][T30029] binder: 30017:30029 unknown command 0 [ 381.758439][T30029] binder: 30017:30029 ioctl c0306201 20000240 returned -22 23:10:05 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xba00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x63404000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 381.857650][T30039] binder: 30037:30039 unknown command 0 [ 381.872652][T30039] binder: 30037:30039 ioctl c0306201 20000240 returned -22 [ 381.885067][T30043] binder: 30037:30043 unknown command 0 [ 381.892601][T30043] binder: 30037:30043 ioctl c0306201 20000240 returned -22 23:10:05 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1338) 23:10:05 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xae01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xba01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 382.033986][T30051] binder: 30050:30051 unknown command 6504512 [ 382.065356][T30051] binder: 30050:30051 ioctl c0306201 20000240 returned -22 23:10:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:05 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1350) [ 382.086959][T30063] binder: 30050:30063 unknown command 6504512 [ 382.096111][T30063] binder: 30050:30063 ioctl c0306201 20000240 returned -22 23:10:05 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1368) [ 382.230794][T30076] binder: 30069:30076 unknown command 16777216 [ 382.239042][T30076] binder: 30069:30076 ioctl c0306201 20000240 returned -22 [ 382.253099][T30081] binder: 30069:30081 unknown command 16777216 [ 382.261974][T30081] binder: 30069:30081 ioctl c0306201 20000240 returned -22 23:10:05 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x163404000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:05 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xaf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:05 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:06 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1380) [ 382.431709][T30096] binder: 30094:30096 unknown command 23281728 [ 382.439028][T30096] binder: 30094:30096 ioctl c0306201 20000240 returned -22 [ 382.453321][T30100] binder: 30094:30100 unknown command 23281728 [ 382.459709][T30100] binder: 30094:30100 ioctl c0306201 20000240 returned -22 23:10:06 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 382.521231][T30109] binder: 30108:30109 unknown command 33554432 [ 382.548174][T30109] binder: 30108:30109 ioctl c0306201 20000240 returned -22 [ 382.562324][T30113] binder: 30108:30113 unknown command 33554432 23:10:06 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 382.569240][T30113] binder: 30108:30113 ioctl c0306201 20000240 returned -22 23:10:06 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x263044000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:06 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1398) 23:10:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 382.688484][T30127] binder: 30117:30127 unknown command 40043584 [ 382.694877][T30127] binder: 30117:30127 ioctl c0306201 20000240 returned -22 [ 382.708796][T30130] binder: 30117:30130 unknown command 40043584 [ 382.716259][T30130] binder: 30117:30130 ioctl c0306201 20000240 returned -22 23:10:06 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 382.792703][T30134] binder: 30133:30134 unknown command 50331648 [ 382.800490][T30134] binder: 30133:30134 ioctl c0306201 20000240 returned -22 23:10:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x363084000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:06 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x13b0) [ 382.895394][T30148] binder: 30133:30148 unknown command 50331648 [ 382.902368][T30148] binder: 30133:30148 ioctl c0306201 20000240 returned -22 23:10:06 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 382.953814][T30152] binder: 30151:30152 unknown command 56821824 [ 382.967545][T30152] binder: 30151:30152 ioctl c0306201 20000240 returned -22 23:10:06 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 383.084153][T30160] binder: 30151:30160 unknown command 56821824 [ 383.094415][T30160] binder: 30151:30160 ioctl c0306201 20000240 returned -22 23:10:06 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x463044000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 383.135009][T30172] binder: 30171:30172 unknown command 67108864 [ 383.141555][T30172] binder: 30171:30172 ioctl c0306201 20000240 returned -22 [ 383.153606][T30174] binder: 30171:30174 unknown command 67108864 [ 383.172737][T30174] binder: 30171:30174 ioctl c0306201 20000240 returned -22 23:10:06 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x13c8) 23:10:06 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 383.322977][T30182] binder: 30176:30182 unknown command 73598016 [ 383.339821][T30182] binder: 30176:30182 ioctl c0306201 20000240 returned -22 [ 383.354763][T30193] binder: 30176:30193 unknown command 73598016 [ 383.361455][T30193] binder: 30176:30193 ioctl c0306201 20000240 returned -22 23:10:06 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:06 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x13e0) [ 383.422114][T30196] binder: 30195:30196 unknown command 83886080 [ 383.445440][T30196] binder: 30195:30196 ioctl c0306201 20000240 returned -22 23:10:07 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 383.507618][T30206] binder: 30195:30206 unknown command 83886080 [ 383.528124][T30206] binder: 30195:30206 ioctl c0306201 20000240 returned -22 23:10:07 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:07 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x13f8) 23:10:07 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbe00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 383.649972][T30220] binder: 30218:30220 unknown command 100663296 [ 383.656776][T30220] binder: 30218:30220 ioctl c0306201 20000240 returned -22 [ 383.671572][T30223] binder: 30218:30223 unknown command 100663296 23:10:07 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 383.733167][T30223] binder: 30218:30223 ioctl c0306201 20000240 returned -22 23:10:07 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1410) 23:10:07 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbe01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 383.833143][T30243] binder: 30239:30243 unknown command 117440512 [ 383.841576][T30243] binder: 30239:30243 ioctl c0306201 20000240 returned -22 [ 383.853991][T30244] binder: 30239:30244 unknown command 117440512 [ 383.871913][T30244] binder: 30239:30244 ioctl c0306201 20000240 returned -22 23:10:07 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x763044000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:07 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1428) 23:10:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 384.046599][T30260] binder: 30256:30260 unknown command 123929664 [ 384.053402][T30260] binder: 30256:30260 ioctl c0306201 20000240 returned -22 [ 384.067767][T30266] binder: 30256:30266 unknown command 123929664 [ 384.074304][T30266] binder: 30256:30266 ioctl c0306201 20000240 returned -22 23:10:07 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xba00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 384.117454][T30268] binder: 30267:30268 unknown command 134217728 [ 384.156025][T30268] binder: 30267:30268 ioctl c0306201 20000240 returned -22 23:10:07 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 384.214210][T30272] binder: 30267:30272 unknown command 134217728 23:10:07 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1440) [ 384.248322][T30272] binder: 30267:30272 ioctl c0306201 20000240 returned -22 23:10:07 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x863104000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:07 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xba01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xca00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:07 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1458) [ 384.382173][T30292] binder: 30289:30292 unknown command 140709952 [ 384.393512][T30292] binder: 30289:30292 ioctl c0306201 20000240 returned -22 [ 384.416490][T30297] binder: 30289:30297 unknown command 140709952 23:10:08 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 384.465523][T30297] binder: 30289:30297 ioctl c0306201 20000240 returned -22 23:10:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x963104000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:08 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1470) 23:10:08 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xca01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 384.614047][T30316] binder: 30315:30316 unknown command 157487168 [ 384.622556][T30316] binder: 30315:30316 ioctl c0306201 20000240 returned -22 23:10:08 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 384.667718][T30317] binder: 30315:30317 unknown command 157487168 [ 384.706367][T30317] binder: 30315:30317 ioctl c0306201 20000240 returned -22 23:10:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:08 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1488) 23:10:08 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 384.810482][T30336] binder: 30335:30336 unknown command 167772160 [ 384.835639][T30336] binder: 30335:30336 ioctl c0306201 20000240 returned -22 [ 384.849375][T30339] binder: 30335:30339 unknown command 167772160 23:10:08 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 384.882491][T30339] binder: 30335:30339 ioctl c0306201 20000240 returned -22 23:10:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xa63084000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:08 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x14a0) 23:10:08 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 385.061733][T30356] binder: 30355:30356 unknown command 174262336 [ 385.083749][T30356] binder: 30355:30356 ioctl c0306201 20000240 returned -22 23:10:08 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x14b8) [ 385.123705][T30361] binder: 30355:30361 unknown command 174262336 [ 385.162424][T30361] binder: 30355:30361 ioctl c0306201 20000240 returned -22 23:10:08 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xb63000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:08 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x14d0) [ 385.327263][T30392] binder: 30388:30392 unknown command 191037440 [ 385.343823][T30392] binder: 30388:30392 ioctl c0306201 20000240 returned -22 [ 385.364331][T30397] binder: 30388:30397 unknown command 191037440 23:10:08 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:08 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 385.397691][T30397] binder: 30388:30397 ioctl c0306201 20000240 returned -22 23:10:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xc63000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:09 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x14e8) 23:10:09 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 385.532298][T30416] binder: 30413:30416 unknown command 207814656 [ 385.541061][T30416] binder: 30413:30416 ioctl c0306201 20000240 returned -22 [ 385.552796][T30418] binder: 30413:30418 unknown command 207814656 [ 385.562037][T30418] binder: 30413:30418 ioctl c0306201 20000240 returned -22 23:10:09 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xd63000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:09 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1500) [ 385.723804][T30430] binder: 30426:30430 unknown command 224591872 [ 385.731048][T30430] binder: 30426:30430 ioctl c0306201 20000240 returned -22 [ 385.751040][T30438] binder: 30426:30438 unknown command 224591872 23:10:09 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbe00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 385.778497][T30438] binder: 30426:30438 ioctl c0306201 20000240 returned -22 23:10:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xe630c4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:09 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xce00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1518) 23:10:09 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 385.962138][T30459] binder: 30456:30459 unknown command 241372224 [ 385.973703][T30459] binder: 30456:30459 ioctl c0306201 20000240 returned -22 [ 385.989868][T30465] binder: 30456:30465 unknown command 241372224 [ 385.996563][T30465] binder: 30456:30465 ioctl c0306201 20000240 returned -22 23:10:09 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbe01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xce01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xf630c4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:09 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1530) 23:10:09 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 386.197002][T30482] binder: 30477:30482 unknown command 258149440 [ 386.210151][T30482] binder: 30477:30482 ioctl c0306201 20000240 returned -22 [ 386.222479][T30489] binder: 30477:30489 unknown command 258149440 23:10:09 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x1063084000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:09 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xb901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 386.259904][T30489] binder: 30477:30489 ioctl c0306201 20000240 returned -22 23:10:09 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1548) 23:10:09 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:09 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xba00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 386.423144][T30503] binder: 30499:30503 unknown command 274925632 [ 386.435171][T30503] binder: 30499:30503 ioctl c0306201 20000240 returned -22 23:10:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x1163484000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 386.477958][T30516] binder: 30499:30516 unknown command 274925632 [ 386.484452][T30516] binder: 30499:30516 ioctl c0306201 20000240 returned -22 23:10:10 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1560) [ 386.519620][T30522] binder: 30521:30522 unknown command 291719232 [ 386.526268][T30522] binder: 30521:30522 ioctl c0306201 20000240 returned -22 23:10:10 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xba01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 386.574950][T30526] binder: 30521:30526 unknown command 291719232 [ 386.593943][T30526] binder: 30521:30526 ioctl c0306201 20000240 returned -22 23:10:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x1200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:10 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 386.744795][T30545] binder: 30542:30545 unknown command 301989888 [ 386.752445][T30545] binder: 30542:30545 ioctl c0306201 20000240 returned -22 23:10:10 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1578) 23:10:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x1263484000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 386.802616][T30552] binder: 30542:30552 unknown command 301989888 [ 386.810282][T30552] binder: 30542:30552 ioctl c0306201 20000240 returned -22 23:10:10 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1590) 23:10:10 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 386.951223][T30567] binder: 30566:30567 unknown command 308496448 [ 386.958883][T30567] binder: 30566:30567 ioctl c0306201 20000240 returned -22 [ 386.971526][T30573] binder: 30566:30573 unknown command 308496448 [ 386.989817][T30573] binder: 30566:30573 ioctl c0306201 20000240 returned -22 23:10:10 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:10 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x15a8) 23:10:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x4000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:10 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 387.195040][T30595] binder: 30594:30595 unknown command 536870912 [ 387.201737][T30595] binder: 30594:30595 ioctl c0306201 20000240 returned -22 [ 387.213021][T30596] binder: 30594:30596 unknown command 536870912 [ 387.219575][T30596] binder: 30594:30596 ioctl c0306201 20000240 returned -22 23:10:10 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x15c0) 23:10:10 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:10 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x15d8) [ 387.423097][T30612] binder: 30606:30612 unknown command 1073741824 [ 387.430483][T30612] binder: 30606:30612 ioctl c0306201 20000240 returned -22 23:10:11 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 387.504927][T30622] binder: 30606:30622 unknown command 1073741824 [ 387.524547][T30622] binder: 30606:30622 ioctl c0306201 20000240 returned -22 23:10:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:11 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x15f0) 23:10:11 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 387.695533][T30643] binder: 30639:30643 unknown command 1207959552 [ 387.702860][T30643] binder: 30639:30643 ioctl c0306201 20000240 returned -22 [ 387.719606][T30647] binder: 30639:30647 unknown command 1207959552 [ 387.729288][T30647] binder: 30639:30647 ioctl c0306201 20000240 returned -22 23:10:11 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1608) [ 387.801083][T30653] binder: 30652:30653 unknown command 1275068416 [ 387.818002][T30653] binder: 30652:30653 ioctl c0306201 20000240 returned -22 23:10:11 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 387.850699][T30659] binder: 30652:30659 unknown command 1275068416 [ 387.870225][T30659] binder: 30652:30659 ioctl c0306201 20000240 returned -22 23:10:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:11 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1620) 23:10:11 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbe00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 387.976703][T30674] binder: 30672:30674 unknown command 1610612736 [ 387.983720][T30674] binder: 30672:30674 ioctl c0306201 20000240 returned -22 [ 388.012257][T30677] binder: 30672:30677 unknown command 1610612736 [ 388.061580][T30677] binder: 30672:30677 ioctl c0306201 20000240 returned -22 23:10:11 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:11 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 388.169082][T30696] binder: 30695:30696 unknown command 1744830464 [ 388.177506][T30696] binder: 30695:30696 ioctl c0306201 20000240 returned -22 [ 388.188950][T30697] binder: 30695:30697 unknown command 1744830464 [ 388.196774][T30697] binder: 30695:30697 ioctl c0306201 20000240 returned -22 23:10:11 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1638) 23:10:11 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbe01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:11 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xca00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 388.271080][T30700] binder: 30698:30700 unknown command 1811939328 [ 388.307238][T30700] binder: 30698:30700 ioctl c0306201 20000240 returned -22 23:10:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 388.348313][T30708] binder: 30698:30708 unknown command 1811939328 [ 388.363051][T30708] binder: 30698:30708 ioctl c0306201 20000240 returned -22 23:10:11 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1650) 23:10:12 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xca01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 388.465101][T30720] binder: 30719:30720 unknown command 1946157056 [ 388.475422][T30720] binder: 30719:30720 ioctl c0306201 20000240 returned -22 [ 388.497613][T30727] binder: 30719:30727 unknown command 1946157056 [ 388.504228][T30727] binder: 30719:30727 ioctl c0306201 20000240 returned -22 23:10:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:12 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xbf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1668) 23:10:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0xff00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 388.660476][T30744] binder: 30740:30744 unknown command 2046820352 [ 388.667007][T30744] binder: 30740:30744 ioctl c0306201 20000240 returned -22 [ 388.679323][T30746] binder: 30740:30746 unknown command 2046820352 [ 388.686415][T30746] binder: 30740:30746 ioctl c0306201 20000240 returned -22 23:10:12 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:12 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1680) [ 388.842557][T30761] binder: 30754:30761 unknown command -16777216 [ 388.850441][T30761] binder: 30754:30761 ioctl c0306201 20000240 returned -22 [ 388.873197][T30764] binder: 30754:30764 unknown command -16777216 [ 388.880982][T30764] binder: 30754:30764 ioctl c0306201 20000240 returned -22 23:10:12 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 388.928709][T30772] binder: 30771:30772 unknown command 0 [ 388.935798][T30772] binder: 30771:30772 ioctl c0306201 20000240 returned -22 23:10:12 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 388.988220][T30775] binder: 30771:30775 unknown command 0 [ 389.025483][T30775] binder: 30771:30775 ioctl c0306201 20000240 returned -22 23:10:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:12 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 389.098110][T30792] binder: 30791:30792 unknown command 0 [ 389.103969][T30792] binder: 30791:30792 ioctl c0306201 20000240 returned -22 [ 389.122792][T30793] binder: 30791:30793 unknown command 0 [ 389.128782][T30793] binder: 30791:30793 ioctl c0306201 20000240 returned -22 23:10:12 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1698) 23:10:12 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 389.286113][T30810] binder: 30802:30810 unknown command 0 [ 389.301711][T30810] binder: 30802:30810 ioctl c0306201 20000240 returned -22 [ 389.323922][T30814] binder: 30802:30814 unknown command 0 23:10:12 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:12 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 389.354701][T30814] binder: 30802:30814 ioctl c0306201 20000240 returned -22 23:10:12 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x16b0) 23:10:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:13 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x16c8) [ 389.539545][T30834] binder: 30831:30834 unknown command 0 [ 389.549067][T30834] binder: 30831:30834 ioctl c0306201 20000240 returned -22 [ 389.572242][T30838] binder: 30831:30838 unknown command 0 [ 389.583715][T30838] binder: 30831:30838 ioctl c0306201 20000240 returned -22 23:10:13 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:13 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x16e0) [ 389.693628][T30849] binder: 30848:30849 unknown command 0 [ 389.720309][T30849] binder: 30848:30849 ioctl c0306201 20000240 returned -22 23:10:13 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 389.773686][T30860] binder: 30848:30860 unknown command 0 23:10:13 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 389.832454][T30860] binder: 30848:30860 ioctl c0306201 20000240 returned -22 23:10:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:13 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x16f8) 23:10:13 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xce00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 390.044270][T30887] binder: 30881:30887 unknown command 0 [ 390.061592][T30887] binder: 30881:30887 ioctl c0306201 20000240 returned -22 [ 390.074720][T30887] binder: BINDER_SET_CONTEXT_MGR already set [ 390.080703][T30898] binder: 30881:30898 unknown command 0 23:10:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 390.085608][T30887] binder: 30881:30887 ioctl 40046207 0 returned -16 [ 390.088202][T30898] binder: 30881:30898 ioctl c0306201 20000240 returned -22 23:10:13 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xce01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 390.136193][T30900] binder: 30899:30900 unknown command 0 [ 390.143293][T30900] binder: 30899:30900 ioctl c0306201 20000240 returned -22 [ 390.157392][T30901] binder: 30899:30901 unknown command 0 [ 390.163025][T30901] binder: 30899:30901 ioctl c0306201 20000240 returned -22 23:10:13 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1710) [ 390.272225][T30911] binder: 30906:30911 unknown command 0 [ 390.295950][T30911] binder: 30906:30911 ioctl c0306201 20000240 returned -22 23:10:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:13 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 390.321910][T30921] binder: 30906:30921 unknown command 0 [ 390.327881][T30921] binder: 30906:30921 ioctl c0306201 20000240 returned -22 23:10:13 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xca00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:13 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 390.368640][T30924] binder: 30923:30924 unknown command 0 [ 390.374354][T30924] binder: 30923:30924 ioctl c0306201 20000240 returned -22 23:10:14 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1728) 23:10:14 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xda00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 390.437249][T30925] binder: 30923:30925 unknown command 0 23:10:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 390.483796][T30925] binder: 30923:30925 ioctl c0306201 20000240 returned -22 23:10:14 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xca01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 390.563410][T30945] binder: 30943:30945 unknown command 0 [ 390.571991][T30945] binder: 30943:30945 ioctl c0306201 20000240 returned -22 [ 390.596720][T30948] binder: 30943:30948 unknown command 0 23:10:14 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1740) 23:10:14 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 390.607947][T30948] binder: 30943:30948 ioctl c0306201 20000240 returned -22 23:10:14 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xda01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:14 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1758) 23:10:14 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 390.780513][T30968] binder: 30965:30968 unknown command 0 [ 390.789876][T30968] binder: 30965:30968 ioctl c0306201 20000240 returned -22 [ 390.803089][T30973] binder: 30965:30973 unknown command 0 [ 390.808922][T30973] binder: 30965:30973 ioctl c0306201 20000240 returned -22 23:10:14 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 390.982056][T30985] binder: 30977:30985 unknown command 0 [ 390.988359][T30985] binder: 30977:30985 ioctl c0306201 20000240 returned -22 [ 391.001214][T30994] binder: 30977:30994 unknown command 0 [ 391.007224][T30994] binder: 30977:30994 ioctl c0306201 20000240 returned -22 [ 391.040758][T30996] binder: 30995:30996 unknown command 0 [ 391.055330][T30996] binder: 30995:30996 ioctl c0306201 20000240 returned -22 23:10:14 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1770) 23:10:14 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 391.083218][T30997] binder: 30995:30997 unknown command 0 [ 391.098405][T30997] binder: 30995:30997 ioctl c0306201 20000240 returned -22 23:10:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:14 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 391.240605][T31016] binder: 31013:31016 unknown command 0 [ 391.251311][T31016] binder: 31013:31016 ioctl c0306201 20000240 returned -22 [ 391.262996][T31018] binder: 31013:31018 unknown command 0 23:10:14 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1788) [ 391.302554][T31018] binder: 31013:31018 ioctl c0306201 20000240 returned -22 23:10:14 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:14 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x17a0) 23:10:15 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 391.482593][T31038] binder: 31035:31038 unknown command 0 [ 391.489239][T31038] binder: 31035:31038 ioctl c0306201 20000240 returned -22 [ 391.505115][T31044] binder: 31035:31044 unknown command 0 [ 391.511472][T31044] binder: 31035:31044 ioctl c0306201 20000240 returned -22 23:10:15 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x17b8) [ 391.658420][T31050] binder: 31049:31050 unknown command 0 [ 391.675414][T31050] binder: 31049:31050 ioctl c0306201 20000240 returned -22 [ 391.694191][T31065] binder: 31049:31065 unknown command 0 [ 391.699929][T31065] binder: 31049:31065 ioctl c0306201 20000240 returned -22 23:10:15 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:15 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:15 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 391.877182][T31082] binder: 31075:31082 unknown command 0 [ 391.883593][T31082] binder: 31075:31082 ioctl c0306201 20000240 returned -22 [ 391.896813][T31088] binder: 31075:31088 unknown command 0 [ 391.902584][T31088] binder: 31075:31088 ioctl c0306201 20000240 returned -22 23:10:15 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x17d0) 23:10:15 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xce00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xde00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 392.028980][T31092] binder: 31090:31092 unknown command 0 [ 392.046315][T31092] binder: 31090:31092 ioctl c0306201 20000240 returned -22 23:10:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 392.080112][T31107] binder: 31090:31107 unknown command 0 [ 392.091243][T31107] binder: 31090:31107 ioctl c0306201 20000240 returned -22 23:10:15 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x17e8) 23:10:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 392.124184][T31110] binder: 31109:31110 unknown command 0 [ 392.130304][T31110] binder: 31109:31110 ioctl c0306201 20000240 returned -22 [ 392.149963][T31111] binder: 31109:31111 unknown command 0 [ 392.159829][T31111] binder: 31109:31111 ioctl c0306201 20000240 returned -22 23:10:15 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xce01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xde01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:15 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1800) [ 392.308457][T31116] binder: 31115:31116 unknown command 0 [ 392.317029][T31116] binder: 31115:31116 ioctl c0306201 20000240 returned -22 [ 392.328345][T31131] binder: 31115:31131 unknown command 0 [ 392.333951][T31131] binder: 31115:31131 ioctl c0306201 20000240 returned -22 23:10:15 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xc901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:15 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 392.378307][T31133] binder: 31132:31133 unknown command 0 [ 392.383993][T31133] binder: 31132:31133 ioctl c0306201 20000240 returned -22 23:10:15 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 392.430688][T31135] binder: 31132:31135 unknown command 0 [ 392.436826][T31135] binder: 31132:31135 ioctl c0306201 20000240 returned -22 23:10:16 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xb63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:16 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1818) 23:10:16 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 392.570370][T31153] binder: 31151:31153 unknown command 0 [ 392.585906][T31153] binder: 31151:31153 ioctl c0306201 20000240 returned -22 23:10:16 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xca00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 392.640612][T31158] binder: 31151:31158 unknown command 0 23:10:16 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1830) 23:10:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xc63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 392.685495][T31158] binder: 31151:31158 ioctl c0306201 20000240 returned -22 23:10:16 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xca01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 392.822426][T31177] binder: 31173:31177 unknown command 0 [ 392.852826][T31177] binder: 31173:31177 ioctl c0306201 20000240 returned -22 23:10:16 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1848) 23:10:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xd63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 392.929454][T31190] binder: 31173:31190 unknown command 0 [ 392.945481][T31190] binder: 31173:31190 ioctl c0306201 20000240 returned -22 23:10:16 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 392.983277][T31196] binder: 31195:31196 unknown command 0 [ 392.997975][T31196] binder: 31195:31196 ioctl c0306201 20000240 returned -22 23:10:16 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1860) [ 393.031078][T31198] binder: 31195:31198 unknown command 0 23:10:16 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 393.073107][T31198] binder: 31195:31198 ioctl c0306201 20000240 returned -22 23:10:16 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x1200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:16 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 393.243393][T31220] binder: 31217:31220 unknown command 0 [ 393.265532][T31220] binder: 31217:31220 ioctl c0306201 20000240 returned -22 23:10:16 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1878) 23:10:16 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 393.334064][T31229] binder: 31217:31229 unknown command 0 [ 393.340898][T31229] binder: 31217:31229 ioctl c0306201 20000240 returned -22 23:10:16 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:17 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 393.474401][T31245] binder: 31243:31245 unknown command 0 [ 393.480703][T31245] binder: 31243:31245 ioctl c0306201 20000240 returned -22 23:10:17 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1890) 23:10:17 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 393.536534][T31248] binder: 31243:31248 unknown command 0 [ 393.542148][T31248] binder: 31243:31248 ioctl c0306201 20000240 returned -22 23:10:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:17 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 393.664820][T31267] binder: 31266:31267 unknown command 0 [ 393.671360][T31267] binder: 31266:31267 ioctl c0306201 20000240 returned -22 [ 393.695105][T31267] binder: 31266:31267 unknown command 0 23:10:17 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x18a8) [ 393.713525][T31267] binder: 31266:31267 ioctl c0306201 20000240 returned -22 23:10:17 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:17 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 393.893537][T31289] binder: 31285:31289 unknown command 0 [ 393.904342][T31289] binder: 31285:31289 ioctl c0306201 20000240 returned -22 [ 393.920143][T31292] binder: 31285:31292 unknown command 0 23:10:17 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 393.942801][T31292] binder: 31285:31292 ioctl c0306201 20000240 returned -22 23:10:17 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x18c0) 23:10:17 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:17 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xce00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 394.133064][T31314] binder: 31307:31314 unknown command 0 [ 394.146598][T31314] binder: 31307:31314 ioctl c0306201 20000240 returned -22 [ 394.172561][T31319] binder: 31307:31319 unknown command 0 23:10:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:17 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xce01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x18d8) [ 394.190315][T31319] binder: 31307:31319 ioctl c0306201 20000240 returned -22 23:10:17 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 394.315792][T31335] binder: 31333:31335 unknown command 0 [ 394.323223][T31335] binder: 31333:31335 ioctl c0306201 20000240 returned -22 [ 394.355119][T31337] binder: 31333:31337 unknown command 0 23:10:17 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:17 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x18f0) [ 394.361322][T31337] binder: 31333:31337 ioctl c0306201 20000240 returned -22 23:10:18 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x630b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:18 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xcf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1908) [ 394.532908][T31356] binder: 31354:31356 unknown command 0 [ 394.538879][T31356] binder: 31354:31356 ioctl c0306201 20000240 returned -22 [ 394.566744][T31358] binder: 31354:31358 unknown command 0 [ 394.572358][T31358] binder: 31354:31358 ioctl c0306201 20000240 returned -22 23:10:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x630c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:18 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xda00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x630d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 394.712324][T31375] binder: 31372:31375 unknown command 0 [ 394.718513][T31375] binder: 31372:31375 ioctl c0306201 20000240 returned -22 [ 394.739756][T31379] binder: 31372:31379 unknown command 0 [ 394.752595][T31379] binder: 31372:31379 ioctl c0306201 20000240 returned -22 23:10:18 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1920) 23:10:18 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xda01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 394.916653][T31391] binder: 31387:31391 unknown command 0 [ 394.923021][T31391] binder: 31387:31391 ioctl c0306201 20000240 returned -22 [ 394.947108][T31401] binder: 31387:31401 unknown command 0 [ 394.953630][T31401] binder: 31387:31401 ioctl c0306201 20000240 returned -22 23:10:18 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1938) [ 395.086729][T31410] binder: 31409:31410 unknown command 0 [ 395.126557][T31410] binder: 31409:31410 ioctl c0306201 20000240 returned -22 23:10:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 395.166064][T31427] binder: 31409:31427 unknown command 0 [ 395.171939][T31427] binder: 31409:31427 ioctl c0306201 20000240 returned -22 23:10:18 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 395.214942][T31430] binder: 31429:31430 unknown command 0 [ 395.233709][T31430] binder: 31429:31430 ioctl c0306201 20000240 returned -22 [ 395.253895][T31431] binder: 31429:31431 unknown command 0 23:10:18 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:18 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 395.264780][T31431] binder: 31429:31431 ioctl c0306201 20000240 returned -22 23:10:18 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1950) 23:10:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:18 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 395.413742][T31450] binder: 31449:31450 unknown command 0 [ 395.440143][T31450] binder: 31449:31450 ioctl c0306201 20000240 returned -22 23:10:19 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1968) [ 395.483266][T31458] binder: 31449:31458 unknown command 0 23:10:19 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 395.530282][T31458] binder: 31449:31458 ioctl c0306201 20000240 returned -22 23:10:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:19 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1980) [ 395.651420][T31476] binder: 31475:31476 unknown command 0 [ 395.661319][T31476] binder: 31475:31476 ioctl c0306201 20000240 returned -22 23:10:19 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 395.750530][T31490] binder: 31475:31490 unknown command 0 23:10:19 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 395.809115][T31490] binder: 31475:31490 ioctl c0306201 20000240 returned -22 23:10:19 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 395.885440][T31503] binder: 31500:31503 unknown command 0 [ 395.903182][T31503] binder: 31500:31503 ioctl c0306201 20000240 returned -22 [ 395.926146][T31508] binder: 31500:31508 unknown command 0 23:10:19 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1998) 23:10:19 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 395.932148][T31508] binder: 31500:31508 ioctl c0306201 20000240 returned -22 23:10:19 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x634040, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:19 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 396.066297][T31525] binder: 31524:31525 unknown command 0 [ 396.072066][T31525] binder: 31524:31525 ioctl c0306201 20000240 returned -22 [ 396.086051][T31527] binder: 31524:31527 unknown command 0 [ 396.100411][T31527] binder: 31524:31527 ioctl c0306201 20000240 returned -22 23:10:19 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xde00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x19b0) 23:10:19 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 396.266323][T31540] binder: 31539:31540 unknown command 0 [ 396.273094][T31540] binder: 31539:31540 ioctl c0306201 20000240 returned -22 23:10:19 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xde01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xea00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x1634040, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 396.326812][T31553] binder: 31539:31553 unknown command 0 [ 396.332516][T31553] binder: 31539:31553 ioctl c0306201 20000240 returned -22 23:10:19 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x19c8) 23:10:20 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xda00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 396.461524][T31570] binder: 31568:31570 unknown command 0 [ 396.474560][T31570] binder: 31568:31570 ioctl c0306201 20000240 returned -22 23:10:20 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xea01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x19e0) 23:10:20 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xda01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 396.562028][T31578] binder: 31568:31578 unknown command 0 [ 396.588733][T31578] binder: 31568:31578 ioctl c0306201 20000240 returned -22 23:10:20 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:20 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x19f8) [ 396.756627][T31597] binder: 31596:31597 unknown command 0 [ 396.767896][T31597] binder: 31596:31597 ioctl c0306201 20000240 returned -22 [ 396.790985][T31603] binder: 31596:31603 unknown command 0 23:10:20 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xeb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x2630440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 396.808380][T31603] binder: 31596:31603 ioctl c0306201 20000240 returned -22 23:10:20 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1a10) 23:10:20 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 396.911704][T31617] binder: 31616:31617 unknown command 0 [ 396.924670][T31617] binder: 31616:31617 ioctl c0306201 20000240 returned -22 [ 396.935601][T31617] binder: BINDER_SET_CONTEXT_MGR already set 23:10:20 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xeb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 397.005899][T31617] binder: 31616:31617 ioctl 40046207 0 returned -16 23:10:20 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1a28) 23:10:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 397.052686][T31626] binder: 31616:31626 unknown command 0 [ 397.088849][T31626] binder: 31616:31626 ioctl c0306201 20000240 returned -22 23:10:20 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xec00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1a40) [ 397.214536][T31646] binder: 31644:31646 unknown command 0 [ 397.245385][T31646] binder: 31644:31646 ioctl c0306201 20000240 returned -22 23:10:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x3630840, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:20 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xec01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 397.285765][T31658] binder: 31644:31658 unknown command 0 [ 397.291550][T31658] binder: 31644:31658 ioctl c0306201 20000240 returned -22 23:10:20 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:20 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 397.382861][T31665] binder: 31664:31665 unknown command 0 [ 397.412555][T31665] binder: 31664:31665 ioctl c0306201 20000240 returned -22 23:10:21 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1a58) 23:10:21 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 397.447986][T31665] binder: BINDER_SET_CONTEXT_MGR already set [ 397.464106][T31665] binder: 31664:31665 ioctl 40046207 0 returned -16 23:10:21 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xed00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:21 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 397.492242][T31680] binder: 31664:31680 unknown command 0 [ 397.518932][T31680] binder: 31664:31680 ioctl c0306201 20000240 returned -22 23:10:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:21 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:21 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1a70) 23:10:21 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 397.668090][T31693] binder: 31688:31693 unknown command 0 [ 397.692214][T31693] binder: 31688:31693 ioctl c0306201 20000240 returned -22 23:10:21 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xed01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 397.730046][T31702] binder: 31688:31702 unknown command 0 [ 397.743194][T31702] binder: 31688:31702 ioctl c0306201 20000240 returned -22 23:10:21 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:21 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:21 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1a88) 23:10:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x4630440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:21 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xee00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:21 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:21 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 397.936644][T31717] binder: 31713:31717 unknown command 0 [ 397.962179][T31717] binder: 31713:31717 ioctl c0306201 20000240 returned -22 23:10:21 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xde00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 398.008810][T31726] binder: 31713:31726 unknown command 0 [ 398.042636][T31726] binder: 31713:31726 ioctl c0306201 20000240 returned -22 23:10:21 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1aa0) 23:10:21 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xee01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:21 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:21 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:21 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xde01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:21 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xef00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 398.312194][T31755] binder: 31749:31755 unknown command 0 [ 398.323325][T31755] binder: 31749:31755 ioctl c0306201 20000240 returned -22 [ 398.338120][T31759] binder: 31749:31759 unknown command 0 [ 398.343998][T31759] binder: 31749:31759 ioctl c0306201 20000240 returned -22 23:10:21 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:21 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1ab8) 23:10:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:22 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xef01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xd901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 398.558031][T31774] binder: 31768:31774 unknown command 0 [ 398.564000][T31774] binder: 31768:31774 ioctl c0306201 20000240 returned -22 [ 398.582149][T31776] binder: 31768:31776 unknown command 0 [ 398.595951][T31776] binder: 31768:31776 ioctl c0306201 20000240 returned -22 23:10:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:22 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xda00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1ad0) 23:10:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x7630440, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 398.752002][T31794] binder: 31792:31794 unknown command 0 [ 398.758188][T31794] binder: 31792:31794 ioctl c0306201 20000240 returned -22 [ 398.784955][T31800] binder: 31792:31800 unknown command 0 [ 398.790872][T31800] binder: 31792:31800 ioctl c0306201 20000240 returned -22 [ 398.823910][T31805] binder: 31804:31805 unknown command 0 [ 398.829931][T31805] binder: 31804:31805 ioctl c0306201 20000240 returned -22 [ 398.852871][T31806] binder: 31804:31806 unknown command 0 23:10:22 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xda01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1ae8) 23:10:22 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 398.876747][T31806] binder: 31804:31806 ioctl c0306201 20000240 returned -22 23:10:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:22 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 399.026345][T31825] binder: 31824:31825 unknown command 0 [ 399.035116][T31825] binder: 31824:31825 ioctl c0306201 20000240 returned -22 [ 399.063564][T31830] binder: 31824:31830 unknown command 0 [ 399.069451][T31830] binder: 31824:31830 ioctl c0306201 20000240 returned -22 23:10:22 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1b00) 23:10:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x8631040, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:22 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x9631040, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 399.221068][T31845] binder: 31841:31845 unknown command 0 [ 399.227943][T31845] binder: 31841:31845 ioctl c0306201 20000240 returned -22 [ 399.239369][T31850] binder: 31841:31850 unknown command 0 [ 399.247609][T31850] binder: 31841:31850 ioctl c0306201 20000240 returned -22 23:10:22 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:22 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1b18) [ 399.299984][T31852] binder: 31851:31852 unknown command 0 [ 399.361513][T31852] binder: 31851:31852 ioctl c0306201 20000240 returned -22 23:10:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:23 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 399.428860][T31868] binder: 31851:31868 unknown command 0 [ 399.434700][T31868] binder: 31851:31868 ioctl c0306201 20000240 returned -22 23:10:23 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1b30) [ 399.495787][T31872] binder: 31871:31872 unknown command 0 [ 399.503319][T31872] binder: 31871:31872 ioctl c0306201 20000240 returned -22 23:10:23 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 399.545173][T31878] binder: 31871:31878 unknown command 0 23:10:23 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xa630840, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 399.608045][T31878] binder: 31871:31878 ioctl c0306201 20000240 returned -22 23:10:23 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1b48) 23:10:23 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 399.702071][T31899] binder: 31898:31899 unknown command 0 [ 399.710678][T31899] binder: 31898:31899 ioctl c0306201 20000240 returned -22 23:10:23 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 399.767641][T31904] binder: 31898:31904 unknown command 0 [ 399.774989][T31904] binder: 31898:31904 ioctl c0306201 20000240 returned -22 23:10:23 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xb630000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:23 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xc630000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 399.906192][T31923] binder: 31922:31923 unknown command 0 [ 399.912002][T31923] binder: 31922:31923 ioctl c0306201 20000240 returned -22 [ 399.924527][T31924] binder: 31922:31924 unknown command 0 [ 399.930901][T31924] binder: 31922:31924 ioctl c0306201 20000240 returned -22 23:10:23 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1b60) 23:10:23 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 400.079306][T31933] binder: 31931:31933 unknown command 0 [ 400.115743][T31933] binder: 31931:31933 ioctl c0306201 20000240 returned -22 23:10:23 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xde00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1b78) [ 400.143331][T31947] binder: 31931:31947 unknown command 0 [ 400.158384][T31947] binder: 31931:31947 ioctl c0306201 20000240 returned -22 23:10:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xd630000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:23 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xde01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xe630c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:23 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1b90) [ 400.317138][T31960] binder: 31959:31960 unknown command 0 [ 400.331247][T31960] binder: 31959:31960 ioctl c0306201 20000240 returned -22 [ 400.349124][T31968] binder: 31959:31968 unknown command 0 [ 400.356049][T31968] binder: 31959:31968 ioctl c0306201 20000240 returned -22 23:10:23 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdf00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xf630c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 400.458775][T31977] binder: 31976:31977 unknown command 0 [ 400.467028][T31977] binder: 31976:31977 ioctl c0306201 20000240 returned -22 [ 400.479089][T31978] binder: 31976:31978 unknown command 0 [ 400.485020][T31978] binder: 31976:31978 ioctl c0306201 20000240 returned -22 23:10:24 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1ba8) 23:10:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x10630840, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:24 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 400.599290][T31994] binder: 31993:31994 unknown command 0 [ 400.604970][T31994] binder: 31993:31994 ioctl c0306201 20000240 returned -22 [ 400.616932][T31998] binder: 31993:31998 unknown command 0 [ 400.622947][T31998] binder: 31993:31998 ioctl c0306201 20000240 returned -22 23:10:24 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xdf01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1bc0) [ 400.739021][T32000] binder: 31999:32000 unknown command 0 [ 400.757842][T32000] binder: 31999:32000 ioctl c0306201 20000240 returned -22 [ 400.779404][T32012] binder: 31999:32012 unknown command 0 23:10:24 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x11634840, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:24 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xea00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 400.820928][T32012] binder: 31999:32012 ioctl c0306201 20000240 returned -22 23:10:24 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1bd8) 23:10:24 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 400.883494][T32026] binder: 32025:32026 unknown command 0 [ 400.889428][T32026] binder: 32025:32026 ioctl c0306201 20000240 returned -22 [ 400.908606][T32028] binder: 32025:32028 unknown command 0 [ 400.915170][T32028] binder: 32025:32028 ioctl c0306201 20000240 returned -22 23:10:24 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x12000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:24 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xea01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 401.049917][T32040] binder: 32034:32040 unknown command 0 [ 401.058678][T32040] binder: 32034:32040 ioctl c0306201 20000240 returned -22 23:10:24 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1bf0) 23:10:24 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 401.094239][T32047] binder: 32034:32047 unknown command 0 23:10:24 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x12634840, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 401.153386][T32047] binder: 32034:32047 ioctl c0306201 20000240 returned -22 23:10:24 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xeb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 401.296641][T32065] binder: 32063:32065 unknown command 0 [ 401.314388][T32065] binder: 32063:32065 ioctl c0306201 20000240 returned -22 [ 401.330398][T32065] binder: BINDER_SET_CONTEXT_MGR already set [ 401.337478][T32065] binder: 32063:32065 ioctl 40046207 0 returned -16 23:10:24 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xeb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 401.344653][T32080] binder: 32063:32080 unknown command 0 [ 401.352076][T32080] binder: 32063:32080 ioctl c0306201 20000240 returned -22 23:10:24 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1c08) 23:10:25 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 401.453773][T32085] binder: 32083:32085 unknown command 0 [ 401.466722][T32085] binder: 32083:32085 ioctl c0306201 20000240 returned -22 23:10:25 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xec00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 401.512083][T32091] binder: 32083:32091 unknown command 0 [ 401.542116][T32091] binder: 32083:32091 ioctl c0306201 20000240 returned -22 23:10:25 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1c20) 23:10:25 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 401.631133][T32107] binder: 32105:32107 unknown command 0 [ 401.654045][T32107] binder: 32105:32107 ioctl c0306201 20000240 returned -22 23:10:25 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xec01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x40046302, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 401.692019][T32114] binder: 32105:32114 unknown command 0 [ 401.726519][T32114] binder: 32105:32114 ioctl c0306201 20000240 returned -22 23:10:25 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1c38) 23:10:25 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 401.819773][T32126] binder: 32124:32126 unknown command 0 [ 401.838513][T32126] binder: 32124:32126 ioctl c0306201 20000240 returned -22 23:10:25 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xed00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 401.884232][T32135] binder: 32124:32135 unknown command 0 [ 401.898335][T32135] binder: 32124:32135 ioctl c0306201 20000240 returned -22 23:10:25 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1c50) 23:10:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:25 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 402.040743][T32154] binder: 32151:32154 unknown command 0 [ 402.047006][T32154] binder: 32151:32154 ioctl c0306201 20000240 returned -22 [ 402.071756][T32157] binder: 32151:32157 unknown command 0 23:10:25 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xed01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1c68) [ 402.084121][T32157] binder: 32151:32157 ioctl c0306201 20000240 returned -22 23:10:25 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x40046307, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:25 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xee00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:25 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1c80) 23:10:25 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 402.257589][T32175] binder: 32173:32175 unknown command 0 [ 402.263974][T32175] binder: 32173:32175 ioctl c0306201 20000240 returned -22 23:10:25 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 402.347079][T32182] binder: 32173:32182 unknown command 0 [ 402.353062][T32182] binder: 32173:32182 ioctl c0306201 20000240 returned -22 23:10:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x40086303, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:25 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1c98) 23:10:26 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xee01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfa00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 402.464347][T32198] binder: 32195:32198 unknown command 0 [ 402.523744][T32198] binder: 32195:32198 ioctl c0306201 20000240 returned -22 23:10:26 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xea00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 402.572054][T32198] binder: BINDER_SET_CONTEXT_MGR already set [ 402.579294][T32198] binder: 32195:32198 ioctl 40046207 0 returned -16 23:10:26 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xef00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1cb0) [ 402.618965][T32215] binder: 32195:32215 unknown command 0 [ 402.647950][T32215] binder: 32195:32215 ioctl c0306201 20000240 returned -22 23:10:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x4008630a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:26 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xea01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfa01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xef01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1cc8) 23:10:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x40086310, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:26 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xeb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 402.828525][T32238] binder: 32236:32238 unknown command 0 [ 402.837661][T32238] binder: 32236:32238 ioctl c0306201 20000240 returned -22 [ 402.852086][T32248] binder: 32236:32248 unknown command 0 [ 402.862053][T32248] binder: 32236:32248 ioctl c0306201 20000240 returned -22 23:10:26 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:26 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1ce0) 23:10:26 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xeb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 403.008558][T32259] binder: 32253:32259 unknown command 0 [ 403.017782][T32259] binder: 32253:32259 ioctl c0306201 20000240 returned -22 [ 403.034935][T32266] binder: 32253:32266 unknown command 0 [ 403.040762][T32266] binder: 32253:32266 ioctl c0306201 20000240 returned -22 23:10:26 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 403.152906][T32270] binder: 32269:32270 unknown command 0 [ 403.176235][T32270] binder: 32269:32270 ioctl c0306201 20000240 returned -22 23:10:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x400c630f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:26 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xec00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 403.213319][T32285] binder: 32269:32285 unknown command 0 [ 403.220654][T32285] binder: 32269:32285 ioctl c0306201 20000240 returned -22 23:10:26 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1cf8) 23:10:26 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:26 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xec01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 403.359977][T32295] binder: 32294:32295 unknown command 0 [ 403.399208][T32295] binder: 32294:32295 ioctl c0306201 20000240 returned -22 23:10:27 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1d10) [ 403.431609][T32295] binder: BINDER_SET_CONTEXT_MGR already set [ 403.438469][T32295] binder: 32294:32295 ioctl 40046207 0 returned -16 [ 403.444959][T32314] binder: 32294:32314 unknown command 0 [ 403.468371][T32314] binder: 32294:32314 ioctl c0306201 20000240 returned -22 23:10:27 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xed00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x40106308, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:27 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 403.626801][T32331] binder: 32330:32331 unknown command 0 [ 403.635410][T32331] binder: 32330:32331 ioctl c0306201 20000240 returned -22 23:10:27 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xed01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1d28) [ 403.671107][T32337] binder: 32330:32337 unknown command 0 [ 403.692245][T32337] binder: 32330:32337 ioctl c0306201 20000240 returned -22 23:10:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x40106309, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:27 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xee00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 403.837794][T32352] binder: 32351:32352 unknown command 0 [ 403.848826][T32352] binder: 32351:32352 ioctl c0306201 20000240 returned -22 23:10:27 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1d40) [ 403.888325][T32360] binder: 32351:32360 unknown command 0 23:10:27 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x40406300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 403.932673][T32360] binder: 32351:32360 ioctl c0306201 20000240 returned -22 23:10:27 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xe901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xee01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 404.043866][T32378] binder: 32377:32378 unknown command 0 [ 404.061083][T32378] binder: 32377:32378 ioctl c0306201 20000240 returned -22 23:10:27 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1d58) [ 404.100046][T32383] binder: 32377:32383 unknown command 0 23:10:27 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfe00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x40406301, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 404.142021][T32383] binder: 32377:32383 ioctl c0306201 20000240 returned -22 23:10:27 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 404.205042][T32399] binder: 32398:32399 unknown command 0 [ 404.210961][T32399] binder: 32398:32399 ioctl c0306201 20000240 returned -22 [ 404.232851][T32401] binder: 32398:32401 unknown command 0 23:10:27 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xef00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xea00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1d70) 23:10:27 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfe01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 404.268803][T32401] binder: 32398:32401 ioctl c0306201 20000240 returned -22 23:10:27 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x40486311, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:27 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xea01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xef01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 404.423286][T32422] binder: 32421:32422 unknown command 0 [ 404.432807][T32422] binder: 32421:32422 ioctl c0306201 20000240 returned -22 23:10:28 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xff00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1d88) [ 404.489169][T32425] binder: 32421:32425 unknown command 0 23:10:28 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x40486312, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:28 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 404.532119][T32425] binder: 32421:32425 ioctl c0306201 20000240 returned -22 23:10:28 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xeb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1da0) 23:10:28 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xff01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 404.698550][T32445] binder: 32441:32445 unknown command 0 [ 404.713885][T32445] binder: 32441:32445 ioctl c0306201 20000240 returned -22 [ 404.728761][T32445] binder: BINDER_SET_CONTEXT_MGR already set [ 404.736461][T32445] binder: 32441:32445 ioctl 40046207 0 returned -16 23:10:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 404.747794][T32460] binder: 32441:32460 unknown command 0 [ 404.754351][T32460] binder: 32441:32460 ioctl c0306201 20000240 returned -22 23:10:28 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xeb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x20000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1db8) [ 404.874441][T32467] binder: 32465:32467 unknown command 0 23:10:28 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 404.920711][T32467] binder: 32465:32467 ioctl c0306201 20000240 returned -22 23:10:28 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xec00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1dd0) [ 404.962495][T32467] binder: BINDER_SET_CONTEXT_MGR already set [ 404.983197][T32483] binder: 32465:32483 unknown command 0 [ 405.022142][T32467] binder: 32465:32467 ioctl 40046207 0 returned -16 [ 405.062365][T32483] binder: 32465:32483 ioctl c0306201 20000240 returned -22 23:10:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:28 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x100000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1de8) [ 405.152912][T32498] binder: 32497:32498 unknown command 0 [ 405.185396][T32498] binder: 32497:32498 ioctl c0306201 20000240 returned -22 23:10:28 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xec01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 405.261087][T32507] binder: 32497:32507 unknown command 0 [ 405.278111][T32507] binder: 32497:32507 ioctl c0306201 20000240 returned -22 23:10:28 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1e00) 23:10:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:28 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 405.339374][T32519] binder: 32518:32519 unknown command 0 [ 405.355380][T32519] binder: 32518:32519 ioctl c0306201 20000240 returned -22 [ 405.370607][T32520] binder: 32518:32520 unknown command 0 [ 405.376356][T32520] binder: 32518:32520 ioctl c0306201 20000240 returned -22 23:10:28 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x200000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xed00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 405.459457][T32525] binder: 32521:32525 unknown command 0 [ 405.495104][T32525] binder: 32521:32525 ioctl c0306201 20000240 returned -22 23:10:29 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1e18) [ 405.542209][T32539] binder: 32521:32539 unknown command 0 [ 405.555529][T32539] binder: 32521:32539 ioctl c0306201 20000240 returned -22 23:10:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:29 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xed01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1e30) 23:10:29 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x1000000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 405.716867][T32550] binder: 32545:32550 unknown command 0 [ 405.722843][T32550] binder: 32545:32550 ioctl c0306201 20000240 returned -22 [ 405.738678][T32555] binder: 32545:32555 unknown command 0 [ 405.744636][T32555] binder: 32545:32555 ioctl c0306201 20000240 returned -22 23:10:29 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:29 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xee00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1e48) 23:10:29 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 405.921843][T32572] binder: 32571:32572 unknown command 0 [ 405.942011][T32572] binder: 32571:32572 ioctl c0306201 20000240 returned -22 23:10:29 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x1010000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xee01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 405.982326][T32581] binder: 32571:32581 unknown command 0 [ 406.007878][T32581] binder: 32571:32581 ioctl c0306201 20000240 returned -22 23:10:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:29 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1e60) 23:10:29 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 406.133423][T32593] binder: 32592:32593 unknown command 0 [ 406.152917][T32593] binder: 32592:32593 ioctl c0306201 20000240 returned -22 23:10:29 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x2000000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 406.188202][T32604] binder: 32592:32604 unknown command 0 [ 406.197535][T32604] binder: 32592:32604 ioctl c0306201 20000240 returned -22 23:10:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xff000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:29 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xef00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1e78) 23:10:29 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:29 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 406.341129][T32616] binder: 32612:32616 unknown command 0 [ 406.370320][T32616] binder: 32612:32616 ioctl c0306201 20000240 returned -22 23:10:30 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xef01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x63404000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:30 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x2010000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1e90) [ 406.427721][T32629] binder: 32612:32629 unknown command 0 [ 406.434021][T32629] binder: 32612:32629 ioctl c0306201 20000240 returned -22 23:10:30 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfa00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1ea8) [ 406.621957][T32645] binder: 32635:32645 unknown command 0 [ 406.635552][T32645] binder: 32635:32645 ioctl c0306201 20000240 returned -22 [ 406.655003][T32653] binder: 32635:32653 unknown command 0 [ 406.660717][T32653] binder: 32635:32653 ioctl c0306201 20000240 returned -22 23:10:30 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfa01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf001, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:30 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x3000000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1ec0) 23:10:30 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf100, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 406.823577][T32670] binder: 32669:32670 unknown command 0 [ 406.829898][T32670] binder: 32669:32670 ioctl c0306201 20000240 returned -22 [ 406.842093][T32672] binder: 32669:32672 unknown command 0 [ 406.848229][T32672] binder: 32669:32672 ioctl c0306201 20000240 returned -22 23:10:30 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x163404000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:30 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x3010000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf101, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 407.010893][T32689] binder: 32684:32689 unknown command 0 [ 407.017178][T32689] binder: 32684:32689 ioctl c0306201 20000240 returned -22 [ 407.028267][T32692] binder: 32684:32692 unknown command 0 [ 407.033934][T32692] binder: 32684:32692 ioctl c0306201 20000240 returned -22 23:10:30 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1ed8) 23:10:30 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf200, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 407.176664][T32698] binder: 32693:32698 unknown command 0 [ 407.182542][T32698] binder: 32693:32698 ioctl c0306201 20000240 returned -22 23:10:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x263044000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 407.238124][T32710] binder: 32693:32710 unknown command 0 [ 407.257421][T32710] binder: 32693:32710 ioctl c0306201 20000240 returned -22 23:10:30 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 407.311772][T32717] binder: 32716:32717 unknown command 0 [ 407.338555][T32717] binder: 32716:32717 ioctl c0306201 20000240 returned -22 23:10:30 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1ef0) 23:10:30 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf201, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 407.374038][T32723] binder: 32716:32723 unknown command 0 [ 407.385843][T32723] binder: 32716:32723 ioctl c0306201 20000240 returned -22 23:10:30 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x4000000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:31 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 407.477080][T32732] binder: 32731:32732 unknown command 0 23:10:31 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1f08) [ 407.522051][T32732] binder: 32731:32732 ioctl c0306201 20000240 returned -22 23:10:31 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf300, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x4010000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x363084000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 407.592619][T32743] binder: 32731:32743 unknown command 0 [ 407.610923][T32743] binder: 32731:32743 ioctl c0306201 20000240 returned -22 23:10:31 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1f20) [ 407.691652][T32757] binder: 32753:32757 unknown command 0 [ 407.697648][T32757] binder: 32753:32757 ioctl c0306201 20000240 returned -22 [ 407.717405][T32759] binder: 32753:32759 unknown command 0 [ 407.723102][T32759] binder: 32753:32759 ioctl c0306201 20000240 returned -22 23:10:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:31 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf301, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x5000000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 407.863190][T32767] binder: 32765:32767 unknown command 0 [ 407.874575][T32767] binder: 32765:32767 ioctl c0306201 20000240 returned -22 [ 407.897565][ T309] binder: 32765:309 unknown command 0 [ 407.903120][ T309] binder: 32765:309 ioctl c0306201 20000240 returned -22 23:10:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x463044000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:31 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1f38) 23:10:31 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf400, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfe00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 408.054784][ T322] binder: 319:322 unknown command 0 23:10:31 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x5010000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1f50) [ 408.117627][ T322] binder: 319:322 ioctl c0306201 20000240 returned -22 [ 408.142302][ T334] binder: 319:334 unknown command 0 [ 408.155472][ T334] binder: 319:334 ioctl c0306201 20000240 returned -22 23:10:31 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfe01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:31 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf401, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 408.294398][ T350] binder: 349:350 unknown command 0 23:10:31 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xff00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf500, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:31 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1f68) [ 408.320801][ T350] binder: 349:350 ioctl c0306201 20000240 returned -22 [ 408.357009][ T356] binder: 349:356 unknown command 0 [ 408.362282][ T356] binder: 349:356 ioctl c0306201 20000240 returned -22 23:10:31 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x6000000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfa00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:32 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1f80) 23:10:32 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xff01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf501, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x6010000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 408.631047][ T381] binder: 377:381 unknown command 0 [ 408.639783][ T381] binder: 377:381 ioctl c0306201 20000240 returned -22 [ 408.660313][ T381] binder: BINDER_SET_CONTEXT_MGR already set [ 408.667410][ T381] binder: 377:381 ioctl 40046207 0 returned -16 [ 408.674472][ T390] binder: 377:390 unknown command 0 23:10:32 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1f98) 23:10:32 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfa01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 408.687776][ T390] binder: 377:390 ioctl c0306201 20000240 returned -22 23:10:32 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf600, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x20000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:32 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7000000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1fb0) [ 408.878926][ T405] binder: 404:405 unknown command 0 [ 408.898797][ T405] binder: 404:405 ioctl c0306201 20000240 returned -22 23:10:32 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf601, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 408.930195][ T410] binder: 404:410 unknown command 0 [ 408.956101][ T410] binder: 404:410 ioctl c0306201 20000240 returned -22 23:10:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x763044000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:32 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x100000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1fc8) 23:10:32 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf700, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x7010000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfb01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 409.107307][ T425] binder: 421:425 unknown command 0 [ 409.112561][ T425] binder: 421:425 ioctl c0306201 20000240 returned -22 [ 409.139031][ T427] binder: 421:427 unknown command 0 [ 409.144292][ T427] binder: 421:427 ioctl c0306201 20000240 returned -22 23:10:32 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x200000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1fe0) 23:10:32 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf701, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 409.289259][ T442] binder: 439:442 unknown command 0 [ 409.308132][ T442] binder: 439:442 ioctl c0306201 20000240 returned -22 23:10:32 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfc00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x863104000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 409.352838][ T450] binder: 439:450 unknown command 0 [ 409.370720][ T450] binder: 439:450 ioctl c0306201 20000240 returned -22 23:10:33 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8000000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:33 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x1ff8) [ 409.475908][ T459] binder: 457:459 unknown command 0 23:10:33 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf800, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:33 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfc01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 409.501828][ T459] binder: 457:459 ioctl c0306201 20000240 returned -22 [ 409.524152][ T459] binder: BINDER_SET_CONTEXT_MGR already set [ 409.538141][ T459] binder: 457:459 ioctl 40046207 0 returned -16 23:10:33 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x1000000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0x963104000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:33 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x8010000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:33 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x2010) 23:10:33 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf801, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 409.717093][ T480] binder: 476:480 unknown command 0 23:10:33 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfd00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 409.741096][ T480] binder: 476:480 ioctl c0306201 20000240 returned -22 [ 409.780025][ T489] binder: 476:489 unknown command 0 23:10:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 409.792390][ T489] binder: 476:489 ioctl c0306201 20000240 returned -22 [ 409.831106][ T497] binder: 496:497 unknown command 0 23:10:33 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x2028) 23:10:33 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x1010000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:33 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9000000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 409.845630][ T497] binder: 496:497 ioctl c0306201 20000240 returned -22 23:10:33 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfd01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:33 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf900, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 409.896456][ T498] binder: 496:498 unknown command 0 [ 409.901721][ T498] binder: 496:498 ioctl c0306201 20000240 returned -22 23:10:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xa63084000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:33 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x9010000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xb63000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 410.031081][ T515] binder: 510:515 unknown command 0 [ 410.036620][ T515] binder: 510:515 ioctl c0306201 20000240 returned -22 [ 410.048790][ T517] binder: 510:517 unknown command 0 [ 410.054529][ T517] binder: 510:517 ioctl c0306201 20000240 returned -22 23:10:33 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x2040) 23:10:33 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xf901, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:33 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfe00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:33 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x2000000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 410.213025][ T526] binder: 521:526 unknown command 0 [ 410.226677][ T526] binder: 521:526 ioctl c0306201 20000240 returned -22 [ 410.242487][ T535] binder: 521:535 unknown command 0 [ 410.249846][ T535] binder: 521:535 ioctl c0306201 20000240 returned -22 23:10:33 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa000000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:33 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x2058) 23:10:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xc63000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:33 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfa00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:33 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfe01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:34 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0x2010000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 410.426796][ T553] binder: 545:553 unknown command 0 [ 410.438985][ T553] binder: 545:553 ioctl c0306201 20000240 returned -22 [ 410.449631][ T556] binder: 545:556 unknown command 0 [ 410.454912][ T556] binder: 545:556 ioctl c0306201 20000240 returned -22 23:10:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xd63000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:34 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfa01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:34 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x2070) 23:10:34 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xa010000, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:34 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xff00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 410.602224][ T564] binder: 561:564 unknown command 0 [ 410.634133][ T564] binder: 561:564 ioctl c0306201 20000240 returned -22 23:10:34 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x2088) 23:10:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xe630c4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) [ 410.659581][ T576] binder: 561:576 unknown command 0 [ 410.664930][ T576] binder: 561:576 ioctl c0306201 20000240 returned -22 23:10:34 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xff01, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) 23:10:34 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x105400, 0x0) io_setup(0x2, &(0x7f00000002c0)=0x0) io_submit(r1, 0x2000000000000246, &(0x7f0000001540)=[&(0x7f0000000140)={0x40000031, 0x2759, 0xd, 0xfb00, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) [ 410.746368][ T582] binder: 581:582 unknown command 0 [ 410.751859][ T582] binder: 581:582 ioctl c0306201 20000240 returned -22 [ 410.785073][ T586] binder: 581:586 unknown command 0 23:10:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000001700)=[@reply_sg={0x400c630f, {0x2, 0x0, 0x0, 0xf630c4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xff69, 0x0, 0x0}) 23:10:34 executing program 4: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) sendmsg$TIPC_NL_MON_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)={0x184, 0x0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @mcast2}}}}]}]}, 0x184}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0x20a0) [ 410.795534][ T586] binder: 581:586 ioctl c0306201 20000240 returned -22 [ 410.871948][ T595] binder: 594:595 unknown command 0 [ 410.877856][ T595] binder: 594:595 ioctl c0306201 20000240 returned -22 [ 410.892501][ T597] binder: 594:597 unknown command 0 [ 410.898318][ T597] binder: 594:597 ioctl c0306201 20000240 returned -22 [ 563.285484][ T1057] INFO: task syz-executor.3:558 blocked for more than 143 seconds. [ 563.294265][ T1057] Not tainted 5.3.0-rc3+ #101 [ 563.302391][ T1057] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 563.311680][ T1057] syz-executor.3 D28384 558 10481 0x80004000 [ 563.318299][ T1057] Call Trace: [ 563.321734][ T1057] __schedule+0x755/0x1580 [ 563.326299][ T1057] ? __sched_text_start+0x8/0x8 [ 563.342277][ T1057] ? debug_object_free+0x59/0x390 [ 563.363729][ T1057] schedule+0xa8/0x270 [ 563.368713][ T1057] schedule_timeout+0x717/0xc50 [ 563.374091][ T1057] ? percpu_ref_exit+0xd0/0xd0 [ 563.379443][ T1057] ? usleep_range+0x170/0x170 [ 563.384390][ T1057] ? __kasan_check_write+0x14/0x20 [ 563.389859][ T1057] ? lock_downgrade+0x920/0x920 [ 563.395212][ T1057] ? rwlock_bug.part.0+0x90/0x90 [ 563.400773][ T1057] ? wait_for_completion+0x9e/0x440 [ 563.406145][ T1057] ? trace_hardirqs_on+0x67/0x240 [ 563.411455][ T1057] ? __kasan_check_read+0x11/0x20 [ 563.417219][ T1057] wait_for_completion+0x29c/0x440 [ 563.424370][ T1057] ? wait_for_completion_interruptible+0x470/0x470 [ 563.433067][ T1057] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 563.439337][ T1057] ? wake_up_q+0xf0/0xf0 [ 563.443735][ T1057] ? kill_ioctx+0x1e4/0x2d0 [ 563.448617][ T1057] exit_aio+0x321/0x3a0 [ 563.453132][ T1057] ? ioctx_alloc+0x1dc0/0x1dc0 [ 563.457987][ T1057] ? mutex_unlock+0xd/0x10 [ 563.462839][ T1057] mmput+0xcf/0x4d0 [ 563.467000][ T1057] do_exit+0x84e/0x2e50 [ 563.471459][ T1057] ? __sched_text_start+0x8/0x8 [ 563.476502][ T1057] ? mm_update_next_owner+0x640/0x640 [ 563.482050][ T1057] ? preempt_schedule_common+0x63/0xe0 [ 563.487710][ T1057] ? preempt_schedule+0x4b/0x60 [ 563.492660][ T1057] ? ___preempt_schedule+0x16/0x20 [ 563.497907][ T1057] do_group_exit+0x135/0x360 [ 563.502827][ T1057] __x64_sys_exit_group+0x44/0x50 [ 563.508153][ T1057] do_syscall_64+0xfd/0x6a0 [ 563.512770][ T1057] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 563.518846][ T1057] RIP: 0033:0x459829 [ 563.522910][ T1057] Code: 24 60 48 8b 42 08 48 8b 4a 10 48 8b 5a 18 48 8b 72 20 48 8b 7a 28 48 8b 3f 4c 8b 42 30 48 8b 52 38 48 85 d2 76 62 48 89 44 24 <58> 4c 89 44 24 28 48 89 0c 24 48 89 5c 24 08 48 c7 44 24 10 00 00 [ 563.545237][ T1057] RSP: 002b:00007ffd492e0ca8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 563.554795][ T1057] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 0000000000459829 [ 563.563209][ T1057] RDX: 0000000000413511 RSI: fffffffffffffff7 RDI: 0000000000000000 [ 563.572109][ T1057] RBP: 0000000000000000 R08: ffffffffffffffff R09: 00007ffd492e0d00 [ 563.580744][ T1057] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 563.589019][ T1057] R13: 00007ffd492e0d00 R14: 0000000000000000 R15: 00007ffd492e0d10 [ 563.597535][ T1057] INFO: task syz-executor.2:577 blocked for more than 143 seconds. [ 563.606066][ T1057] Not tainted 5.3.0-rc3+ #101 [ 563.611984][ T1057] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 563.622359][ T1057] syz-executor.2 D26472 577 10479 0x80004000 [ 563.629341][ T1057] Call Trace: [ 563.632768][ T1057] __schedule+0x755/0x1580 [ 563.637650][ T1057] ? __sched_text_start+0x8/0x8 [ 563.642653][ T1057] ? debug_object_active_state+0x28a/0x350 [ 563.648653][ T1057] schedule+0xa8/0x270 [ 563.652857][ T1057] schedule_timeout+0x717/0xc50 [ 563.658201][ T1057] ? percpu_ref_exit+0xd0/0xd0 [ 563.663071][ T1057] ? usleep_range+0x170/0x170 [ 563.668137][ T1057] ? __kasan_check_write+0x14/0x20 [ 563.674064][ T1057] ? lock_downgrade+0x920/0x920 [ 563.679489][ T1057] ? rwlock_bug.part.0+0x90/0x90 [ 563.684462][ T1057] ? wait_for_completion+0x9e/0x440 [ 563.693071][ T1057] ? trace_hardirqs_on+0x67/0x240 [ 563.700664][ T1057] ? __kasan_check_read+0x11/0x20 [ 563.710738][ T1057] wait_for_completion+0x29c/0x440 [ 563.718815][ T1057] ? wait_for_completion_interruptible+0x470/0x470 [ 563.725835][ T1057] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 563.733164][ T1057] ? wake_up_q+0xf0/0xf0 [ 563.738150][ T1057] ? kill_ioctx+0x1e4/0x2d0 [ 563.743904][ T1057] exit_aio+0x321/0x3a0 [ 563.748206][ T1057] ? ioctx_alloc+0x1dc0/0x1dc0 [ 563.753170][ T1057] ? mutex_unlock+0xd/0x10 [ 563.758022][ T1057] mmput+0xcf/0x4d0 [ 563.762141][ T1057] do_exit+0x84e/0x2e50 [ 563.766553][ T1057] ? get_futex_key+0x1760/0x1760 [ 563.771976][ T1057] ? mm_update_next_owner+0x640/0x640 [ 563.777570][ T1057] ? __kasan_check_write+0x14/0x20 [ 563.783221][ T1057] ? lock_downgrade+0x920/0x920 [ 563.789551][ T1057] ? rwlock_bug.part.0+0x90/0x90 [ 563.795041][ T1057] ? get_signal+0x20e/0x2500 [ 563.801929][ T1057] do_group_exit+0x135/0x360 [ 563.807240][ T1057] get_signal+0x47c/0x2500 [ 563.812097][ T1057] ? lock_downgrade+0x920/0x920 [ 563.818736][ T1057] ? __might_fault+0xfb/0x1e0 [ 563.823983][ T1057] do_signal+0x87/0x1700 [ 563.828946][ T1057] ? __kasan_check_read+0x11/0x20 [ 563.834133][ T1057] ? _copy_to_user+0x118/0x160 [ 563.839017][ T1057] ? setup_sigcontext+0x7d0/0x7d0 [ 563.844360][ T1057] ? do_futex+0x1dc0/0x1dc0 [ 563.849092][ T1057] ? trace_hardirqs_on+0x67/0x240 [ 563.854414][ T1057] exit_to_usermode_loop+0x286/0x380 [ 563.860324][ T1057] do_syscall_64+0x5a9/0x6a0 [ 563.865162][ T1057] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 563.871823][ T1057] RIP: 0033:0x459829 [ 563.875967][ T1057] Code: 24 60 48 8b 42 08 48 8b 4a 10 48 8b 5a 18 48 8b 72 20 48 8b 7a 28 48 8b 3f 4c 8b 42 30 48 8b 52 38 48 85 d2 76 62 48 89 44 24 <58> 4c 89 44 24 28 48 89 0c 24 48 89 5c 24 08 48 c7 44 24 10 00 00 [ 563.896602][ T1057] RSP: 002b:00007f77ca40ecf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 563.906035][ T1057] RAX: 0000000000000001 RBX: 000000000075bfd0 RCX: 0000000000459829 [ 563.914367][ T1057] RDX: 00000000004c0c19 RSI: 0000000000000081 RDI: 000000000075bfd4 [ 563.928260][ T1057] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 563.936818][ T1057] R10: 0000000000000001 R11: 0000000000000246 R12: 000000000075bfd4 [ 563.945363][ T1057] R13: 00007ffe78d824cf R14: 00007f77ca40f9c0 R15: 000000000075bfd4 [ 563.953845][ T1057] INFO: lockdep is turned off. [ 563.958710][ T1057] NMI backtrace for cpu 1 [ 563.963542][ T1057] CPU: 1 PID: 1057 Comm: khungtaskd Not tainted 5.3.0-rc3+ #101 [ 563.972934][ T1057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 563.984757][ T1057] Call Trace: [ 563.988322][ T1057] dump_stack+0x172/0x1f0 [ 563.992841][ T1057] nmi_cpu_backtrace.cold+0x70/0xb2 [ 563.998433][ T1057] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 564.005255][ T1057] ? lapic_can_unplug_cpu.cold+0x45/0x45 [ 564.011515][ T1057] nmi_trigger_cpumask_backtrace+0x23b/0x28b [ 564.017833][ T1057] arch_trigger_cpumask_backtrace+0x14/0x20 [ 564.024087][ T1057] watchdog+0x9d0/0xef0 [ 564.029758][ T1057] kthread+0x361/0x430 [ 564.040878][ T1057] ? reset_hung_task_detector+0x30/0x30 [ 564.047189][ T1057] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 564.053662][ T1057] ret_from_fork+0x24/0x30 [ 564.058516][ T1057] Sending NMI from CPU 1 to CPUs 0: [ 564.063840][ C0] NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0xe/0x10 [ 564.064774][ T1057] Kernel panic - not syncing: hung_task: blocked tasks [ 564.080477][ T1057] CPU: 1 PID: 1057 Comm: khungtaskd Not tainted 5.3.0-rc3+ #101 [ 564.089281][ T1057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 564.100362][ T1057] Call Trace: [ 564.103750][ T1057] dump_stack+0x172/0x1f0 [ 564.108171][ T1057] panic+0x2dc/0x755 [ 564.112198][ T1057] ? add_taint.cold+0x16/0x16 [ 564.116991][ T1057] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 564.123121][ T1057] ? printk_safe_flush+0xf2/0x140 [ 564.128222][ T1057] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 564.134854][ T1057] ? nmi_trigger_cpumask_backtrace+0x224/0x28b [ 564.141260][ T1057] ? nmi_trigger_cpumask_backtrace+0x21b/0x28b [ 564.147469][ T1057] watchdog+0x9e1/0xef0 [ 564.151681][ T1057] kthread+0x361/0x430 [ 564.155866][ T1057] ? reset_hung_task_detector+0x30/0x30 [ 564.161945][ T1057] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 564.168363][ T1057] ret_from_fork+0x24/0x30 [ 564.174180][ T1057] Kernel Offset: disabled [ 564.179120][ T1057] Rebooting in 86400 seconds..