[ 35.548881] kauditd_printk_skb: 9 callbacks suppressed [ 35.548889] audit: type=1800 audit(1585823826.487:33): pid=7237 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rc.local" dev="sda1" ino=2465 res=0 [ 35.576117] audit: type=1800 audit(1585823826.497:34): pid=7237 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op="collect_data" cause="failed(directio)" comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 38.585208] random: sshd: uninitialized urandom read (32 bytes read) [ 38.858154] audit: type=1400 audit(1585823829.797:35): avc: denied { map } for pid=7410 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 38.913467] random: sshd: uninitialized urandom read (32 bytes read) [ 39.805355] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.45' (ECDSA) to the list of known hosts. [ 45.482493] random: sshd: uninitialized urandom read (32 bytes read) 2020/04/02 10:37:16 fuzzer started [ 45.724458] audit: type=1400 audit(1585823836.667:36): avc: denied { map } for pid=7419 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 46.151381] random: cc1: uninitialized urandom read (8 bytes read) 2020/04/02 10:37:17 dialing manager at 10.128.0.105:33485 2020/04/02 10:37:18 syscalls: 2937 2020/04/02 10:37:18 code coverage: enabled 2020/04/02 10:37:18 comparison tracing: ioctl(KCOV_TRACE_CMP) failed: invalid argument 2020/04/02 10:37:18 extra coverage: extra coverage is not supported by the kernel 2020/04/02 10:37:18 setuid sandbox: enabled 2020/04/02 10:37:18 namespace sandbox: enabled 2020/04/02 10:37:18 Android sandbox: /sys/fs/selinux/policy does not exist 2020/04/02 10:37:18 fault injection: enabled 2020/04/02 10:37:18 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2020/04/02 10:37:18 net packet injection: enabled 2020/04/02 10:37:18 net device setup: enabled 2020/04/02 10:37:18 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2020/04/02 10:37:18 devlink PCI setup: PCI device 0000:00:10.0 is not available [ 48.151315] random: crng init done 10:40:19 executing program 5: r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ocfs2_control\x00', 0x1, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000040)={{0xa, 0x4e24, 0x3, @mcast1, 0x7fff}, {0xa, 0x4e20, 0x10000, @dev={0xfe, 0x80, [], 0x1a}, 0xd424}, 0x2, [0x10001, 0x8, 0xfc000000, 0x8000, 0x2, 0x6, 0x7acd, 0x101]}, 0x5c) accept$packet(r0, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000100)=0x14) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000140)={0x2b7}, 0x4) openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x129480, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000240)={0x14c, r1, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0xb4, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x80000001}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_CON={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x8000}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7fe}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}]}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x100}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x39}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x400}]}, @TIPC_NLA_SOCK={0x84, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9a}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xb2df}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x101}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffd}, @TIPC_NLA_CON_FLAG={0x8}]}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0x40000}, 0x40) r2 = syz_open_dev$audion(&(0x7f0000000440)='/dev/audio#\x00', 0x9, 0x10000) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000480)=0x8001, 0x4) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000540)='/dev/ubi_ctrl\x00', 0x303a01, 0x0) statx(0xffffffffffffffff, &(0x7f0000000580)='./file0\x00', 0x800, 0x10, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(0xffffffffffffffff, &(0x7f00000006c0)='./file0\x00', 0x400, 0x800, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x1040, &(0x7f0000000800)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@aname={'aname', 0x3d, '/dev/ocfs2_control\x00'}}, {@version_9p2000='version=9p2000'}, {@cache_loose='cache=loose'}, {@uname={'uname'}}, {@aname={'aname', 0x3d, 'security$,'}}, {@afid={'afid', 0x3d, 0x3}}, {@access_any='access=any'}, {@access_uid={'access', 0x3d, r4}}, {@afid={'afid', 0x3d, 0x7fffffff}}, {@uname={'uname', 0x3d, 'TIPCv2\x00'}}], [{@uid_lt={'uid<', r5}}, {@fscontext={'fscontext', 0x3d, 'unconfined_u'}}]}}) ioctl$KDFONTOP_SET_DEF(r2, 0x4b72, &(0x7f0000000d40)={0x2, 0x0, 0x16, 0x17, 0x1e6, &(0x7f0000000940)="99606c0c22aa17b11a7b042ec638cfc563f2dd1f32cf0fcae45320e8d17ec6bba13ad1c0930ef4890e11fe6c32f750586760ff1965c6e14cc2da8093403bc96aeffea598ae9c706b755494a218d23fffb6e99b9683f4d879136873049537649e9711db691edd18f7a38e596ef910f4df84ecf3402da799153c2924c346e9ef3dc680f9cb1d8d3c94d2b71bdf3a0a2873bb6734967a923949a26803bf8f5cd47766506d4bcfb1e4f8f7c1b3e2b43af6e25ecbe913e67482f7f1cb9cac567d42cab960a9684a475a06e1f9a55c014dbec6ee8f041fa87e9fe72d3105701dfcfca8798a4e769f8ede9edcf01bc663a2b5de00cad796f2f3bef1bfd2fedaf61ca15ddbb13e1985faa10148d397b6caff1461f973ccace935d09f14c8ad6fe3ff8d176a18b3a5062c849324b098a4483aaf3461f46fe7a46dcdb084268e5f066e7dbaf2f17f6dd865b587b6b7266c070ea9fbf2977087d884223ad043d5a5edb78598097796ac11d8b63bcda4ac9e37467066339bf6f8cc2be220968b6a10a6dbaf494b5a5f9a1ba40a005aea8c881b50b20d02524ac11bdbba7ec4879bbc4c6117a4dd8c1bca3448cd309aade4886dd5d0f6cda4a8359b61fa586498b0a797fc2e1430266f583dcc2cdab6745811d7e9427c283a0c74d431eaa0f658708d605e39a8c0b9a3fec83bc34967d4d79fd4f80de068ab6b4afad9d64ab5f5a2828ad09ad22c72fda22de85b3a8ae4f93c2829b5a9476dd13657a2721e9c46a4a5946d9a099f996cae3b0c7b7cbf775a30b21954f342fbd1654438b9b382890bbf5cd855be04ae5fa27fbec869e3bdfc32443e0aae1eba5ab17ff13a658588e68ac99a7a435b5fa49232ef363cb5d5719cdebd7de88ae797c97c21a29a8eee8d7d1cfe0112a1055c8a07c0b4f13195f79c08f73416aa4a73c460fcf0cddbdb7ecdc4e5bba10ca8eaf85d8b462fd25829b48e8c60ce8d78239fbe0dc1e0990eb279bfd2736807a80ec713b4599de7bd07aab78bdbb20124669cffd7e16803da389ffbc62708fd2106290211c5bc571137ab9888d1f40ff44f1e90018465b16a9466fca9707430d6f63bfcdfd1cd0c69d856bd81b2f99d1685e416b0e04c0626914fb96af46f0af0d51b7eb1a8541842a3a6f353338898a4b8142cdaf4a9adc5e8772dafc2ce7d907270f322d795a49d506f6212b65688dc4551963daf883ce197f34fe69be55f5dd4dfac21f283391d3eb189ddfb74b6280c8dc8028e4b056244559b6bd4e7003e8c9ef601b4c64a2793d5b8cc32620610ec00f7d4713818bff4fe0b85b1260729b84b291583a785014786dc6de0ad387c30c37d80c51673a7fe176c13256a452425347775488f8546adeabf3038a703fea1daf2f5d4f02951ceae8566d5270c61be81400ad73c53906353f0aed42a5a47e22105bd8f8a44f3ce840cb02cae"}) syz_mount_image$nfs(&(0x7f0000000d80)='nfs\x00', &(0x7f0000000dc0)='./file0\x00', 0x4, 0x7, &(0x7f0000003140)=[{&(0x7f0000000e00)="d90b929cf6373666bd106f52eb96e31f0c6fc3b0438a96c15e386839fce71caa1765aa4d69519eac89cf03042cfbf3413ca2814ff0235b7e8464bd703a902b79e9db6c49c96d8d8b4620db3ffce4e3c8867e7239f1773a6c351ec01c048fe35330942b821f3f8fc9dec3d31f23e79a0d22d7479a447f4ec35f93f76ff05e16e3d2a3d0d6afb4375056e6f0ad0e8a371165b36bbfc03e55f514f2383c1633d0e161db383d647b092f6c8c112056b13c0ddc0f63b3b4bc7bece543dcd4e9fbaf51ddeea1551a0fd77e13c3cae8c142daac6089a89ba6e6068521eed6a5b97c807280261f7e31d7b217d15e2738ab4fe0d2453f40ac4bed62e26da75c116d7eba27a4ca7e91283ecc2ec50fb2d3af35a7e627a01e46f5931ef46e67c8fb2e9e970786a96f9a91ac8e70f9fe342f6104e43db04068bc1326a8b0e434688cd5210ae8905a3283d455d5c512eb6166e0afc1027024d74c1b9779f6649cdd5cf2f581f94e6b9522193e7d60fd85d72b117499d4294c13dc2a7358d26d85b62652ac803fc53703228eed2d13acd7c0a731bedca6564397f3ae4558d4a0c548026464131356b749a86e487a378d07411ed8fb922eb541885930e7b4276e1d15ee1bca68651a6ad76641ffc1de303adf47a8d0fceedd7be4a20ae059fe12e87c961a2448eb9960817d0ddeffc6791ff95b57e084aa2acc503402d85cb45f573a951959885c0209bdc072626009e184137036d7c4df4cd842f3dab8c412dbafcfe20c5639a6880293141be5bc70c21dec2ed055abf9c608e97972ceff1fd44defe2038b5f2b1fd145264c9d6a9c7e694118b984a236a714c090b5f3686bb814272e061dc89a0d03c1cd8352fe3706d3efc9f3d5158e69111bd8adb0ffdc9966bfd3122d1eb039d4997c2ec920e1a27089e32146edbce14786f446e96cb1786947fa375d38c681c38d61603bd19ff57c0544e6472c9991c9f03b20a8b5b0554d2446aebb4fc3c2e0c3a798c0b093eb423d39d6b6d88b3c62041be590c3217128aacfa6beb4cf92ad5293564131b0e402968a205235ae9e042041bc62d313b8b25c0f8f27c1e5856209b4b00c08c940707791465667646b65bc717cee4e464dbd59fc6be628a1cdee2e5c02b137d7d6a5989025e703992f309d3afb216bdd5e99c3a6ab50c72b1fe5861b5125e5d07dfb859a31e45da56b5f7e9113ae80d744da7aae9673ab460125a6e9cf81212d7a6be7d663ae03ef3b2c49b761a2466d9ecece1d688bdc9b37d8acad843b21f8dbcd9620d8f76acef1a290ada2d77905160afd5f042c2e7e1714ca5b491baf7e9ddad027aaf85fa9eb590fa9f9da31353bd2d8f73a68417b0426ec0a799e09b3362d7835bb478f780fd5bdee1bf1921d18a1688fe557f69dc24084920912a46ff831cfdc8e82650a122aa000d9af16d2762d05faee34658c65e7ad8e8a3799611afad1340b215577270dbb3a9b653477e7565e935caebb81cf43cbfe713ecc7f802c0501cd68d4061db190383d5caf49c0523bb2b56ed29cfab1aeab18fae7e4fd57f51a862ffaf2f86f1989f4aed94428b8909ff4b94160ae2920f1f374b8615c574ab0865a53f81f431980a19394fddd4a4ef42d9c558bf1ce41649d1d12088a8bfd9f731484a2a421521e7b835bf545caaf99ab382389a037c8dd4a0c73f76e5723b6e4a763d693d8a57f4eb1866892c408d74572926dacac2692fbf81138082b9ccbcd4ff6aa8d20ff99ba787ba319f5008b62d9f8c94ca952ebb73bd3348ea2858ad6d313d7e54934ca7c75c41dd8402c0639c648e7ce9f8b013caa4e0b4e7b72eb421bcef7555622ce3740e7eeae3e417ff05ae41758eab554fa4cf81fb9248f354a3439f7e3d35fb18e345f3ea72bfcabc0823766b46f45e77a6f0c944c56dd5c05ea1c70a11af36a0dec0ea09759678441481480540124ca95fc771ab4a04ad7f55b1eacc66b9a9ddf41ba051fb554b696affc20e64da01b31d86b6aa275da73db303685bc8f083d8608fb70a24d31a8f03a40a3872b3ca3436054d8f0cb65e17e08dd8fe91fc8dc8ccbe4b7d2e806b92a90ed64fc39c1740170df01d37a9b6c864962ce9af66487344165b007d7490456a9eb2e8339cd84d5db715670af15d982cca8ea6cdd56f5c33040e93f8c0189b704512becafa47de62bf461f7a968d6fe98703340dd4885dc6ee08ade2773ac538396d31e42609c6d41f31d1c2674fcc780d3f4ed15d8d0468d6a10c121b3758c40d2fc37686568c433a3587076078a2e258d4a9055701e97904182c25151cc906b7782584fa97da2a74d289a698e73a697bf3c8e103cbf2fca735e711334a685b0dcedf091690bdbacc03b3125b6221f6ab519d17786de77e1222bbdde288fe1adcc30366b3a21386dedf9c89767b8d7eb2c3813a1b430521da47d91816a599bbf698cb80a10bb50442c400f1d998d147d880da715ba6307966dbc4b216fc809dbd5549cdb5b01a5474af03b0577bc19db4c8f4fd557490730d1b7202049c112a656492134bba0013628af416242e5311adae403912ef22f6c9486260080ad4991051de06670437eeda6e8b57af340fc4a2d24f31edb1b15e8e40d131db2d6d5c049209d40018f0c19c2f9b246ac8a48a018b7456c33e2de88507c989c7d4051770c5be91c56acc8e59b90fe343c93e75e62cdd87b1de0bd8996fc67dce87ecd8bae17264365370c27e92d8201487edbbfa8c0c14f43f83f3beb67662dd076a557d16a89165f004d84766e829b3a2d7afe1e6d4a29d6480e460d8452301ca901ec6b813a376b4a2dca38591ddb5860b4b96c2ff753a7f0fd0a494cf664d42f3c109e6f5a4830eb3c7200103126954af93f6091e4a519e109a1b7ec3e6dae67f6597fd4bb8c799baa5c09c1838501c8caef354068ea11486ce6eefa97481c6d751e7ed71dc50530630f6d6701c26c06f6ac5fa01344eea584e39eaec0ff7f4aeae878b05dc1a2b1f7873e54bd29f635a37eaab6fef435c5c04d020185b4d0638e99cc0566e9e9190dd2ea472500737bd9c2aa4d3932a2331aa97079b772e190167e31810f39178a22b1a7b222dcd8b0ffa1809c2dff14abc47738aa4f3676d5bfaebbe02927b8072be3945bde6db8ff9c32a162bffa35f6908e0738bfd367cb98f18076bcf3a778ef5c6fa8ede0a3c340c028fa9176f79b14a128aa6c5182de1191a75cc1605e839cbd457b71ad87f39af22a6fe6e026a8cd5e9ebeee59b577f8c56f96fd1fc7514ff79a8084a6258552239192766fbdcbb94fd99a43eedf9c87337cee4a78a5618c9827fd1730d530eafe2c26ecd7280dc6d1cbb989708b76e1cb01fc7b6e4693eccfd4d9b437bb98253778c886b50baae1c83f5f7506ea08dbfac7ccebb99537fbe8fc4363c89a017e697ecf9695dc1985a1591147a5aebd0ddfdf8bb3a9752020c19226f4abb2deda44a2259feb542d7206bebbcfd5b2ae7149c21ddd2f8f20c48670ebf1fbc0bf76d866004c5c09968f7b5f2df75bad0976a98e8b7f16a6fedb2c1f056dfc664f29fbbf59f1dad464028558d784d65f714eefd84f3ef7ad03c2feceababb5d05d9eb95269ac04589ebe8725aca942242c4a6c5cb38645e0732d44cc2059288730751733babfd367d6975c7bedb0a04f2672bea4cbcae1baeb96f1a8f7769b4e9356f3627441f169a26bd6e51d62eb601141886d866e1dc36480c7e1fddf1fbb84b5415de5a294504f34a4bb1246629fb2f1a40b3354ff50b506eb8ac2e576cfb4f8113a2fb6fc01011deae2948b7f351020fd409b949cc63f28f3095ad3b4aca4696c7ff2d0a24ffa04bf70522573f59dc752f500e7419c4cb4b15b7ce4c60a562d1bffc01212f44f6dc688f59fc15f4f5842ddcce9367517697ac3842e6bd786cb21f6c7bd2149c1a74ca5d7774f8c7dcd5b7dce920964f616aa387bb35d875e12ce8c064f52a2717afba91de2228a900c59997b90640c848253e303196141c05eebce1badbb3b7102347d8cf4c0f32022f68defad664c5732070569cd536390e79bb83641c17ccf8cbe9b1548f8795f25fe5023d5a0750560b15256cbe9dffb036bf8546795c591c31e85cf579596b44925d85b0469e69f47cf243fb86ce8f1d5823781a312cb0a04e085cdb1c41356e775ff84a85b5d8e9a45e8fac561b0200e4c232d73bda98d11f4ac93ca5f2a8e706a69fa6116353cc9d898248ae00c1bd53f1a7bb5f2eb7e14f311d083cecee550f4e7ea7aa749f038690aebbe39c3ddb9d6117462c64ffbb9c28b0b2adc29e466aaaca97133426a8339729a822a2d66c270811cbae736d7fcd5650750660bf8a7d4ec6936de7266f8ebe69a19a3e10069725ae5d799fb9bffe180db5ec76bb869ed764d3154ba179d213aea885b0f1d1be14f7fca81cb4edd8ade8a402dc4b27fc0ebf62deec53fcd5b6a47ca195617197767fc282e3f348d855dfb99ef152a67601f7f9a4808f3d5903fdff8dec50bcb7ddf982e6c3f7efcc3bcd4e008935bb07a4e01635dfd61fcadd7fb6800586a4a4ae9417611fec9657f634ae62572f1a87cd3924a37222954f2f18bb285e3dfcfce500b8fb1666ae085eadf862993fec0e1736f7b06a7f2699eb6f7475282c7f68b249de67ca867da1bfe966bf349e3dbfa72a611290578eec21c5fbfd7819351e59d7c4cc02e4629f48c980d78c8f5b9b771685e5733eb89575149cd5abc3914a795fe7b2b2edf2d80e1855c78f33a43463f441b4db06416c366af46354e37d95fb4346f7a16616443f8b13a14d8dd7998b0e2882f78e2f8150591e7c88cd7810cc63a49d060403b76794d6954aa6271b2f2f86134b2c1877088775cdab07415367bcd3bd5b90b27531d33a0ecfee801586d8dff7ac47185012c8a2844987bf669b18fc3e02d8a2097c220f4e25f7d699a6dbee1eb175f7ab7d62e34c521765ca1d03a2710c9e648dac2482048392d05a82955757650ad3a05c5a34b6f1b6881f76217824610acd2ef6b68bc5ba86a3cf60fcdf9440a42acc315c3f71c135830fe27e664bbb6176c9b56e6beea65f2fdbae0fe9382fdf81ec11916781a939d35d333265a49d548de9b28d4189c3f0d2dfc910fa6c51b6749386c9fbf1f56ac1054bba10a6b486926a2ce918b6f19b4e286092667b1e59a9ad6dd7bdc687b9b4efab56acabf0674b75e1c56f7f3c134ac6d75fd19bb37592b211192f04b5513d4cc98ca915cd0b2a3084ce63ec89319618c84ad22f5ed572d613ea58eaf0a19ca51d8370fcac9a1fc638b6db8edf7183be260df7e881ffae58bdf8c394afa79f4d19796ec211fa5e4d8b26f1d4aef88d67c206a8230039f7687b9bb26e65404aae44058c1b4f44c70f6d9a6abdfcacbe3cff9c67580a80c59aaebd46814c6f2b4263786def80d6fc20f0dfce96a0dbcd40391721e86e50a095d26086ca1ca35c04ec570aff9eddd7d09a0a03f0c18547ea843af2d023c3fe695926f269b633698519a788b4f2cf68247cfd892090332a783fbcdcb10e3372c43018e680d036a997f0355e795f70e8f266eebf3a55d3452bf6313c1fdaa90cc09a8eab0b42cd5db416cf128489b65d90ca76e0be385985a1410b41842c0e67509b7921c8cff6c7916c1f3283956519a261378ba678d83b27a33606687adc2b602f5733544c47824021da9afdfc85a715fd849e1e3ad6b2ce7c9f8ca9fe2a7166c4f0f4acdbe05be52495b403c3c2bf293bb59a725cf565d17723fd38526794e9d8102eb445ac134945fbca6a20ac8a41ccadfb6c8922f8d22e519", 0x1000, 0x101}, {&(0x7f0000001e00)="0ae16a5da53db982e76c2de5cca64751a5cfcfdde9a33ae600a627e243acec0f5b74994ce1bfc6f53eaf0f2e52fd4ecbcf05a02ca81e93bc9592d9b9980bc7f4a5613330cf6a5f88812750d28229c078ceff0025797e96d7e48d16d0a83ce7068743920886e6bd5d9746882bf5ddc086f0c15ad16c5012b644afe59d46ac668d629095ed15b61b1f60ace788439b43023540e1f3833c28a50dd3f02878a1f0e03602dc7e67e5fe1f6dfc6520d358ec67f77870e59aff3764e738f47c83f1c99437f7", 0xc2, 0x4}, {&(0x7f0000001f00)="5185af62538ed7dde7209242006b502e93698c30394a09b23e99a8364f810a9c2723ddd90b39efe25c95a39473dd45c69cf05384a8042ab041870124b8d13a919c3b61d9085b8cb293b8e67e10c0e98687e3b59f88cd2ea5aa79b41e4264efda4c171ebce958cbd926586845a834469d4b09b91927656391c1b9c7642efd8cca0554e9c794f43201623636c24188e66d8c31aef98b96624203c04f", 0x9b, 0x26}, {&(0x7f0000001fc0)="487cf31edbc23b4c3514c099d62d1ebe65045be9265aac6be5dc62e33a312d6d1e3e6f90943719e9e3812b0397d82a8ad2045005a0d961f6d923be9c1b6317976395953d6a559be17aa6fbc9fec86ec9bd08a193cc53b2528c287f004c120123f1fdac19d051964879ca9e1582c68f66f5", 0x71, 0x5}, {&(0x7f0000002040)="3628a5a7802d90a0a8f3b19735f113db96b608b75fde25d24d417db45a8197c13e23bd0d210e4f2bcd8ae8d71c6d6eca1c83711c38b2a8b1e852294bb8510b30da51fc26b1797671f830f2fdfc0891265d15ea16", 0x54, 0x8}, {&(0x7f00000020c0)="269a5becc8024ed65066f02584f8dd2df5c14edbac7da0f4e4532ced270a57ff136cc0dc737bc470539b71fe5441dc3c3112e1aaf226d02e36eca44ecc5d58d868b827a3fa122b526fa905801b0c30d3608a5302cbffa272f4bdf4c9383412e4d1c3c50683496b0252536a5b544a4ad25006c653df8cb0084cb3ec0b547e691cd9d073dc829fd83d425229bd4c8943f863ee9ec00365426c2fe5ea58ad8a7f5f3dafbd664c63992b4afc0a0a2ba9f8a55ab93de4747ddb357998a8a53290892ab473b358f8d9b623041c7fb17ebfb438f625401b97f8a20af6029e9141f462c1df5a54322026711fc2a2e815fc3fc030116b4b940b9c2b7f8f8f3daab0bb02e23196a43ee1a867b111393174bfd8aeb6f9bb3ef060a647157341b974cd88238e6e7cc273947eb7329020b405f583960992cc533fed33654af736511086216f82e7abc6ffec5715aa7b4d0a6038242931fec1216d4b2f58c99e78621ea7816fc2941a51b730c88c6c7748a6bc5e2d66144707fa87480c2fd98e830263e6eaac8dd51056b13d0e1c76c958d25d54d17288f89b0bbf11965f71146f71e72250e52d1fbd9a09a5dfc726a761125777ebf90ff475c8a74acd8e9dc2232695dc2ffafd46341a34bd973c7851dcaf4009c726c794090f95d39fd58021cd8a486f8660480449d792a7bf78a2570803c1833fa17b9130f09cabebc486a188324e0a6b59977b72a29fca3341d200bd20de53a46d991722aa80d597b01f10f05f04c2005662117a53ff2e836355378291e5425871faaadceb8d9018efd46a42c965ee48ade1c1e4d883193e308bfb71adc209b6136d7eef3ded5d01422cff1602aa1f0cc150cc5aade9709a06a92f8e9de61784af6583e3f6fd35d1bd70bfa436cdc6b52c7a8007e36d030c7c8374ff8156a4c326dda0b7bb48d70d3c52626ea69fbbaca9db40203f06d13de9cf1a19ef8df4532345b873bf65094751bbe39c2b4a8b89d0cad3b97c4cf0b5d0e1f12c7f7adf27014b040c88fac06ea0882b3de703bf73e3ff9707e59134abdd18d34b8bd7d2b37fc336a20adaf8ea2ca7884161b04b029fde2b4f973d0045160f83ac935df80211b450b857161ca669ba6aa963526edcce210ccb7ba35a8cbab53c90a1ddc377384c875196ebf8d18e5a58d513d2d9a4195155fe0e0cb40137b1765258c5a4ae79be4c0d79e32045bebf1b391b5d7e0b994404232e1e95c4b35366308bc183cec3ba0b0b4b0e8fb8b07aebe8036b6f3a131ee146578b7bed034d9174aa2c505dbfbf46d346d0a1685674bac610087813450e8866b6a79fedb8b8a06dcfdec4e4dea89c618d8a352a0688487d38960e6415b8600a2bf02e95b4c9048a598977f19e17d2ce41c4581f8f5e65f39065658bb5d75c5abec608dde46ae1fe9a3cd531fcdb9ba2c7f728941df1874433ae27b7e19f81d1acb0b9bf11d3089a98d89c45129354f3f6e10b8fe2d933a941708df30058e96bec14ae581ebb971ae96d1995a3622a1b604f42300ddc83c7d9116424c03d965fe43eab7074e5625b9797127b20ab81459bbaf77988d83aa9a16231fe46f431efac44176217be7c3b176f01eba5b167aea403b546e4c343c5354dc2da30d4345f0b7992f30ee7fc7ccd45c4e135bdfaccd3e7a36ac16e905ada9874fd3e81a41e57600fd1f452e6678819bf8c81c4fdc55413a9e119b7cea218efeb8534aa024a4bfe253cd33516e664501bbdc9989c560760c2eb06746d3a57203fa46b1e1eb63b45d0d5a2035ee74a34298c69558f17a395d3452f47d8889d56e87e0d3cfbdaa998351264380b77d127014afd99124137b6f70b7bf56f33e524626c10e54dd040e697db70d306b22420988f3e05657166ad834fe149f97e1da8e0fd953b6a10ad95fa1f48e0280f9eacc4e4e7f7e0a039dc29d717fc27c40be399b15a4bfb19839bff0d880c85cd079a6442b297ac8906c9ea811d8268df8e864cd00cb27ce251fe9070fb2054e5a3f8c4fb26b825cb4b034b214d66bd104fa7eadd328abc09d887e9db1c38c1e81f7f47edbc8b8e1d0278a5ce910f8b02c5062558d185e82be4e9d85c3580e859639bbdae4040b64d59dab6d6b6be1e1952d48b2edbabdef3e1834dc53997e91767a87dfe64b2f26587ddae264a5cca6fefc2486e9af2bc45bf43838cfdcfb4a767623ac626aa9e8965dfc33b9aacb6430ee08c17035da33d31654cacd47f7fc8bd5d150084e3b38f9499062639d6c7961889ac4d679a5f23376e8a67b9c24794bbf3dadcd930de3108d62a1810d0255bbdc563a58369c88c50f39b3aaa2096bf9da728ab44ae3ef1fb8e2be2e6bbb5c63d948d659b9c02999eb522083db49c514da71cef3337cddd31932e9d4c7fe72ef7081c8438bd170a09f673bf06b0c154a761220a89b3d058c3d00072b456e1624b507d8ee1ee7b3b611adabd8d0e4ba371c7f2ca0938348c2f992fbd2079451da72675ee8275a0c1c7ebcdc4bdb33bec5f16b5c0ecd678b2db85ee0f33caf1c3b0dba5bb7f08d14ac596afa27930c45288af4fc93397b8105968259d43cc72cc9652e86f7129f5e9878a1b9771b1931a93299e55af9fb4ab9ef451522142bad6e8fc01811fa399efd4646ea92a98be11ca411615a3f6b203b90bb4baae914ae5eaa371e719d50a87ca3de88e511c48f683bf10603f96aaff4348ff17301a537be400143991927e7fd892699bb6ed6edae7d523cc6a000d6846210404523633baf92da4b12b9d487b732cb3777d758e85dabbec047b185e51e632cd8bbc2e74cd3740127c5584cd53f4c3de897e3923e9fdaf9330258e7782044c9bf73ff5eed92abd97fe7c861a858abf092bdd755fe9166c219ca6a840ebc4130c1a2b7bc38a9349f4e74ba8df513ac5600a47f5b21142f8c962470e25d3c26a6441b204328a59ae07204f1bc39cf932c55b1d2c26d568540128b028774ec33e60d2568fcae5ef1e5779018e93962fecb98bea0a5a217e65fb6634120820cd828bb806f407aed313b0b0085f3c71463c97b28a6339b247256a9892b75e6f668e79823a085f56d70fd613bee2d3db658ff5d397afe210d8fa01991c45211318deb9a3727d83876494238a66ca2345d7d189bec69acbeeadd40a7ee109cf51519d45c448a2d04c4b3d61706d44a5ae44826d77ab53ed127560ec562b9476c8e21fa6c5453400617d8a152ecc282815372654d8abdc463b8146adca364a644c19b95c56abc5a356f133f15959beb349e138d213cbeccf6bebb6547d9b1c01a3213b3715612958fd62c087ab50c24987ed9c27f14ffea8a3524b78105883a8f33529efe5d4634acdfcdd42849d51e93f3991031e85917b2afba4df445079416e1c1dfbed55dccd0afd24217a6e065cceb77d2504e8ca47905d23dde448c06f95da6bdadb7efc30d0043095dcc287a1e6fa8225ea33cd23f37f756586b3738e71cfb7e216155286cb0dda7b203cb635f6788688e33b308e4ec87aa9c68118cddc508c8b374f1180b5921fbc2453ec919a8e3a2b96e09099540b5b9ea0061843e8f7439a9d91ffcfd212899a7de9aa134e5b4bbb5cb2b40ee737a1577f2eda916f363c2ba70fde96406826f7d8687fc6d778cd31dacb394a7d12de386d72b70f9a7cafc48f413fb907acfd32a9026870f566ffc5b64e851355adf5f1ad3ac7444dd3899367e73dd7d260e94af597730932b33f54cd5b344c613a1d7ae92ddd3cae5246ac2e9a491b0f74ef8b2bed2fca7c337d2843e208ee1003c786688894d91f381cbed7091a55a03e64432c000c5c69c89fc7f708a4d29824055846043ad565255b547b7afeb31212d7ee66154609bd5e8942cc206f7405310840b03245d60278043f8ed843de6261792ab125bd8a1419e83e159b89c3c8dbfcb84edbb25cf82807bd669f40e67064e16f5d83d9f3a977ec17314d740fa8cc1322b6c20abd2c2d14ee2dd9353b737b5a2cbd49521f6940bffaf242dbcc441473a4d9e238d01875be91797d9c8596bb744ea6b21766541ce92770e22f522e6798545d3d783152140cc40aea4ee690e0c224bed562dc7c7428623f432d7859190eb48140fbc023ec1095ff92fe8b3e942c77d3a7e0271ee7255a771b69b506c5c86d2748eed2ecb76b928a6d3a0650d18b72d72bd11bc7bb600e0ed5b2bea7ecb7759cafa8009292b8859c5b5272ce766689f697ee790ff6287ada0cf629aeb6f11b3fe056b526db597798a9ee7a712a5382afb68f138e809d0928591fd33b853e5d737295536480f3c4bd12cb59c8f871d97ad57d99567a4ef2f134c23366e5ca6822d0114bc36059032d83d3401d8248345f6cf80035b2b5f82a5d678303ed2521add6172f70f5ccf74a03c2915e63d097f7c674d35f52a155710916f091f1591554bef6005e98b687b86fb10165b801163d0751c78c9ed06977bef9361e323742539867d113b99fcf721dd96de17f11e61d0007d339f01deb6139dd7b9e1ccd99e98bb67aa3cdabb49cb7d4706203f8726f8fb8e439ec7c21e00f8090b446c338ad9e6f1fee514fc7f54bad851f9137ad0c0fb9dab3d1e685e0d0a7b4adebf04fb6d4d49dcb56a357142427059d9e421d086eaad3e9a3049c5aa097ff7e39b0bb0b4390ae4cab3f751343aec012a0c86a5d7fcefe1b0447ebcc62e4647dce50b7deb4abe2bfb1cfc96df0e8d4453ed4307d68dacea94da226239df7d97125c3f867a443fb793af244d06d3cc9e47d18d7476b612b495934e193d3c78a6c5b1b1e73aa226cfc670f08f4b2f086547360b7982eb29f774bafe8d42d7f59ce79dbb8d948c57df5a08cfd42acf96cb1795ff58ca5b8d012d3b391114dea1e815523ebc955d11f48f7829768fdbf7337126a744b01f20a978df41b96cb0a03d8fb5856b0e8c10bf946b0870b2ff61170776a810e0f7bec9416b38e0b23c4069f2d46b8ee07cfdcc7c467e618de5ce648d963c4f697fbf384f1b01b727eda2ecb660b6965f740978a54358e0995a7e7d009ab87e7dd5e586aacb94d4ac50156acc915641a057f6090d489e3461fd5b2dae457474fcd2ebad9e72caad66319968a375a1311d41e00a903c53acf12186903c5a773aff6b7d27b17431a9df041774f23da8b49dcbec5ab3d1df1f45e2c9082dd3596f4f04378e64a59003db6e5566c1fdb8287a97976ffd14edd6ba86e9cdc16ad3a25d149fb30ab98b75baa30fd5ad69a0dcba3d529c5decafe95d4de498252ec1bb13d293071ea4cf4a07eee50659027be32410150a24e14ad8b48cd6fbbda11955e01af4da9c9af284605651443a7b9be1a75e08fa533e525ace590a585b01463b9f5db08cde5afc91ff55afa0216724d4fad119fc030a54cd247ef3c32c3d87bf91edb7a830775159d89255b2d9342582656fd4ca9b974af98f84b20e7e3772174d4e03332775969b4eed3829eca340e1b236afa117c3f40cefe69b735cc556281bca707a3ad9f1fdb671196a2b481b3b63fa5037dba8c565e4cb05317188e380b17dbdac9f328ea53d8c3aa5ed395134b9fd3022ab613c6f0258a2b95415059eb627823c4a2f7727a6282e0c1a00e14de69ccc23523ef69249874157b72aee1782dcf1e83f9c05ed15d5e4aa49e7160c6d3a9259781f240a6910543c4c547c0ede5e0799b5236e9db0aa29be89792ebde237fa5ed36c7f1d44072168da39c4664d245f36258c5f772960312fba99bddb98a1523004f7c17c6de69910d6d8abe4e41b7a92db54c3c18dc4ac7378a198863ba2ad4c0348e8144939a95d398155068a242", 0x1000, 0x2}, {&(0x7f00000030c0)="feea4e2d9c652944b1a7f79a5e714810d51c5b018f2ba51716efebc197b1bfa82c351e4036bb5ac253325bd83ca9b4824ee2a04e3c689115970fb03707d71c5fa25d1d2d7ca83d8a786cae53d66f0a288a9d8eb61ae4e1795aacea56", 0x5c, 0x7fffffff}], 0x8000, &(0x7f0000003200)='9p\x00') r6 = syz_open_dev$vcsn(&(0x7f0000003240)='/dev/vcs#\x00', 0x7fffffff8, 0x200) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0x1101}) r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000032c0)='/selinux/enforce\x00', 0x218500, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000003400)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000033c0)={0xffffffffffffffff}, 0x111, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r7, &(0x7f0000003440)={0xb, 0x10, 0xfa00, {&(0x7f0000003300), r8, 0x15}}, 0x18) 10:40:19 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x9, 0x101440) lseek(r0, 0x3, 0x0) r1 = semget(0x2, 0x2, 0x400) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000040)={0xffffffff, 0x20, {0xffffffffffffffff}, {0xee00}, 0xfffffffffffffaf9, 0x3}) stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = geteuid() stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) semctl$IPC_SET(r1, 0x0, 0x1, &(0x7f0000000200)={{0x2, r2, r3, r4, r5, 0x42, 0x8}, 0x2c, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4}) r6 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/qat_adf_ctl\x00', 0x800, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f00000002c0)=0x4, 0x4) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(r6, 0xc1004110, &(0x7f0000000300)={0x8, [0x9, 0x5, 0x4], [{0xff, 0x0, 0x0, 0x0, 0x1, 0x1}, {0x3, 0xd60e, 0x1, 0x1, 0x1}, {0x9, 0x2, 0x1, 0x0, 0x1}, {0xa769, 0x7ff, 0x0, 0x0, 0x1, 0x1}, {0x7fff, 0x26, 0x1, 0x0, 0x1, 0x1}, {0x230e, 0x9, 0x1, 0x1, 0x1}, {0x20, 0x800, 0x1, 0x1, 0x1, 0x1}, {0x3, 0x8, 0x0, 0x1}, {0x20, 0x80000001, 0x0, 0x0, 0x1}, {0x0, 0x716, 0x1, 0x0, 0x1, 0x1}, {0x9, 0x5, 0x0, 0x1}, {0x1, 0x2, 0x1, 0x0, 0x1, 0x1}], 0xffffffff}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000440)={0x2, &(0x7f0000000400)=[{0xdf50, 0x6, 0xcd, 0x6a9d67fa}, {0x6, 0x1, 0x5, 0x101}]}) r7 = open(&(0x7f0000000480)='./file0\x00', 0x101000, 0xe) sendmsg$AUDIT_SET_FEATURE(r7, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x14000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x20, 0x3fa, 0x10, 0x70bd29, 0x25dfdbfd, {0x1, 0x0, 0x1}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x40080}, 0x800) ioctl$NS_GET_USERNS(r6, 0xb701, 0x0) r8 = dup2(0xffffffffffffffff, 0xffffffffffffffff) write$P9_RWALK(r8, &(0x7f00000005c0)={0x3d, 0x6f, 0x2, {0x4, [{0x40, 0x1, 0x3}, {0x4, 0x0, 0x3}, {0x2, 0x0, 0x6}, {0x80, 0x0, 0x7}]}}, 0x3d) accept$packet(r6, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000640)=0x14) write$FUSE_NOTIFY_POLL(r7, &(0x7f0000000680)={0x18, 0x1, 0x0, {0xc6b}}, 0x18) ftruncate(0xffffffffffffffff, 0x7c6) 10:40:19 executing program 3: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x3800) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000000)={0x0, 0x0, 0x95}, 0xe) listen(r0, 0x103) recvmmsg(r0, &(0x7f00000031c0)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x9}], 0x1c) 10:40:19 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f00000001c0)="1c0000001200050f0c1000000049b23e9b200a00080001c000000001", 0x1c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000000600)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5, 0x0, 0x0) recvfrom$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffbf) socket$netlink(0x10, 0x3, 0x0) sendmsg$sock(0xffffffffffffffff, 0x0, 0x0) connect$pptp(0xffffffffffffffff, 0x0, 0x0) recvfrom$inet6(r0, &(0x7f0000000000)=""/114, 0xfffffffffffffd1b, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="9000000020001f", 0x7, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="58ad000010", 0x5, 0x0, 0x0, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000000)='s', 0x10a2a, 0x600, 0x0, 0x6f765f6f191b9a4) 10:40:19 executing program 1: clone(0x3a3dd4008400af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x4, [@datasec={0x2, 0x1, 0x0, 0xf, 0x1, [{}], "f3"}, @datasec={0x0, 0x0, 0x0, 0xf, 0x3, [], '\x00\x00\x00'}]}, {0x0, [0x0, 0x5f]}}, &(0x7f0000000440)=""/262, 0x44, 0x106, 0x8}, 0x20) 10:40:19 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) [ 228.045085] audit: type=1400 audit(1585824018.987:37): avc: denied { map } for pid=7419 comm="syz-fuzzer" path="/root/syzkaller-shm880668768" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 228.140159] audit: type=1400 audit(1585824019.017:38): avc: denied { map } for pid=7438 comm="syz-executor.5" path="/sys/kernel/debug/kcov" dev="debugfs" ino=15777 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 228.312675] IPVS: ftp: loaded support on port[0] = 21 [ 229.096993] chnl_net:caif_netlink_parms(): no params data found [ 229.105060] IPVS: ftp: loaded support on port[0] = 21 [ 229.159928] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.166783] bridge0: port 1(bridge_slave_0) entered disabled state [ 229.174570] device bridge_slave_0 entered promiscuous mode [ 229.195483] bridge0: port 2(bridge_slave_1) entered blocking state [ 229.201945] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.208777] device bridge_slave_1 entered promiscuous mode [ 229.236781] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 229.248719] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 229.276058] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 229.283874] team0: Port device team_slave_0 added [ 229.285520] IPVS: ftp: loaded support on port[0] = 21 [ 229.290138] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 229.301307] team0: Port device team_slave_1 added [ 229.328231] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 229.334566] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 229.359796] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 229.371893] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 229.378142] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 229.403431] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 229.414596] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 229.423435] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 229.492701] device hsr_slave_0 entered promiscuous mode [ 229.550306] device hsr_slave_1 entered promiscuous mode [ 229.600845] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 229.627404] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 229.672759] chnl_net:caif_netlink_parms(): no params data found [ 229.764161] IPVS: ftp: loaded support on port[0] = 21 [ 229.861678] audit: type=1400 audit(1585824020.807:39): avc: denied { create } for pid=7444 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 229.863482] chnl_net:caif_netlink_parms(): no params data found [ 229.891782] audit: type=1400 audit(1585824020.807:40): avc: denied { write } for pid=7444 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 229.919866] audit: type=1400 audit(1585824020.857:41): avc: denied { read } for pid=7444 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 229.958639] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.965155] bridge0: port 1(bridge_slave_0) entered disabled state [ 229.972403] device bridge_slave_0 entered promiscuous mode [ 229.994942] bridge0: port 2(bridge_slave_1) entered blocking state [ 230.002579] bridge0: port 2(bridge_slave_1) entered disabled state [ 230.009443] device bridge_slave_1 entered promiscuous mode [ 230.049892] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 230.058163] bridge0: port 2(bridge_slave_1) entered blocking state [ 230.064625] bridge0: port 2(bridge_slave_1) entered forwarding state [ 230.071526] bridge0: port 1(bridge_slave_0) entered blocking state [ 230.077874] bridge0: port 1(bridge_slave_0) entered forwarding state [ 230.088307] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 230.098706] IPVS: ftp: loaded support on port[0] = 21 [ 230.126022] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 230.133530] team0: Port device team_slave_0 added [ 230.166899] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 230.174371] team0: Port device team_slave_1 added [ 230.183748] bridge0: port 1(bridge_slave_0) entered disabled state [ 230.190598] bridge0: port 2(bridge_slave_1) entered disabled state [ 230.210531] bridge0: port 1(bridge_slave_0) entered blocking state [ 230.216923] bridge0: port 1(bridge_slave_0) entered disabled state [ 230.224602] device bridge_slave_0 entered promiscuous mode [ 230.290245] bridge0: port 2(bridge_slave_1) entered blocking state [ 230.296612] bridge0: port 2(bridge_slave_1) entered disabled state [ 230.304760] device bridge_slave_1 entered promiscuous mode [ 230.319285] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 230.325776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 230.351097] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 230.367562] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 230.373892] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 230.399265] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 230.413916] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 230.441253] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 230.449244] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 230.468729] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 230.494287] chnl_net:caif_netlink_parms(): no params data found [ 230.563383] device hsr_slave_0 entered promiscuous mode [ 230.600479] device hsr_slave_1 entered promiscuous mode [ 230.647884] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 230.657481] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 230.673994] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 230.684427] team0: Port device team_slave_0 added [ 230.686084] IPVS: ftp: loaded support on port[0] = 21 [ 230.690907] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 230.704963] team0: Port device team_slave_1 added [ 230.734189] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 230.740545] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 230.766113] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 230.794254] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 230.800813] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 230.826298] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 230.863989] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 230.876154] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 230.993135] device hsr_slave_0 entered promiscuous mode [ 231.040456] device hsr_slave_1 entered promiscuous mode [ 231.133061] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 231.184133] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 231.207037] 8021q: adding VLAN 0 to HW filter on device bond0 [ 231.214381] bridge0: port 1(bridge_slave_0) entered blocking state [ 231.220969] bridge0: port 1(bridge_slave_0) entered disabled state [ 231.227860] device bridge_slave_0 entered promiscuous mode [ 231.255783] bridge0: port 2(bridge_slave_1) entered blocking state [ 231.262976] bridge0: port 2(bridge_slave_1) entered disabled state [ 231.269879] device bridge_slave_1 entered promiscuous mode [ 231.286136] chnl_net:caif_netlink_parms(): no params data found [ 231.297227] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 231.306918] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 231.335829] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 231.343975] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 231.351991] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 231.379191] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 231.395486] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 231.404122] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 231.410698] 8021q: adding VLAN 0 to HW filter on device team0 [ 231.502878] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 231.530218] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 231.537531] team0: Port device team_slave_0 added [ 231.543827] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 231.551384] team0: Port device team_slave_1 added [ 231.568817] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 231.576565] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 231.584272] bridge0: port 1(bridge_slave_0) entered blocking state [ 231.590628] bridge0: port 1(bridge_slave_0) entered forwarding state [ 231.623229] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 231.637650] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 231.646319] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 231.654088] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 231.679796] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 231.691673] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 231.697910] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 231.723886] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 231.746269] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 231.754836] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 231.762921] bridge0: port 2(bridge_slave_1) entered blocking state [ 231.769263] bridge0: port 2(bridge_slave_1) entered forwarding state [ 231.776272] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 231.784572] chnl_net:caif_netlink_parms(): no params data found [ 231.796646] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 231.805789] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 231.837050] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 231.846409] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 231.864478] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 231.903692] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 231.911925] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 231.919819] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 231.929870] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 231.992334] device hsr_slave_0 entered promiscuous mode [ 232.030330] device hsr_slave_1 entered promiscuous mode [ 232.094854] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 232.102561] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 232.112953] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 232.120600] bridge0: port 1(bridge_slave_0) entered blocking state [ 232.126957] bridge0: port 1(bridge_slave_0) entered disabled state [ 232.134428] device bridge_slave_0 entered promiscuous mode [ 232.142412] bridge0: port 2(bridge_slave_1) entered blocking state [ 232.148769] bridge0: port 2(bridge_slave_1) entered disabled state [ 232.156205] device bridge_slave_1 entered promiscuous mode [ 232.171759] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 232.186004] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 232.197300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 232.206391] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 232.223317] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 232.238210] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 232.247345] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 232.258061] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 232.268091] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 232.275853] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 232.291741] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 232.297760] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 232.335175] 8021q: adding VLAN 0 to HW filter on device bond0 [ 232.382062] bridge0: port 1(bridge_slave_0) entered blocking state [ 232.388469] bridge0: port 1(bridge_slave_0) entered disabled state [ 232.396196] device bridge_slave_0 entered promiscuous mode [ 232.409201] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 232.417547] team0: Port device team_slave_0 added [ 232.423671] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 232.432143] team0: Port device team_slave_1 added [ 232.452099] bridge0: port 2(bridge_slave_1) entered blocking state [ 232.458460] bridge0: port 2(bridge_slave_1) entered disabled state [ 232.466320] device bridge_slave_1 entered promiscuous mode [ 232.475183] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 232.507167] 8021q: adding VLAN 0 to HW filter on device bond0 [ 232.540751] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 232.550595] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 232.558983] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 232.565601] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 232.590922] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 232.605010] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 232.613901] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 232.626762] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 232.650606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 232.656842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 232.682156] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 232.693318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 232.700657] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 232.707794] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 232.718157] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 232.726148] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 232.749926] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 232.757243] 8021q: adding VLAN 0 to HW filter on device team0 [ 232.765937] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 232.773537] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 232.780726] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 232.787556] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 232.794345] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 232.806756] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 232.830359] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 232.837714] team0: Port device team_slave_0 added [ 232.866570] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 232.875744] team0: Port device team_slave_1 added [ 232.883409] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 232.933080] device hsr_slave_0 entered promiscuous mode [ 232.960345] device hsr_slave_1 entered promiscuous mode [ 233.011755] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 233.017835] 8021q: adding VLAN 0 to HW filter on device team0 [ 233.024818] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 233.033028] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 233.041136] bridge0: port 1(bridge_slave_0) entered blocking state [ 233.047485] bridge0: port 1(bridge_slave_0) entered forwarding state [ 233.081176] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 233.087745] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 233.095339] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 233.113194] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 233.121048] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 233.128116] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 233.135982] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 233.143575] bridge0: port 2(bridge_slave_1) entered blocking state [ 233.149908] bridge0: port 2(bridge_slave_1) entered forwarding state [ 233.173263] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 233.182213] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 233.188475] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 233.215873] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 233.227983] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 233.234473] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 233.260121] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 233.270515] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 233.278273] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 233.286248] bridge0: port 1(bridge_slave_0) entered blocking state [ 233.292634] bridge0: port 1(bridge_slave_0) entered forwarding state [ 233.300525] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 233.329868] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 233.337827] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 233.347201] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 233.364717] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 233.373327] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 233.381415] bridge0: port 2(bridge_slave_1) entered blocking state [ 233.387747] bridge0: port 2(bridge_slave_1) entered forwarding state [ 233.402133] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 233.418318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 233.428273] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 233.482523] device hsr_slave_0 entered promiscuous mode [ 233.510323] device hsr_slave_1 entered promiscuous mode [ 233.552623] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 233.561704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 233.569420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 233.579758] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready [ 233.594340] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 233.603508] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 233.637410] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 233.645769] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 233.660682] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 233.667706] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 233.676439] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 233.685359] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 233.694575] IPv6: ADDRCONF(NETDEV_UP): veth1_virt_wifi: link is not ready [ 233.720996] 8021q: adding VLAN 0 to HW filter on device bond0 [ 233.727525] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 233.735751] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 233.743904] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 233.751997] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 233.759802] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 233.772246] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 233.784195] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 233.804520] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 233.811829] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 233.819635] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 233.827994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 233.836195] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 233.846173] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 233.875221] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 233.885134] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 233.893814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 233.902214] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 233.909551] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 233.916737] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 233.925945] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 233.932479] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 233.954207] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready [ 233.961577] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready [ 233.968188] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready [ 233.977483] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 233.985703] 8021q: adding VLAN 0 to HW filter on device team0 [ 234.004581] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 234.022897] IPv6: ADDRCONF(NETDEV_UP): veth1_vlan: link is not ready [ 234.042506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 234.051254] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 234.058932] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 234.066508] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 234.073990] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 234.081073] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 234.091845] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 234.099992] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 234.123460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 234.131413] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 234.142199] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 234.149608] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 234.157726] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 234.166787] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 234.182691] device veth0_vlan entered promiscuous mode [ 234.193987] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 234.201898] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 234.209256] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 234.217100] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 234.224875] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.231226] bridge0: port 1(bridge_slave_0) entered forwarding state [ 234.238068] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 234.245620] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 234.254518] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 234.261308] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 234.288603] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 234.296829] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 234.316418] device veth1_vlan entered promiscuous mode [ 234.332861] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 234.340780] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 234.348393] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.354781] bridge0: port 2(bridge_slave_1) entered forwarding state [ 234.363608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 234.373484] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 234.395622] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 234.410980] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready [ 234.420828] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 234.432807] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 234.442840] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 234.451325] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 234.471008] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 234.479126] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 234.486582] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 234.494823] IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready [ 234.506093] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 234.520417] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 234.528069] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 234.536366] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 234.549414] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 234.559805] device veth0_macvtap entered promiscuous mode [ 234.567371] IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready [ 234.584536] device veth1_macvtap entered promiscuous mode [ 234.591361] IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready [ 234.597930] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 234.605929] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 234.613547] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 234.622459] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 234.632130] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 234.649197] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 234.657816] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 234.667430] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready [ 234.676499] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 234.687936] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready [ 234.700855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 234.711099] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 234.733327] 8021q: adding VLAN 0 to HW filter on device bond0 [ 234.742763] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 234.754819] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready [ 234.765714] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready [ 234.775807] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 234.782667] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 234.791674] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 234.799008] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 234.807138] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 234.818933] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 234.835727] IPv6: ADDRCONF(NETDEV_UP): veth1_virt_wifi: link is not ready [ 234.854276] 8021q: adding VLAN 0 to HW filter on device bond0 [ 234.864470] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 234.871258] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 234.879543] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready [ 234.887264] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 234.894366] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 234.903285] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 234.911477] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 234.919110] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 234.929065] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 234.943452] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 234.964817] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 234.973049] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 234.983023] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 235.001172] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 235.007263] 8021q: adding VLAN 0 to HW filter on device team0 [ 235.018016] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 235.027987] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 235.039119] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 235.046078] 8021q: adding VLAN 0 to HW filter on device team0 [ 235.079077] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready [ 235.087082] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready [ 235.096731] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready [ 235.103766] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 235.112433] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 235.123218] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 235.137330] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready [ 235.146466] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 235.153971] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 235.162462] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 235.169978] bridge0: port 1(bridge_slave_0) entered blocking state [ 235.176369] bridge0: port 1(bridge_slave_0) entered forwarding state [ 235.183350] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 235.192033] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 235.199571] bridge0: port 1(bridge_slave_0) entered blocking state [ 235.205980] bridge0: port 1(bridge_slave_0) entered forwarding state [ 235.212895] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 235.219554] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 235.228049] IPv6: ADDRCONF(NETDEV_UP): veth1_vlan: link is not ready [ 235.238828] device veth0_vlan entered promiscuous mode [ 235.248632] IPv6: ADDRCONF(NETDEV_UP): veth1_virt_wifi: link is not ready [ 235.262265] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 235.268657] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 235.278498] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 235.292571] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 235.301212] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 235.308768] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 235.316667] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 235.325110] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 235.332420] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 235.342480] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 235.351161] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 235.367548] device veth1_vlan entered promiscuous mode [ 235.381316] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 235.389134] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 235.397808] bridge0: port 2(bridge_slave_1) entered blocking state [ 235.404202] bridge0: port 2(bridge_slave_1) entered forwarding state [ 235.412985] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 235.421379] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 235.429068] bridge0: port 2(bridge_slave_1) entered blocking state [ 235.435468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 235.445690] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 235.464200] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 235.477660] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 235.492963] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 235.505411] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 235.517162] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready [ 235.528448] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 235.548264] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 235.556555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 235.569011] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 235.583192] IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready [ 235.591414] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 235.599134] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 235.617327] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 235.626636] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 235.637537] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready [ 235.645133] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready [ 235.653943] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready [ 235.661545] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 235.673256] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 235.687816] device veth0_macvtap entered promiscuous mode [ 235.694934] IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready [ 235.706432] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 235.713914] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 235.721693] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 235.729395] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 235.737126] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 235.744980] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 235.753346] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 235.762495] IPv6: ADDRCONF(NETDEV_UP): veth1_vlan: link is not ready [ 235.771768] device veth0_vlan entered promiscuous mode [ 235.783390] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready [ 235.792547] device veth1_macvtap entered promiscuous mode [ 235.798918] IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready [ 235.811729] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 235.823354] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 235.830909] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 235.838018] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 235.846410] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 235.853832] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 235.861814] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 235.870662] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 235.878090] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 235.885824] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 235.892993] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 235.905739] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 235.916521] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready [ 235.969077] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 235.976914] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 235.992230] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 235.999756] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 236.013081] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 236.022123] IPv6: ADDRCONF(NETDEV_UP): veth1_virt_wifi: link is not ready [ 236.037646] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 236.045575] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 236.056934] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready [ 236.066861] device veth1_vlan entered promiscuous mode [ 236.082342] IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready [ 236.091161] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 236.098663] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 236.108441] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 236.118688] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 236.127209] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 236.137104] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 236.152583] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 236.185046] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 236.195242] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready [ 236.202836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 236.211467] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 236.217494] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 10:40:27 executing program 5: clone(0x3a3dd4008400af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000380)=ANY=[@ANYBLOB="7261775000000000000000000000003c0000000001b60000c800000000000000c10300000300200098030000d0010000d001000016000000d0010000d0010000c803c73378020000c8020000c8020000c802000003"], 0x1) socketpair$unix(0x1, 0x40000000000001, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = memfd_create(&(0x7f00000000c0)='systemem0md5sum$\x00', 0x0) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x5, 0x11, r4, 0x0) rt_sigaction(0x7, &(0x7f0000b4a000)={0x0, 0x0, 0x0, {[0xffffffffffffffff]}}, 0x0, 0x8, &(0x7f0000000100)) prctl$PR_SET_DUMPABLE(0x4, 0x0) syz_open_procfs(0x0, &(0x7f00000008c0)='sessionid\x00') [ 236.234055] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 236.248917] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 236.259474] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 236.276601] IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready [ 236.306003] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 236.322347] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 236.333651] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 236.346448] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready [ 236.354007] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 236.366059] audit: type=1400 audit(1585824027.307:42): avc: denied { map } for pid=7604 comm="syz-executor.5" path=2F6D656D66643A73797374656D656D306D643573756D24202864656C6574656429 dev="tmpfs" ino=28979 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file permissive=1 [ 236.367539] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready 10:40:27 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000000008010100000000000000c3f90000000900010073797a310000000005000300060000000c0004800800054000000000060002"], 0x1}}, 0x0) sendfile(r4, r3, 0x0, 0x100000002) [ 236.403625] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 236.412097] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 236.426779] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 236.433603] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 236.442452] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 236.452748] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready [ 236.459877] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready [ 236.467487] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready [ 236.476522] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 236.496152] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 236.509884] IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready [ 236.519954] audit: type=1804 audit(1585824027.457:43): pid=7610 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.5" name="/root/syzkaller-testdir415563708/syzkaller.lha5EB/2/cgroup.controllers" dev="sda1" ino=16519 res=1 [ 236.530348] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 236.560766] audit: type=1400 audit(1585824027.497:44): avc: denied { create } for pid=7609 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 236.585171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 236.595952] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 236.603780] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 236.610755] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 236.616044] audit: type=1400 audit(1585824027.507:45): avc: denied { write } for pid=7609 comm="syz-executor.5" path="socket:[28996]" dev="sockfs" ino=28996 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 236.619416] device veth0_macvtap entered promiscuous mode [ 236.655315] IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready [ 236.664281] IPv6: ADDRCONF(NETDEV_UP): veth1_vlan: link is not ready [ 236.678786] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 236.691024] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 236.698885] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 236.713787] device veth1_macvtap entered promiscuous mode [ 236.725035] IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready [ 236.744289] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 236.752985] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 236.762696] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 236.769640] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 236.789832] device veth0_vlan entered promiscuous mode [ 236.796676] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready [ 236.824303] device veth1_vlan entered promiscuous mode [ 236.840669] IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready [ 236.852014] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready [ 236.879597] IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready [ 236.898980] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 236.923380] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 236.936409] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 236.946448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 236.957178] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready [ 236.966012] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 236.981585] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 236.988954] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 237.017690] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 237.025943] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 237.041706] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready [ 237.048752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 237.059277] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 237.069398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 237.079221] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 237.089581] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready [ 237.097323] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 237.107963] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready [ 237.125173] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 237.134506] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 237.158767] IPv6: ADDRCONF(NETDEV_UP): veth1_virt_wifi: link is not ready [ 237.182344] IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready [ 237.191185] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 237.206621] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 237.223934] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 237.236515] audit: type=1804 audit(1585824028.177:46): pid=7611 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="ToMToU" comm="syz-executor.5" name="/root/syzkaller-testdir415563708/syzkaller.lha5EB/2/cgroup.controllers" dev="sda1" ino=16519 res=1 [ 237.265621] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 237.276449] device veth0_macvtap entered promiscuous mode [ 237.294009] IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready [ 237.316431] device veth1_macvtap entered promiscuous mode 10:40:28 executing program 5: timer_create(0x8, &(0x7f00000002c0)={0x0, 0x0, 0x1, @thr={0x0, 0x0}}, &(0x7f0000000240)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x77359400}, {0x0, 0x989680}}, 0x0) [ 237.343542] IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready [ 237.389648] IPv6: ADDRCONF(NETDEV_UP): veth0_virt_wifi: link is not ready [ 237.403714] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready [ 237.413383] audit: type=1400 audit(1585824028.357:47): avc: denied { wake_alarm } for pid=7661 comm="syz-executor.5" capability=35 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability2 permissive=1 10:40:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23}, 0x1c) listen(r0, 0xfff) accept4(r0, &(0x7f0000000000)=@xdp, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$devlink(0x0) [ 237.449378] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 237.459993] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 237.478826] IPv6: ADDRCONF(NETDEV_UP): veth1_virt_wifi: link is not ready [ 237.496282] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready [ 237.510785] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 237.519261] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 237.536493] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready [ 237.546736] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready [ 237.554981] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready [ 237.569799] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 237.580541] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 237.589683] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 237.599825] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 237.609895] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 237.619892] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 237.632021] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready [ 237.638964] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 237.677926] IPv6: ADDRCONF(NETDEV_UP): veth0_vlan: link is not ready [ 237.686093] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready [ 237.693512] IPv6: ADDRCONF(NETDEV_UP): vlan1: link is not ready [ 237.704139] IPv6: ADDRCONF(NETDEV_UP): veth1_vlan: link is not ready [ 237.719584] device veth0_vlan entered promiscuous mode [ 237.743611] IPv6: ADDRCONF(NETDEV_UP): veth1_vlan: link is not ready [ 237.759473] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 237.770530] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 237.779143] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 237.791539] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 237.799105] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 237.811286] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 237.821050] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 237.835493] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 237.845820] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 237.861364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 237.874110] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 237.884687] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! 10:40:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$bt_hci(r0, 0x0, 0x0, 0x0, &(0x7f0000000040)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r3 = open(&(0x7f0000000000)='./bus\x00', 0x600c2, 0x0) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f00000000c0)=0x5, 0x4) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={0x0, 0x1ff}, 0x8) ftruncate(r3, 0x200004) sendfile(r1, r3, 0x0, 0x80001d00c0d0) syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) [ 237.902964] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready [ 237.909833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 237.928040] device veth0_vlan entered promiscuous mode [ 237.943149] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 237.952097] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 237.959203] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 237.978305] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 237.985490] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 237.993634] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 238.017439] device veth1_vlan entered promiscuous mode [ 238.051166] IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready [ 238.062517] device veth1_vlan entered promiscuous mode [ 238.068574] IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready [ 238.077502] hrtimer: interrupt took 40486 ns [ 238.113103] IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready [ 238.129680] IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready [ 238.159488] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready [ 238.189697] IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready [ 238.213318] IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready [ 238.226513] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 238.236912] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 238.255032] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 238.273793] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 238.285785] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 238.293739] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 238.309152] IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready [ 238.319093] device veth0_macvtap entered promiscuous mode [ 238.334808] IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready [ 238.352995] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 238.366221] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 238.388369] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 238.416452] device veth1_macvtap entered promiscuous mode [ 238.426119] IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready [ 238.439011] device veth0_macvtap entered promiscuous mode [ 238.447886] IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready [ 238.482891] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready [ 238.491383] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 238.498543] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 238.516780] device veth1_macvtap entered promiscuous mode [ 238.529942] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready [ 238.548769] IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready [ 238.565653] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 238.580704] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 238.589925] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 238.604568] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 238.613844] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 238.627989] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 238.637231] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 238.652670] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 238.664907] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready [ 238.681575] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 238.692790] IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready [ 238.705256] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 238.716860] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 238.742541] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 238.767757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 238.794896] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 238.826881] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 238.847779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 238.865944] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! 10:40:29 executing program 5: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r0, 0x802c550a, &(0x7f0000000180)=@urb_type_control={0x2, {0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 10:40:29 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23}, 0x1c) listen(r0, 0xfff) accept4(r0, 0x0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) [ 238.893487] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 238.905637] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 238.928640] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready [ 238.975070] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 239.001416] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 239.012706] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.022818] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 239.032620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.043081] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 239.053336] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.062647] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 239.072400] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.081712] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 239.091461] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.101859] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready [ 239.108809] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 239.132445] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 239.143908] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 239.155336] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 239.166321] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 239.184589] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 239.201946] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.220926] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 239.231148] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.240360] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 239.250185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.259306] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 239.269071] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.278401] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 239.291891] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 239.303493] IPv6: ADDRCONF(NETDEV_UP): batadv_slave_1: link is not ready [ 239.314230] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 239.338647] netlink: 44371 bytes leftover after parsing attributes in process `syz-executor.4'. [ 239.348940] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 239.364603] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 239.438107] netlink: 42059 bytes leftover after parsing attributes in process `syz-executor.4'. [ 239.473186] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 240.481404] NOHZ: local_softirq_pending 08 10:40:31 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r0, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008002, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback=0xac14140d}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xfff}, {0x80000006, 0x0, 0x0, 0xffffffff}]}, 0x10) recvfrom(r0, &(0x7f0000000100)=""/94, 0xffffffffffffff5e, 0x0, 0x0, 0x0) 10:40:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:31 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23}, 0x1c) listen(r0, 0xfff) accept4(r0, &(0x7f0000000000)=@xdp, 0x0, 0x0) close(0xffffffffffffffff) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) [ 240.650182] QAT: Invalid ioctl [ 240.654170] QAT: Invalid ioctl [ 240.659287] QAT: Invalid ioctl [ 240.665105] QAT: Invalid ioctl [ 240.689488] audit: type=1400 audit(1585824031.627:48): avc: denied { set_context_mgr } for pid=7796 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 240.695761] binder: 7796:7798 ioctl c0306201 20000180 returned -14 [ 240.744863] audit: type=1400 audit(1585824031.627:49): avc: denied { map } for pid=7796 comm="syz-executor.3" path="/dev/binder3" dev="devtmpfs" ino=513 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 240.770693] audit: type=1400 audit(1585824031.627:50): avc: denied { call } for pid=7796 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 10:40:31 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xd4ba0ff) unlink(&(0x7f00000000c0)='./bus\x00') clone(0x1000109, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) link(&(0x7f0000000000)='./bus\x00', &(0x7f0000000140)='./bus\x00') ftruncate(r0, 0x0) 10:40:32 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:40:32 executing program 4: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000000)) 10:40:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:32 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r0, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008002, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback=0xac14140d}, 0x10) close(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x1a, 0x0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xfff}, {0x80000006, 0x0, 0x0, 0xffffffff}]}, 0x10) openat$mice(0xffffffffffffff9c, 0x0, 0x0) recvfrom(r0, &(0x7f0000000100)=""/94, 0xffffffffffffff5e, 0x10100, 0x0, 0x0) 10:40:32 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:32 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x90, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @acquire], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) 10:40:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23}, 0x1c) listen(r0, 0xfff) accept4(r0, 0x0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) [ 241.913769] binder: 7825:7832 ioctl c0306201 20000180 returned -14 [ 241.914731] binder: BINDER_SET_CONTEXT_MGR already set [ 241.946133] binder: 7826:7834 ioctl 40046207 0 returned -16 [ 241.955399] binder: BINDER_SET_CONTEXT_MGR already set 10:40:32 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmmsg$inet(r0, &(0x7f00000003c0)=[{{&(0x7f0000000440)={0x2, 0x0, @remote}, 0x10, &(0x7f0000001d80)=[{&(0x7f0000000a40)="801d", 0x2}], 0x1}}, {{&(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000480)=[@ip_retopts={{0x10}}], 0x10}}], 0x2, 0x0) 10:40:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 241.967091] binder: 7826:7838 ioctl 40046207 0 returned -16 10:40:33 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r0, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008002, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback=0xac14140d}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000000)=[{0x80000006}]}, 0x10) recvfrom(r0, &(0x7f0000000100)=""/94, 0xffffffffffffff5e, 0x0, 0x0, 0x0) 10:40:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 242.066361] binder: 7847:7851 ioctl c0306201 20000180 returned -14 10:40:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 242.176280] binder: 7859:7860 ioctl c0306201 20000180 returned -14 10:40:33 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:40:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r3) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:33 executing program 5: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_CLEAR_HALT(r0, 0x80045515, &(0x7f0000000040)) 10:40:33 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x1000000, 0x0}) 10:40:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 242.794628] binder: 7870:7871 ioctl c0306201 20000180 returned -14 10:40:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r3) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:33 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f0000000000)='./bus\x00', 0x600c2, 0x0) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f00000000c0)=0x5, 0x4) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={0x0, 0x1ff}, 0x8) ftruncate(r2, 0x200004) sendfile(r0, r2, 0x0, 0x80001d00c0d0) [ 242.930853] binder: 7888:7890 ioctl c0306201 20000180 returned -14 10:40:33 executing program 5: r0 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000029000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000b28000)=0x3e) fcntl$setsig(r1, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r2}], 0x1, 0xfffffffffffffff8) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) dup2(r1, r2) fcntl$setown(r2, 0x8, r0) tkill(r0, 0x14) 10:40:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r3) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 243.086806] syz-executor.0 (7891) used greatest stack depth: 24208 bytes left [ 243.111714] binder: 7897:7903 ioctl c0306201 20000180 returned -14 10:40:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:34 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:40:34 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x49) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket(0x10, 0x80002, 0x0) r4 = fcntl$dupfd(r2, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000)={0x3f}, 0x14) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x10010000000035) fcntl$setstatus(r0, 0x4, 0x2000) 10:40:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:34 executing program 4: pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0xf0e}]}, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socket$inet(0x2, 0x3, 0x2a) bind$inet(r3, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x34}}, 0x10) connect$inet(r3, &(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r3, 0x0, 0x19404, 0x0) 10:40:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 243.609958] binder: 7912:7913 ioctl c0306201 20000180 returned -14 10:40:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 243.728166] binder: 7925:7928 ioctl c0306201 20000180 returned -14 [ 243.813003] binder: 7933:7935 ioctl c0306201 20000180 returned -14 10:40:37 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="340000000a06010800000000000000000000000005000100060000000900020073797a30000000000c00078008000940010000008747e5ae9a00aa4c07fb07dc829f748fc02e4d58a88b881e83a1d2adc5a5408f19cc5def62a0180ca9d0d90b23164720a889cd40e9999fc62cde18b4c8d08c05ae9234cc1c6f9232e4ca3f8696b3f854eac2f51c93f5ff0dc1dfd632eab4f77131e0655b3ab5b00b3e77553b10b82a0b4ea89f8bc9f4bdac1b629f1a5e9d"], 0x34}}, 0x0) 10:40:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:37 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) 10:40:37 executing program 0: futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x3ffffffb) 10:40:37 executing program 4: prctl$PR_MCE_KILL(0x35, 0x0, 0x4) arch_prctl$ARCH_SET_GS(0x1001, 0x0) 10:40:37 executing program 4: 10:40:37 executing program 0: 10:40:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 246.116502] binder: 7943:7952 ioctl c0306201 20000180 returned -14 10:40:37 executing program 5: 10:40:37 executing program 4: 10:40:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:37 executing program 0: 10:40:37 executing program 5: 10:40:37 executing program 4: [ 246.294957] binder: 7967:7972 ioctl c0306201 20000180 returned -14 10:40:37 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) 10:40:37 executing program 0: 10:40:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:37 executing program 5: 10:40:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:37 executing program 4: 10:40:37 executing program 5: 10:40:37 executing program 0: 10:40:37 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000000)=0x7, 0x4) recvmmsg(r0, &(0x7f0000004b40)=[{{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000001e40)=""/239, 0xef}}, {{&(0x7f0000003300)=@tipc=@id, 0x80, &(0x7f00000049c0)=[{&(0x7f0000003380)=""/83, 0x53}, {0x0}, {0x0}, {&(0x7f0000004580)=""/203, 0xcb}, {0x0}, {&(0x7f00000048c0)=""/218, 0xda}], 0x6, &(0x7f0000004a40)=""/243, 0xf3}}], 0x20004582, 0x2, 0x0) [ 246.938337] binder: 7983:7987 ioctl c0306201 20000180 returned -14 10:40:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:37 executing program 0: 10:40:37 executing program 5: 10:40:38 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) 10:40:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:38 executing program 5: 10:40:38 executing program 0: 10:40:38 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:38 executing program 4: 10:40:38 executing program 0: 10:40:38 executing program 5: 10:40:38 executing program 4: [ 247.805696] binder: 8010:8017 ioctl c0306201 20000180 returned -14 [ 247.806245] binder_alloc: 8012: binder_alloc_buf, no vma 10:40:38 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:38 executing program 4: 10:40:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 247.955423] binder_alloc: 8028: binder_alloc_buf, no vma [ 247.974447] binder: 8032:8034 ioctl c0306201 20000180 returned -14 10:40:39 executing program 5: 10:40:39 executing program 0: 10:40:39 executing program 4: 10:40:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:39 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:40:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:39 executing program 5: 10:40:39 executing program 0: 10:40:39 executing program 4: 10:40:39 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) [ 248.698729] binder_alloc: 8040: binder_alloc_buf, no vma 10:40:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 248.744890] binder: 8044:8048 ioctl c0306201 20000180 returned -14 10:40:39 executing program 5: 10:40:39 executing program 0: 10:40:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$netlink(0x10, 0x3, 0x10) sendmsg(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000280)="23000000190007041dfffd94ec8675c2020000001f00000000000800050016f30300ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) 10:40:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:39 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:40:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:39 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @loopback}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x11, 0x2, 0x0) bind(r5, &(0x7f0000000080)=@generic={0x11, "000001000000000008fc9d71fc00000000000000f8ffff002e0b3836005404b0d6301a4ce875f2e3ff5f163ee340b76795008000f8000000000104003c5811039e15775027ecce66fd792bbf0e5bf5ff9b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ff42c65400"}, 0x80) getsockname$packet(r5, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=@newlink={0x24, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_IFALIASn={0x4}]}, 0x24}}, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 10:40:39 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000003dc0)={&(0x7f0000007400)={{0x14}, [@NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x401, 0x0, 0x0, {}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x54}}, 0x0) [ 248.927206] binder: 8068:8070 ioctl c0306201 20000180 returned -14 10:40:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(0x0) r0 = syz_open_dev$sg(&(0x7f0000000340)='/dev/sg#\x00', 0x0, 0x5) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000100)="ae88bff824f400005a90f57f07703aeff0f64ebbee07962c22772e11b44e69d90cf41bdd2ac8bb8c43b460e46292", 0x2e}, {&(0x7f00000001c0)="53000000feff7700400000002000100000200000000000004000000000000000000000004459e28542e6", 0x2a}], 0x2) ioctl$SG_GET_PACK_ID(0xffffffffffffffff, 0x227c, 0x0) 10:40:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:40 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)) read(0xffffffffffffffff, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:40:40 executing program 5: sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYBLOB="02090000020000000061bf74643ebf80395a6bf20aa73dc38e1875673422335d125f739d7de461f3d50c4c05e9f4d0c4a9482ac0c6c608858cb5d0fff720cd52833214ad64421b590b719093ec676200b7f81b559bd6773650416a24746108a7640ef8864f8735fd55248afa7ad9aea09e4d666fd0b87338282c809c2f3182ae2801064eafb87f565e420ef84c2b2e8bc328a778345f00c7724205f9732d1f0af7f87fe42a1094b5ea0783a0d44a18a8d8186d808f10e8db2458d6d3a66497c6d452b62a5626257cfb5daea35cc56c781dd8871f0a5ea808d58c52ebfc178ea22cdc6b338c0787a0d1de38c8a774732843eb517d9b4f3b58823c6266bffec1ac192a88a78a1a42f50573411a98fee12e5f944cc5ef4790605c7933b2b9c4a2bbfeee22a62b1326224d07a31b3a375e1e85e0f270d265849d37c191f64bf710573c9529b2050aa869afbdf2e18f34e0d0baa1b9bd6129d2104a378b831b59090000000000000061478650ff6088c1409b90cca6fa1ca888da1e12805894c163ad3aa25edb59a4f5d7d533fa31489b3c270f9544958c81adcfa70e57a300000000008e279cbaa4596feac37ee3c0724f24e7e7a2de074e715f1473bc97efb0bbf278d8c821a25c22c869dd58423ca3185e5f6d2004439b95d1022f5ec564cfdfa6cca301ac41564673005187f33b248800db2fff3f01161a0bead12aed6276f89b4194230983ed28acb4b301003c3dc585c218bd46afe93d9826d18c879847aa1c9b8d923184417e88fd72e61b1dcbce4bb2dcfb1bd1206effa783068de2b4a42acd6f6f8c0b8d652a813e92e59ed2502c46e525ee4e82a5f5e14a320404018cb8270140091982b2f3315f394785921b879d33a065600d5dcc410417d6f07eea35b679d888530f33f481d0e60633e1150a5fb6e6347b8040caa0e96df30a72ad9150f45df828cfea6f3e6a13b278c19d2c79b0"], 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0xffffffffa0018000, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2, 0x0, 0x0, 0x0, 0x2}, 0x10}}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmmsg(r0, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) 10:40:40 executing program 0: sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYBLOB="02090000020000000061bf74643ebf80395a6bf20aa73dc38e1875673422335d125f739d7de461f3d50c4c05e9f4d0c4a9482ac0c6c608858cb5d0fff720cd52833214ad64421b590b719093ec676200b7f81b559bd6773650416a24746108a7640ef8864f8735fd55248afa7ad9aea09e4d666fd0b87338282c809c2f3182ae2801064eafb87f565e420ef84c2b2e8bc328a778345f00c7724205f9732d1f0af7f87fe42a1094b5ea0783a0d44a18a8d8186d808f10e8db2458d6d3a66497c6d452b62a5626257cfb5daea35cc56c781dd8871f0a5ea808d58c52ebfc178ea22cdc6b338c0787a0d1de38c8a774732843eb517d9b4f3b58823c6266bffec1ac192a88a78a1a42f50573411a98fee12e5f944cc5ef4790605c7933b2b9c4a2bbfeee22a62b1326224d07a31b3a375e1e85e0f270d265849d37c191f64bf710573c9529b2050aa869afbdf2e18f34e0d0baa1b9bd6129d2104a378b831b59090000000000000061478650ff6088c1409b90cca6fa1ca888da1e12805894c163ad3aa25edb59a4f5d7d533fa31489b3c270f9544958c81adcfa70e57a300000000008e279cbaa4596feac37ee3c0724f24e7e7a2de074e715f1473bc97efb0bbf278d8c821a25c22c869dd58423ca3185e5f6d2004439b95d1022f5ec564cfdfa6cca301ac41564673005187f33b248800db2fff3f01161a0bead12aed6276f89b4194230983ed28acb4b301003c3dc585c218bd46afe93d9826d18c879847aa1c9b8d923184417e88fd72e61b1dcbce4bb2dcfb1bd1206effa783068de2b4a42acd6f6f8c0b8d652a813e92e59ed2502c46e525ee4e82a5f5e14a320404018cb8270140091982b2f3315f394785921b879d33a065600d5dcc410417d6f07eea35b679d888530f33f481d0e60633e1150a5fb6e6347b8040caa0e96df30a72ad9150f45df828cfea6f3e6a13b278c19d2c79b0"], 0x10}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0xffffffffa0018000, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2, 0x6, 0x0, 0x0, 0x2}, 0x10}}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmmsg(r0, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) 10:40:40 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)) read(0xffffffffffffffff, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) [ 249.112833] binder: 8091:8097 ioctl c0306201 20000180 returned -14 10:40:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:40 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000000140)=[{&(0x7f0000001600)="d083b8778d9e055daedb2fb28df629afabdb0b25311ef1e77295a000a43e26", 0x1f}, {&(0x7f00000016c0)="7507747dd9bcc24bc9201e9ab3851c2352e456a59990f36599f89b848cf73dba62e0ee4d214b4ea417ba047283d923aa85916b00b017843fb4dd334d8bf4ab10c73e81992e6fd44138b794415b5cc26106b7db3a6b8796ce064e031f8f35e3f749cb730bb38dcfb2cf9155bf417d427a6ea7c2284e317a87736058c4140d8fe5d67450f4e38f91d2457b1f20672e51d2a112668d", 0x94}, {&(0x7f0000001780)="a45d4e26c6fadcbd663ccd6c0aca006b802c18d131b5427b3d4515dee8f10570a5923f3f543435278f94c3f8f0d4c35488ecfb1bd630b2e1e0e4247bb44938f03d603b27e44942ddcd3f11f086e6bf39ab074b690284b6d6aff6cc1e736b32f7d781c315bad312c6e8062089abe9838cd011d5227aa050589d2e5f34e10165336747bc2156f8e2570a4a76d4af1ef57edb31f57834ba2486c9f253a1737d59d15a11571414ec61c17dc20d9974e58cf2925c7c6e56216d4e35e39a9977e27e21450596008761c86e216667c6f72b64fdcad802718d16b390d4b4dc05bffb838b7e6831cc53b65b1de0bbf6af1311a722a80065913d37bea8c988e3b3f05ab1eb02d6b52a11191f1ced75b0200502e5f2881204104e152b5644da9d26301ed8905156a069c61444d44d82c135ff4f20574247a4a5cc963e3c395a029125ccae1f1564a3e28e06b1a08e47bd1a9621edf1003d167cbdfc0be2a4914908198575a688a38d24bdc9881ced9fe04e119a87b9286ea15aa168163a9650a26a926c571f2f0e0b2102de1fd1a6920cb71d846f02b2c23f80a3c0116b48d14925e69c4a65126e544995e0cb5fefaa870ddd66e8eb47a3be8f07fcd361dcf144c865fe355e3b98e6d4694d74aa6d3d75c7c568feabdcb483c5c22ca40782cd2dea789dc677c603227878c369a3b7a3204bf1bc9b1fdb1e00447152e854095b9527d6e980b1bac1b1ec6e9706084ac77b383bd4e555a11410f6a830966ec9b0fa58abf22238638ea06bad5baa2b55174b0db510", 0x22e}, {&(0x7f0000000300)="c9be9ccc6aeb99edf480dd9158d5818ed363362992dd1fb54c321b9a93c187d50220f4b1fece138b81f09d639d7c693acc610026f77f0d8af3575fefcec628d9856649621ed6aad4b9e620113eafb805220aad55765b55bc53239db983f369c2cc9f9a26a4dbc40751dc7b0bda441c497ca7d0c3470888f660b9252c59", 0x7d}], 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1801, 0x4) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860005cf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 10:40:40 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000180)=@updpolicy={0xb8, 0x13, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x1, [0x0, 0x3f000000, 0x3]}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x30}}}, 0xb8}, 0x1, 0xfffff000}, 0x0) 10:40:40 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$IPT_SO_SET_REPLACE(r1, 0x8000000000000, 0x40, &(0x7f0000000a00)=ANY=[@ANYBLOB="7261770000000000000000000000000000000000000600000000000000000000020000000300000058030000f001000000000000000000000000000000000000c0020000c0020000c0020000c0020000c0020000030000000000000000000000ffffffffac1e000100000000000000006970366772657461703000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009001f0010000000000000000000000000000000000000000f800726563656e740000000000000000000000000000000000000000000000000000000000000000010073797a310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000bd3213a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fb00000000000000000000000000002800727066696c74657200000000000000000000000000000000000000000000000000000000000060005345540000000000000000000000000000000000000000000000000000000000000000000000d203000000e4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0000001000000000000000069703665727370616e300000000000006d6163766c6eaa649400000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000007000d00000000000000000000000000000000000000000006000434c5553544552495000000000000000000000000000000000000000000000000000aaaaaaaaaabb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700098000000000000000000000000efff000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) 10:40:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:40 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)) read(0xffffffffffffffff, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:40:40 executing program 4: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000380)) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r3 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={0x0, 0x839}, 0x8) ftruncate(r3, 0x200004) sendfile(r0, r3, 0x0, 0x80001d00c0d0) 10:40:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 249.353789] x_tables: ip_tables: rpfilter match: used from hooks INPUT, but only valid from PREROUTING [ 249.383426] binder: 8121:8127 ioctl c0306201 20000180 returned -14 10:40:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:40 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(0x0, 0x1000000000016) 10:40:40 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f0000000380)=0xffffffff) r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x2, 0x2) ioctl$VIDIOC_LOG_STATUS(r1, 0x5646, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ubi_ctrl\x00', 0x41, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000600)}}, 0x20) 10:40:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 249.549246] binder_alloc: 8143: binder_alloc_buf, no vma [ 249.570106] binder: 8143:8148 ioctl c0306201 20000180 returned -14 [ 249.578309] vivid-001: ================= START STATUS ================= 10:40:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 249.603203] vivid-001: Radio HW Seek Mode: Bounded [ 249.612606] vivid-001: Radio Programmable HW Seek: false [ 249.619325] vivid-001: RDS Rx I/O Mode: Block I/O [ 249.632683] vivid-001: Generate RBDS Instead of RDS: false [ 249.645519] vivid-001: RDS Reception: true [ 249.657662] vivid-001: RDS Program Type: 0 inactive [ 249.669288] vivid-001: RDS PS Name: inactive [ 249.676355] vivid-001: RDS Radio Text: inactive [ 249.684680] vivid-001: RDS Traffic Announcement: false inactive [ 249.703924] vivid-001: RDS Traffic Program: false inactive [ 249.710010] vivid-001: RDS Music: false inactive [ 249.716379] vivid-001: ================== END STATUS ================== [ 249.745087] vivid-001: ================= START STATUS ================= [ 249.753840] vivid-001: Radio HW Seek Mode: Bounded [ 249.758884] vivid-001: Radio Programmable HW Seek: false [ 249.768873] vivid-001: RDS Rx I/O Mode: Block I/O [ 249.773965] vivid-001: Generate RBDS Instead of RDS: false [ 249.779692] vivid-001: RDS Reception: true [ 249.788481] vivid-001: RDS Program Type: 0 inactive [ 249.793753] vivid-001: RDS PS Name: inactive [ 249.805250] vivid-001: RDS Radio Text: inactive [ 249.810719] vivid-001: RDS Traffic Announcement: false inactive [ 249.816885] vivid-001: RDS Traffic Program: false inactive [ 249.827569] vivid-001: RDS Music: false inactive [ 249.832684] vivid-001: ================== END STATUS ================== 10:40:41 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x0, 0x0) poll(&(0x7f0000000140)=[{r2}], 0x1, 0x5) 10:40:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f0000000380)=0xffffffff) r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x2, 0x2) ioctl$VIDIOC_LOG_STATUS(r1, 0x5646, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ubi_ctrl\x00', 0x41, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000600)}}, 0x20) 10:40:41 executing program 4: perf_event_open(&(0x7f00000000c0)={0x1, 0x158, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000003dc0)={&(0x7f0000007400)={{0x14}, [@NFT_MSG_DELSETELEM={0x2884, 0xe, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4ac, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}]}, {0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x9e}, @NFTA_SET_ELEM_TIMEOUT={0xc}]}, {0x280, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x80000001}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_DATA={0x26c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VALUE={0x4d, 0x1, "aac93dd788aade11e062e4b5b3ae9eb8f75d12cfb227417451b6fdaed2d4c4780185cc9e6cecb25cdf3e7c2e23851b1941bbea92e4758f2dca5c299184176ee5cd1c7b2ea0eaea4907"}, @NFTA_DATA_VALUE={0x7, 0x1, "1ed055"}, @NFTA_DATA_VALUE={0x85, 0x1, "df3820f57841fa114a44a65fac6e39784da4dd54597319c869c0c3afeec45c27f92514ccc50f32ecc22665f54ba04cbc3a47475252858d0b334db71e06226cc28352b24d0f47d7f3a969b1b84989460abbb28ec441a4ce49d3e120ee68f335eae92ac226a54d105d1b8866f9c425cee02999bd0a762af46b1cc40dcdf3c0bff1c1"}, @NFTA_DATA_VALUE={0xa4, 0x1, "eb045f558fe9d81417bd84af14a66cd1263ad10d9b56a56ff0c4e4485234cd431aa00e56f1d1662160cce9e52df3df52d7a31588366caa200e2c6060b4faea0c71feaa340d27f13704fb853714971b771c5216325c44da81a78672ab94e4db0604445c048e573d0165e6428d3b05d6fd08b8df454aef589c557b3c81ac0351f27edce37d304d0ded97f9542d42976eff59f2934cf9583921b1f24300627223df"}, @NFTA_DATA_VALUE={0xd0, 0x1, "4e0a343806ba4e8b12bcdfba87ca79e35960cd32bc59dfaa18e4d7f830249f1302a583394a4b82300ee04c1b86e899584c8d78d46bdf991bb31ffdb734b09f257d67100fcd977aeb24413e74820e517cf9b97f6bd0e0bc1b05eb69221aa4a0a218128bdfd7ba63b261dfe0784c34a75c8ba45ac4cca0bf670d24ef2f14b104ecc1be6ba59718eba22458b8bdcc40b180572ecdf217390f05167120bd539548019919d119aca4f27d045627d4f3ee2f57d2ba75db842f1525787d5bd206c4d0153b3894773899ed09359203b2"}]}]}, {0x34, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x81}]}, {0x110, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xffff}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_USERDATA={0x7a, 0x6, 0x1, 0x0, "a58c994596da8e4b5b9e06d24bc67c8893cee618c85957dd85a6d7cf03b527dd9b50dbda6ed3c415a7042fad90c768b5febea07984a4fd8943dbfa9cebee772812784fb227b78d5fb129d53eb5bc662f7a84a7f7a62e13cad851992cbbbdb07ef45be2f2e0b5177977fd2ca7bd50fb415c622a750387"}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xaa6}, @NFTA_SET_ELEM_DATA={0x48, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x2c, 0x1, "b98fb7e87f211feabbb88fbf12d10b833f40e74813adfae63facc6456f22dc4d1f25eefdaed63302"}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}]}]}]}, {0xbc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x40, 0x6, 0x1, 0x0, "dea29660fdcc8408f9211bdc21ee8d64796c225fa6c781053dc449bbea6664afc63e8c88963d016e3b34631ba77465d69e031e1e83a7e3ef41859157"}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_KEY={0x6c, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x28, 0x1, "281622d388d075a0f1231e0750a813d0268c72655b8bade195b7c53da9feee19900dafc9"}, @NFTA_DATA_VALUE={0x3f, 0x1, "c2c072337e62664ec261f19e596eee0a4dbeea5b0f8fff69a7bad1df62acc6ad44994b00e4a6e6cecddee38ddc35f0d19491ab2df313040dff52bb"}]}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x43c, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8}]}, {0x134, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x128, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xd0, 0x1, "6d69c64c1709b68d596b3b578e9ccc2262b85edf3e184bdfdac01c50658af6120ea652b615327cd70d04a88ee333bc9ebe5220e18151cf1b397e8d3e86125835754b53ca3bc139a5fe3499694f970493786ebca6dcb9a452b27057511f9a2e177eba116c8581e61e0bf251e0aebb5fae676499ef4dc6842e492d5c0fe587feac53ac4719a27153eeedef5a94f95e101d1a2ea4c5e993c3d7a6aa7c5488492287d61938ae0ff6152a16ef5dfae873ae4a482e370a2bea571ee3e458b25fee65d1f8fc29b9e49b8b330e5d1283"}, @NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}]}]}, @NFTA_SET_ELEM_FLAGS={0x8}]}, {0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0x1b, 0x6, 0x1, 0x0, "e2b8000a702a564061f2e1dda69a621e11d5f503a615d6"}, @NFTA_SET_ELEM_EXPR={0x4}]}, {0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0x264, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_KEY={0x58, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0x50, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_KEY={0xbc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xa, 0x1, "702b96bc0cb6"}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x4d, 0x1, "63c1256fc19946efd6194f38064b0feed74a0f86a35dc72f83589ce607ad9a6eed2a95e2dfc82641aa03b9bbd84e325efa2755a59a637132f35ca188e7f1254ecd6d931f4c486977ae"}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}, @NFTA_SET_ELEM_DATA={0x138, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VALUE={0xf4, 0x1, "07b5cf0356e852af2e7f9fa4ddf0339a2c1cb22022292011ce2c5e01c1bbe24c807d8b3240ad6ac5e8aaf7bc8f55e9a9f2210f1faedbb79d595ac6a217fdd002b2321746cd8cd1174339f78d3992b826dab6b14fbc5b8b18dc7008a9d6900f0101e504d8f010d80b4c3da12dda629ab36376024fe80310f9477466c6054fa90c2af3fe0518828f72933f6cd08945cd0f3da38e681c24ab3f4e8777f35843608b77a67606dca89f5a9abcd9774e2f2832ed1ed55ad98541ded495b46d03c70993dce7b14afad63e88bf3b9349a0175218174e528d0863025f71fc1f577cf22b0a92dd56e4271ae5be12b96f41a6277e4f"}]}, @NFTA_SET_ELEM_FLAGS={0x8}]}, {0x30, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_DATA={0x28, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}]}, {0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1f34, 0x3, 0x0, 0x1, [{0x1334, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xdc, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x2c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0x2c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}]}, @NFTA_SET_ELEM_DATA={0xe4, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xd, 0x1, "c8e30db3a8651350c5"}, @NFTA_DATA_VALUE={0x4c, 0x1, "1d0400a575098ab119b6a392025ef15cd1d80ef609ca4f3488ecad1427b3f53c7096bfbe6dbe350a902735b0d3a8d66ba8993eff25f9986dfd63644146b82d693aa97a089de7bf19"}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}]}, @NFTA_SET_ELEM_DATA={0x1160, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x1004, 0x1, "3c85ed27ac4cd3372b84d23a5eb91abb1f378827bbc3431983511c69c2d73a0a18c3176a4b5d477162f02e256597e447901ba1db08e95a3001ffa2239f69ff44332f1e3ed0f1641576de8ce1e2a90f430d262fc99aaee5e44ed6a14e37990e9620545dcdcb480f6b4acd13636ed614f928a18bb824dec898f22a473a4e296642a6ad9bcc24f135ecf4e2c9c8197ac94a35e0d2aa243e70524f486b395ab67b5714c17b657ebe04b0f509bd177eb34ee45502ae7df823fe0a2327b59c5e497a5017d52e3fa56d53c7fb0a518d8d9d6591eb16d1e939e1103d448184cad78f8643c51529b427d680f0f651472173f4b9284fb2759c8ea9f001c38b07e4647c3021e17e04e22b8b9bb329eb04802fbdac816a326f38c40dff8cd2344db54711627fcf70fddab4166de4d9a1561d0f38e1c5bb317abbfc4dbc39cd33c93d1b6e61337b19084ff02f9c506c719662e20d27354ec45753eea49a3b811e77cae008a2a8b10a89940be066124d897f1c56d581ceafe9346e37d8263b8fa70c0714ebc30f7dc1cb6202ef78e38795330e3c30f5174f205a6079f8981c35756759f5232843e68789c20a3ed32333d370dc6fca16a6737ad6ce9c74da12704bd898648d6fe24be47e1d4bb4404ceb5e55cd35e1f6f9b3696726f90cc95df953a873c5e673bd8255cf565e47058bfee982d9ec15f164833a6b587d2eb9f3cc4ef9d2921795f6194eacd6d8d16f5aa7703d34ef53435a5b3eac2604cd7b4584acfa2f2983a380d02e462fde39f4f32242d3ca06588c1578bfa875763b48560e58faee6755c63d68859983ec97b21e8b9b00c2a48d69588d427f4be12c713504bb9b9b6346a164ba3bec04a0c2dcc6c05359d683fbc3c1e03a3245574ef9ea646af242f491df9992c7547fcb7f4a892cbdcc729ef832542b1f9dd34b5d1f79e32ab9d3773c7429476d5e2b52de0d0efac15649020566356a15512471f02222f9d521a8767e6037fad047a116abdf24df84ae476e79869784d69ca2fb144d33773299a4f79c249ca74e368c182ff9bd40c21bc1ed8e30a89d54fff395cf9954d46922dc90686d0625fe9fe91781deaefd8a667785e0fcebf8c8cca5f9d6dc93825c0c9b7d6aa45b30897e52935895774fd63988cd8e158f96a2177f10ef763875a70daa598d9b512aa274d04cf72c3ea756796de3217e15f0de22272ddc9976a99280653ed4ae4bd79124abd77ddf9b20083cca580fc70c962a74b0119f4eaefa0d09a1e8e67b9232de15e65bc533d38bba87017bd5569bca0d8251cc88b817bcf6fbe8e0002cae6d336e8d02e8ad8ceb798c9be09f71c2ee9fc14dd0ec198e2d728c3752a4ad1840f4aa5d05d80370ab79f1787df74d10212f3e7f7a3de76fccec8bc232328804594f389f9174f8d4c8aa40d5d4edb373bd02aeb084b04b2e33a71c11e416d2163027170a3268f2cd28444692a6a60ee080fbcd3b5df1944efad522ca05f5c347cf76e5185a3a23c7f1d82a427c736457c598b0775f5cb58ecbf74afe6e404c97e465f976c7167a7421f780f9c04bf11e8b95faf1fe05ebf88da0280c84791897639db4faf99c3740e7e6c66fb9822f0a8984b7297952c264481b38654efc8f983adc5952ea059371f1cdd710f974fbf452db538c22a41b422b85a9ee574113bf2064906fe87fa643b3bdb89f754a59baf0ed7f4fba741db1478615efe182032cfedaa36110acb2d9e28748103315668e53723a02acfec267da9ebce5095c90dfd775ae0afec4c6142d995e2abb6586b323f62284fdb0eddbfe817eb8114816fae11b2d018e91bf46f089f11f164b4b3c2c824b88fa548beba349ecbd1107dd09b0c89de4e73d1673d2a81d91438b8c481d6c19e12ca76d9bfa8b7c21dea0100ca6fb24c8a6581af551e6b9378d9fe9eaece4588e45616b4ede44d311622d51171d2b7e1273ddb4e883f318aeed806410603042aed1d52fba9df48243d95ddd5f9408d64b820eca113b81a305f4638b253b525b6a41613e0819fe78319d95c52596c6aba0834ee3c398a5f28c10d557039d428cbd4b82f650d63322f7732495304b159856cc990f3eba84516dfea98e9956728bb5005f5aade6eb2831f6aea8996c685996c7e0d24d22629f37bb60f75bec5ac67b92b7dc830a28813e2be814f4e79184256cab3cd8548a1c5e57830b0599a369fdeda720ecb87dc143c4c3648b31d6df5060fec5376494c169b45e17ff39ee471821cfade35f5e6b50c3cc90e598560caa55247b35463a60510e9114cd0e55aca879f2874d9d6ef79e4e5fb61a1104ef8af7372e939324d67ab7710dd213eb67dc03072caebea5be1da3b0c7348745489de8f59c2192c836feb73eb5a2f7447f36a8379d95098580114640fb708b34c92380bcd660ff99f8387c8fb451bb91b8aaa66e477063c1b17705286dbba0523d855983c2dd379ca3db79a22f1fb4033f11a98ffe5759f3e99f6a8e41c976b0c576bb94d14c7abefb22a6f2a2fb74c0f57c3ae322fdd2cc51f779ce1f18bf7dc9affa39fb8f40c2c7f78984a204e166e13e998a5d845f6a7afee15aaf0ae03c047aa9a0800374018ef4592b52b7fe6bd88c4f2265a0d5207acac6453eef74e7f846dde7e3da7cbe8927b54a7fb3dcbbda095b42007ab6c4f3729a258bf5e93b563a3a383878d78e8d0eea999ce39c5d8ceadf8223d1dc7fe1e882957bbe9ab1cf4f1a1a7aff56db3602a930f9e5a1a0267444559097ac0fea149fc74a5b9e1b0d268ec32def7cc3bd0eb1302be855e4c20e84eb0bb4a4d3aa5a66cda6d17c3aa32b885a57ca637c709ef86a39ceebe3000e5b893d60d2b9e07d395602c3278b4fc12073a039d9fcf9dd03f6b47c1cd21a07d7f99cea4af3f099b76c1738c11f6078ca1da6bba3c55861cdd0d1bd5a4b3a1531f189d2c263ba3b1c1eb5ee1a7abdaed7a9c81808b0d878a76ff4067c6bf105da044d67ef9c3384a201c4be205802a06c217087027558352abea12b4a3b628bfeb96bee02fdfcb410c93e664560e047b4981b5505d3234af6a52b2498533944e25a25f1f599d152d24e25cdb97caeede8a5ba88669ee996469a94b4ade1c9f01ec7fdda5ec22bf9ce3916913bad4b7b99c08ad6d20d60f9a5b39558b04ac486181510ca5d74620b6d674a3cec446fba46b37e9ed97b4e62cc74a0babde416a732b408156f229a134fbf9fc0133380e903f8abcf2808b897bbeef9f908a7c1f7f9be08aabe5a0e401efe663fb1e5f59bc3ad599c84422c6c286bbdd2c979ca06e7118e0a7c543c5e893b8b720f97d19498f4cec06e653f33de4b3d6af1598c663dd600210bf2504207e9396ab741e1ac9aac50c826eabed97645fc387f15d43c838f1f4354536cd1044ad660a814ea5dc4fa49abb1caf58639b3ce1fcd279e7ad1111d7bbf7fd204a5a6af0b619dcde3e4625e99f3838d2b7d240623399208fe104d458fa9e169afdc858a099ba627a6d802a17a98e7eae1434dedf24c16b6a7be993b419ac580fa1f31a97e940784febf518ee858eb824ca4094ae79a782e4f3d6a855b1ebb63d0f747323a6b8c3331c1adb45ff0a624434449a540613aa8c53e948f58df121d575f0549971516cd4fba26ad856d7b68c07049e6bc2374f47a86cf62fe702f9d923ace3d3a0d6da452613edbf186ecf334c9c209775610a62c1ed554a17a4ee2788ae00f65f5411bacdade0fda1e04d05438bb66563cd148b9a636969bbb168476458e7dbe58e08e9f5a2a4ac209acb439a2d50731ace22a1c4e4ecc0b0f6b0611a4efa1e89a8ad576239a29262c97f879749aac2c7753a3a8e732ca4d362608302c41e3277c3b32752080d547040117946d7db0d444fe31256043f0a478959cfaaa82b433532d5d6b40daee4015be1076a04a5642d2cd4b6659e54283812a3d549bcad70464496616f4f7f2ecf90852aa6b8cfbe01b357d52f8bf8812211ca0f27d5bdae0edadb64286c96a61663f0bc30bf55dfae1da9de565cbf10bf9d087d528bb86d200932e3a2d056e3b79bf916907da89fa1e2414d70769534b13200043f468831caad7faaa24c9a57da932e69d6784da180cb739146ae388ce352d44ee529ffa173b326d0c6600d31adde782ace20361473822e775b0e834c717450b3e742e4817c97d77c3101d0f3a714e9fe45de259934226f1124c24bc35187cd9ff63ad04636d58ff3d5438faf038f4007f752979623c5078b60440c4299b71d31bde44de58e92f5bf61fa9efa16f6d1bd6ae79a2815af1a82f7c5d55aebfe7c2b51c4f55b7dfa0b12fc9b77e36070f55ba78a1ed11976d4776643a879bcd63b72e2ff595978643db56559a3a20fa0cfde3406b4e27f6a45574dcc10b0526e6392af4b473f20166d85c36f3b44af77b1c2cdf73a3214b2ee26ba4b2618cf7dd9089b03a14f4875255d685bbc844f13864458c9aa8e556539c393fb422858fc68a46a3b11bf02eda07f33b1868f64a9dedb538395b1e8b2facf3dcc9fe444a7b7abd7b203d6eb4dd7548b48cdabbb30a7ad5017da59e286faa959965be898954c729c46c484fd45dd3cbf15cffdb39e8d112bbc9034135b612a674ebd3b606bc6b450ef3e8d243cbefd2e14f02cdd64faa76f1e5758b3b134baa45ecb5ff0d757ec0c64f623c0c3068cbcaa6838145b861364fc97ccc0a834899619404b55c104082fc5cc86a4dc9e268f739818c9ce4f725abdfcada95b8693b9a463fb2b69707a866f49ea154540f954fca0121c3365cda754af646c04dcd32427977357435d0b7f6b677076ab245d662979e5b944987fb16ac1a302904a44d950dceea60912ae1a0677a96920d952203a91588c49b8a953b01abfdcacbbf6dbf2c2361c6d1731571be0c5bb2ba6ad9f94a047703dce48198041a5c92c8b47cb107d8eedcb44e6f3d849a5075221acf5e3ee268bc70f22eae9f8454060d723eae792b34087ed724b1b6e13f73a2c378a64706b19e89684d496f3b20f52a40a0ba15161a13e28e1fa439fd3e09b2d65cc75426264dac59dba31fe3a463fd42b5f086db9cfe1eb8c4e4542ce9250ac09dd15c843da95d90b5ac76bf05bac580e7a8bb631dfd70ffd5698a38b409f1af89e489e8ae1fd26eb5210876f893fc848cf3a578c10886ec792acb01d6e6717d97e9c0af7f45caf04959e4c80e75b228a911e9326cbe4c77b7f0ab43a173055afae8d02ec9f65d756a4cef8e713ae88271e40faf3c6efec67e49aff3ad64a228f66073761bdde3fd538814df588a94250f8c5bd6fb55936695bbadf9a2aee79f39387a4cc92640f9da09e669f1a4125c598380c4722f47b695e0ca8fb32f0d01ad56167075d1f5340f5d0cd46d6f1f969f42a48b502c1847e36d86def0fd6a73f42d95d1ca258eb78f9d4ad826aeb3476fc286deb07b15d61e48eb6fb80236c83412f0611584cf31738ee89562a037b03488a5128bf915a39ea9944802d0aa986136ab89396ca8e6f1bbdf1574c7559bf4759988f5249e93340483448328fcc84e327626be796abc3c42a6970c592e0ade2bee750c90854deca5224e15d8571a20e29376cf51b5722397bb85d95add41f5402782e460fd05db5feb90e3c64a7dd13ce5307373cbd83bc940f5b3fb31d56a6fd8a9eb50ad9bf30a001c4a0acf6b88a62bb66b44dd8e7c42d6dd23a6533535460664ac5b50229a41847cfcfe3a355f039908880db9dcf2968bc7597eee7ac1da7a783647450ba5ce6a688627d9f990e9471c8f2c119adfe888e270b9b2e625fc0583ad7e73fef413379b4e"}, @NFTA_DATA_VALUE={0xa8, 0x1, "ee9a216d4484bdcd4076c6747577ae3d246a945cf3e2296f27090464b0577c8e56b0156262ec0ee4b53d2d114b53774cc59c1cfbc78a2ab91d1e279eb163489cc0d6a17d7a3654e828a8806bb1b9d50d1225dd322ea0906e90bd1619ccdb3bb02b1f69203bf962642809db593fc3dc46b0733f518bdcadd06f8fca0966267e28d6a2b7cfb327e4d6e424df4ad67076b5a739fa5f440206cb16db2478c8be2b1f58eeb640"}, @NFTA_DATA_VALUE={0x94, 0x1, "fc33787c72d89775b8bc947f2785775128014d1e0575cf5b0ad0bb6f89d0f6b7e480ac196eb3d57787d43726a189392cfca7e4db355195551a449893b9aec2f21b4de986ebc042722293a7558ce12a915858ec1e9f48cea9ee784d07db7d283f60a521062773161de2d802244e4c806f84c822cc8e1eb3f65fc86b51effedd96299b03f2fc08de83c95d46d072ecd4b3"}, @NFTA_DATA_VALUE={0x15, 0x1, "eb2bd38a64d503dfcbd26f0e73e9274d3b"}, @NFTA_DATA_VERDICT={0x4}]}, @NFTA_SET_ELEM_USERDATA={0x10, 0x6, 0x1, 0x0, "bfe48eab67f9b473ba756e65"}]}, {0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x8}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}]}, {0xad4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_KEY={0xab8, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VALUE={0x9c4, 0x1, "0751fac6b331545daca93a9cc52d98a1435adc40e6889cc00a8eae8c26caa2a77e78a5b53b47ddc6a9b33446e2c214db10c3c9af63484d7e27769f1694d7c9847d1dfd394c56c9172d1b58af0405e9f7d8024cf6438528ef78bc4a24b26f298a2cf10a6654e1e6cc4d28bf1d64f8aa7e54d57fb6f353d0e242d2ab93ae723cee8fbf48c3b5e0a3dc3ea263d614cf6cce06ca62fdd9dcf1bee22031ee845219925075ae7e1bb58c60a556b32cff9454eb9580c90c45636c0a271696071055654bfe1361c28f1b8bfc7f6b0e54998f1a54c9e8239974118437a0cba1bb3d4a9e6545d6f393d2baa6cb5e9cffa44c388b5652e15f2e06d08f1e8d8795fa9db25e7ed468e9d69157a81c6324e19cb1d1cc51b6c9692524d32c6854c61ba91a1d65d9843a1be47aef793ee294bee1f121fe0fb683ce4c53402c445d82f925cc8412dd98a24665ae5b1def8c8c55d19c227361e14c40f97c3053f878aab315a55ec2d3f57434f8aefadd48d84918dcb2db4b85efe37c2f2b857ff4c602522238b1281b809ae7112c47ee66a25a71e1939f651f83902768902ec52913102f5b430ee51dd91bec594d58053035f06645144a9b52526a6b53c406484e0efa40d49270dd74c75ff78bd80d686116c48213f06924ed3735783610d646fc4f233cce9c572b00e952d767c2730189666895e32e00c05c0185e0e72624b1eb80cdb2b0f0288008be40864ee37968072ad239c6e7721d74004aeadd39a47d5b50b2e30608dfb6815efa723736d5a08cc799f5712644a540362ce18eb86a54a9123215935b026f7d22d55ae223b3655e17a8204097b26242735e7b217245eb0e655b4dfbb2f1177bb3db12f42ad18effa2b24779433dff062dd2b51b814abae7d787d63ea75482cafe9498b877084b28a8fa4834e44d8d38de494a4a5979c616dc417006b85d24e23c81ca73be5a45f3446cc033612d05be2026122fde76477eed7f1418b43ed5c7445dd0c035abd39576cd17a5cc3cee31494616eadea8f0ab33c25831862d57b4ad7ff92e17b3b2849fb2fa509d092531ca4c4fb144b332e4aa98571a36489210d2af03fc9db285574134f9b14544141689874dcbb24f84901dc1d94a1c4cbd1c87620c79f9c4a0fcc65e077c962334806a8294e748ba0d4158695532bcc4aaea1629bfb4495e35b24612d762cbe758c25e820361b2b2d2f3e6aca2bef2f63136aa5d350d791b624e3346f7fecd7e42cd451c0137c75639e3c6bd5b6196a816844049b62f0bfb899c7c9568c85fa563384ecce1ecf8a34da8aba12015b9f62a26da24aff8a5766952a332130d282cbe062e7c7a47a41253be9ef88266912301fb33541fc12abcbf20c7055cc6f3ffc3c4abc18dfb46b49f9a97c8f05057f4576ecc30584232cd0f9205a4a3ebd1eb4cdb44d5e8895ddddcc695ce0e3d5e8327ff4db7a59d0949e467d410de6b65d19ae57a3e03c802e500935182088b2222b9dc75801326d91ab09b54a0d4cab4403af45100981c5040c1ef20022da3d3c1231dd241ea565b4a4474aaed4d83337c21ab70f611e5d9fb49b67ff8c2c78a4cef1703e4d1e6db1bbafcc620738a30106a3181953a6eb1f676b201164d00de8400a1c8b854370c68e3017cbb2f81a63be84db021d76e995fa49bcf9129c4cacf22860ea8ae059f5e026550cbe1b7c81c399e845646213e9185ceadf02dc5fe3fa871e14171a4183212f570e571c5a391292ecde870a00be4a496a79e44031b76cac2594379040491dc4794e0fdd59de52d36b8167bb1bcf8e3ebd475aa5c49f5cd895d0f48a7e4a3d1213356026f6b644147255fe7841351c8d1e6e92992a93a99de434aff3873d67b77616928d5c7105402238b6bf1cfcac6e45eadd15bf80cf4e8744b2fb0d003c561a21a53caadf9f2ee6a22f32f0a8d2fee0d010883cbc68cf45b73f3ae985e528bea79aa080c9f62789f51b083365fabd8be9f6a8fd7ee2cf2938d0f343352f33d110893e32413046a245ca09df21aaa3b6ad1eeeb455026ff766fd621cdcf12eaada6f3f4ab23928109110a61b87152e912f38ad4adf952e3fbba63c03da0e0b815a5effb44410ded8ee37838fb5115d8b3cc47086dba15697784177c9b9581202c1066a4a87eaf188e3b2f71a8513a87e9b5f6b6ccc80b085a670e2128254a871ee783d38807fcfc06d756edba37616f19b5bc93936c5f759c44211140d3718fd743af1c926dff449fd04645ec1370133f52ba80ca1f7f20337bce9dbede5ccb890198a34644e839bd5dd58c8dadca5b2fb158b14dd5f940a50fbffc79eef503feeb6c6d5566ac07325e3cf69499f1a30ef205cc2ac57bd8f9b2778a9ee7fb0078926a1ed011e37ef32caa5f75f54214403eac66a54731d6ac0fb3fbe7378e5429b754226767fc96f68855af1c178592e2706d7e419b3a9665daf8e57c726e1809857dbae4172bd479352815b7b352e2cf62a6ce7f44e3d5a5e21a85a1df529294e24ded445607c58b4ff2b0dc3f3151b255d53174ca05bdc13c40cfcfaab68b53ca6cbfd20566905ea1894cb2adf3f7774cad81123079de3d777c6f20cc2dd1558a7b6025bd9a2d5d0de52df6e56a192e1b46cb935d2f588818d54ad7c95b05f43c275865f8553836af2c8a95a2ca3141345ee29914ce45480604b92f5ecefdb23120c3158f1c1ea08c94d34d41c0dbed287d16a7ee44ef523297b0cc0f10530d36c8cddd7ec89e6464a3465465cb59ad4aee622ac4f958c922dd7b623b56e42e93085a6098369bf99f3ebd8917259b56313b20e8f45b580ae937ed0d6ea36f0b8d787a1ea414d9e7165e2e44284a2cb7731454a9110abf62896a5c67abf164eb6246cae184af0831467f0d9f4b1abd6383ce933e6b557e356271c080ee2adff8a64a8155064c0ecfcb9df8402193c87edd9f1ab825e9614ac261c6ed9366099d6647f2c31f1e07c1b5b078c036a5e09d9c93e91a3b2612b1748980c27806962a95bfef494275bd93b88a7d9b115144baebf3f3207100b0a045d054afe029e818c407e6e99510d41c9ff3bef191cee7b26ec5b32f7504b963c19ed5a7bfd1971f9d441083a633e4c0987884c33d2350a5c7b693ec5c9ffb1932026225b030555b46ed34a712feb7b59eaf6a282c9686968744562f59d8dbabb99bb7ac7e1a2486c29e908694fc8eb647dfcb87ff12b1621059a33f997c0d8c5fa0fd164028c2bf2292e4668c8ffdeb0ce8e051a9bf31a398c9eb12125b5b17e54167442ea04475b8a536fa3b024b068b118dd805800c4f65258b1c8f9cb2e8c7b01a6aaf3a9c4efb988332e4fa629773d7197a3f75356b4334c737a7f5c4eadc3b515713c83ac3eb8ad73f2100b262a42566c0f4c9b8ecffc633ba4fff37fad3875a27529da40f27aac6f887025f5129928302a3d8a134c6461a1763734d4c990e138b1e6223722dcfeb70caa361c648ee94ba11d9ffb36568d76db3ffbbfd96e24f4d1e42178dcc1f1c8b4194d5aa46bc9804efe1728ab9288648755747"}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}]}, {0x10c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_USERDATA={0x56, 0x6, 0x1, 0x0, "ff315b2e618c591a81b6ad7272d3f9d36d99a3d3e181394cc84edc28f472979f93fffb2c04f894aa3f50353ac5cecf00d89d29d1425de96b9f459511dc5eadcb2fdc96dcf5852595ee1c274ad36e1c52ab6b"}, @NFTA_SET_ELEM_KEY={0x9c, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x74, 0x1, "cc24c411561c53213c1c392ad6f195e4a96cb684f22563d0a148e583fabc4fa7160f725c3659f24bde7b9bc4ca5bf197c69d294649b7c2144efcf76508db3760bd31c43c8549bd73187f7d2e09b1a2b3d12c39eb4b6ab98ba33a7d54f4f3d59a48908f7a36c5b004dca36fbb1a4fb04c"}, @NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}]}, @NFTA_SET_ELEM_EXPR={0x4}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x78, 0x16, 0xa, 0x0, 0x0, 0x0, {}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x4c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'lo\x00'}, {0x14, 0x1, 'sit0\x00'}, {0x14, 0x1, 'sit0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}]}]}], {0x14}}, 0x2924}}, 0x0) 10:40:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 250.168108] binder_alloc: 8168: binder_alloc_buf, no vma [ 250.179330] binder: 8168:8172 ioctl c0306201 20000180 returned -14 [ 250.186380] vivid-001: ================= START STATUS ================= [ 250.208175] vivid-001: Radio HW Seek Mode: Bounded 10:40:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 250.214838] vivid-001: Radio Programmable HW Seek: false [ 250.262782] vivid-001: RDS Rx I/O Mode: Block I/O [ 250.280901] vivid-001: Generate RBDS Instead of RDS: false 10:40:41 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(0x0, 0x1000000000016) 10:40:41 executing program 5: syz_open_dev$sndpcmp(0x0, 0x8, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(0x0, 0x0, 0x0) openat$cgroup_subtree(r1, &(0x7f0000000340)='cgroup.subtree_control\x00', 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r4 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={0x0, 0x839}, 0x8) ftruncate(r4, 0x200004) sendfile(r0, r4, 0x0, 0x80001d00c0d0) 10:40:41 executing program 4: r0 = socket(0x18, 0x0, 0x2) getsockname$packet(r0, 0x0, &(0x7f00000001c0)) 10:40:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 250.314874] vivid-001: RDS Reception: true [ 250.320785] vivid-001: RDS Program Type: 0 inactive [ 250.325936] vivid-001: RDS PS Name: inactive [ 250.347664] vivid-001: RDS Radio Text: inactive [ 250.363282] vivid-001: RDS Traffic Announcement: false inactive [ 250.372464] binder_alloc: 8191: binder_alloc_buf, no vma [ 250.393890] binder: 8191:8194 ioctl c0306201 20000180 returned -14 10:40:41 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:41 executing program 4: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x6}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) connect$inet6(r0, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0x1, 0x4000000) 10:40:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 250.397541] vivid-001: RDS Traffic Program: false inactive [ 250.423698] vivid-001: RDS Music: false inactive [ 250.428768] vivid-001: ================== END STATUS ================== 10:40:41 executing program 1: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x5, &(0x7f0000000380)=0xffffffff) r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x2, 0x2) ioctl$VIDIOC_LOG_STATUS(r1, 0x5646, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ubi_ctrl\x00', 0x41, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000600)}}, 0x20) 10:40:41 executing program 1: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:41 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000040)={0x0, 0x11d000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000024003505d21b80788c", 0xd}], 0x1}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x40000000011, r7, 0x0) [ 250.587494] vivid-001: ================= START STATUS ================= [ 250.607726] vivid-001: Radio HW Seek Mode: Bounded [ 250.626283] vivid-001: Radio Programmable HW Seek: false [ 250.645166] vivid-001: RDS Rx I/O Mode: Block I/O [ 250.662144] vivid-001: Generate RBDS Instead of RDS: false [ 250.677592] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 250.680150] vivid-001: RDS Reception: true [ 250.716067] vivid-001: RDS Program Type: 0 inactive [ 250.741367] vivid-001: RDS PS Name: inactive [ 250.746170] vivid-001: RDS Radio Text: inactive [ 250.751742] vivid-001: RDS Traffic Announcement: false inactive [ 250.758188] vivid-001: RDS Traffic Program: false inactive [ 250.765572] vivid-001: RDS Music: false inactive [ 250.771422] vivid-001: ================== END STATUS ================== 10:40:42 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(0x0, 0x1000000000016) 10:40:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:42 executing program 1: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:42 executing program 0: r0 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000000)={'syz', 0x3}, &(0x7f0000000600)="585cc9e4005c48040ded83b836c1803e02a6474914dc55e72206297b6895b66147b3c7218a9169a85ea0bdc9e1587af6ff000000d342e33089754c8107c3cd3923dd4a71c2ff01007b6b4838122d2550829eaa9435c99926022b8753a188748c569f435fb3bae96efb74b50ec93c152f5e8e198a29e5c0d0c60000ce0637ce000000ec24c53dc9f2653d661ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009", 0xc1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000080)={'syz'}, &(0x7f0000000100)='\x00', 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f00000001c0)={r1, r0, r1}, &(0x7f0000000240)=""/112, 0x208, &(0x7f0000000580)={&(0x7f0000000500)={'crc32\x00'}}) 10:40:42 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000024003505d21b80788c", 0xd}], 0x1}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 10:40:42 executing program 5: r0 = socket$kcm(0xa, 0x5, 0x0) sendmsg(r0, &(0x7f0000000240)={&(0x7f0000000100)=@in={0x2, 0x0, @loopback}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000040)='9', 0x1}], 0x1, &(0x7f0000000480)=[{0x20, 0x84, 0x2, '\x00\x00\n\x00\x00\x00\x00\x00\x00'}], 0x20}, 0x0) 10:40:42 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:42 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) clone(0x8100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$IPT_SO_SET_REPLACE(r1, 0x8000000000000, 0x40, &(0x7f0000000a00)=ANY=[@ANYBLOB="7261770000000000000000000000000000000000000000000000000000000000020000000300000058030000f001000000000000000000000000000000000000c0020000c0020000c0020000c0020000c0020000030000000000000000000000ffffffffac1e000100000000000000006970366772657461703000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009001f0010000000000000000000000000000000000000000f800726563656e740000000000000000000000000000000000000000000000000000000000000000010073797a310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000bd3213a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fb00000000000000000000000000002800727066696c74657200000000000000000000000000000000000000000000000000000000000060005345540000000000000000000000000000000000000000000000000000000000000000000000d203000000e4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0000001000000000000000069703665727370616e300000000000006d6163766c6eaa649400000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000007000d00000000000000000000000000000000000000000006000434c5553544552495000000000000000000000000000000000000000000000000000aaaaaaaaaabb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700098000000000000000000000000efff000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) 10:40:42 executing program 0: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x741}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) open(0x0, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000380)) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r3 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000001640)=[{0x0}], 0x1, 0x0) ftruncate(r3, 0x200004) sendfile(r0, r3, 0x0, 0x80001d00c0d0) 10:40:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:42 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 251.357889] x_tables: ip_tables: rpfilter match: used from hooks INPUT, but only valid from PREROUTING [ 251.394998] binder: 8270:8274 ioctl c0306201 20000180 returned -14 10:40:42 executing program 4: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000140)={0x2, &(0x7f0000000100)=[{0x4000000028}, {0x80000006}]}, 0x10) [ 251.397528] x_tables: ip_tables: rpfilter match: used from hooks INPUT, but only valid from PREROUTING 10:40:42 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) r1 = gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(r1, 0x1000000000016) 10:40:42 executing program 5: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0) setxattr(&(0x7f0000000080)='./file0/file1\x00', &(0x7f00000000c0)=@known='system.posix_acl_default\x00', &(0x7f0000000100)='./cgroup.net/syz1\x00', 0x12, 0x0) 10:40:42 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:42 executing program 0: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="2800000014000300000000000000000001001c0001003806c5070200000000000400000000000000162277a5668bdd5f112a3c3206b29f76837c56032d1e7eca59f59c76db6d8fcc9e84ee02ccf829100ff6bd6543c58f95c2c1840980f8100088c9ddbc940fc49b2e964963bee3513dcdeca2001ed6597f67dad6bb05bc8ba9cbbb584f86ba5ca8ee518422b6be20531243365b982ce3cc5ae6a729568997609d566d1cbfd9acf7cf88fc3f98beba5fb26c46f9cf4d8c39d05b21cd5d2ba0e3ec8a3a63a6d6a368ce58e4b474d70fcd45131be5034f983193fafadc8e284972ea797c5072e809ae34937bb6103925d8449054323ed5721a2dda17a82e9088c36f361b3ff04d632b11ed6c6d05ddd1c1c52c2f5053cee974d1080f0f6e0409ece9a9cf335c5a635b8db8fecbc3c60a7ca0c95efc8bfa73dd9239c78d883d6072c2b1e7a785a742da059a8104756b55b30522ecd5bb738e11232269f050cac434b972a55122d5a28eec613d63deac7bf17c8e2a74641cdf4323140b0759798093adc914cbc372af4e28750ef1dcc1a7d67fbac3fab8fce3489c58026953aaa257298f7499ece2d92d504761f6cba2a6ec2ee5755ee6cb1fc00af32d7a3f30f596dade9448a0b0c1fbe9d29175dc74896fa4f88d5c664590651be97d1d714d369ae9384a57dc47dbf17dfc"], 0x28}}, 0x0) 10:40:42 executing program 4: syz_open_procfs(0x0, &(0x7f0000000240)='uid_map\x00') 10:40:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:43 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000016000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x20000000fb], 0x100000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:40:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 252.063880] binder: 8293:8296 ioctl c0306201 20000180 returned -14 10:40:43 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, 0x0) close(r0) 10:40:43 executing program 5: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 10:40:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 252.194053] binder: 8307:8310 ioctl c0306201 20000180 returned -14 10:40:43 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) r1 = gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(r1, 0x1000000000016) 10:40:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:43 executing program 5: r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x2, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x4}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0xf}, @exit={0x95, 0x0, 0x1200}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0xe, [0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) 10:40:43 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2, 0x0) read$FUSE(r2, &(0x7f0000000240), 0x2305e2b7) r3 = dup(r2) write$FUSE_DIRENTPLUS(r3, &(0x7f0000002c00)={0x490, 0x0, 0x2, [{}, {{}, {0x0, 0x0, 0x11, 0x0, 'GPLGPLtrustedbdev'}}, {{}, {0x0, 0x0, 0xa, 0x0, '/dev/cuse\x00'}}, {{}, {0x0, 0x0, 0xe, 0x0, 'vboxnet1,&proc'}}, {{}, {0x0, 0x0, 0x4, 0x0, 'bdev'}}, {{}, {0x0, 0x0, 0x2, 0x0, '\'@'}}, {{}, {0x0, 0x0, 0xf, 0x0, '/dev/sequencer\x00'}}]}, 0x490) 10:40:43 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f00000003c0)=[{{&(0x7f0000000000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2b}}, 0x10, 0x0, 0x0, &(0x7f0000000340)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x3f}}], 0x18}}], 0x1, 0x0) 10:40:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:43 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x220007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) recvmmsg(r0, &(0x7f0000001780)=[{{&(0x7f00000001c0)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000380)=""/159, 0x9f}, {0x0}, {&(0x7f0000000500)=""/71, 0x47}], 0x3, &(0x7f0000000240)=""/20, 0x14}, 0x3}, {{&(0x7f0000000580)=@caif=@dgm, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000640)=""/147, 0x93}, {&(0x7f0000000700)=""/129, 0x81}, {&(0x7f00000007c0)=""/236, 0xec}, {&(0x7f00000008c0)=""/137, 0x89}, {&(0x7f0000000980)=""/94, 0x5e}, {&(0x7f0000000a00)=""/96, 0x60}, {&(0x7f00000002c0)=""/38, 0x26}, {&(0x7f0000000a80)=""/216, 0xd8}, {&(0x7f0000000b80)=""/144, 0x90}], 0x9}, 0x8}, {{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000e40)=""/22, 0x16}, {&(0x7f0000000f00)=""/218, 0xda}], 0x2, &(0x7f00000010c0)=""/170, 0xaa}, 0x2}, {{0x0, 0x0, 0x0}}], 0x4, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000600), 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x170) 10:40:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:43 executing program 0: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r1) keyctl$chown(0x4, 0x0, 0x0, 0x0) clone(0xc75e43cfae22dd4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 10:40:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = mq_open(&(0x7f0000000280)='eth0\x00', 0x42, 0x0, 0x0) mq_timedsend(r2, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x989680}) 10:40:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 253.119887] audit: type=1400 audit(1585824044.057:51): avc: denied { sys_admin } for pid=8361 comm="syz-executor.0" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 253.382054] IPVS: ftp: loaded support on port[0] = 21 10:40:44 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) r1 = gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(r1, 0x1000000000016) 10:40:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:44 executing program 4: perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigqueueinfo(r0, 0x0, &(0x7f0000000100)) 10:40:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:44 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) sched_setscheduler(0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000680)={@void, @val, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "a5c268", 0x1298, 0x3a, 0xff, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, [{0x5, 0x19, "e5fb000005005357cd99e33bca98e246dc9027eb3334ea443e7fdc4049b892d54090878bee496aa11e07fb0f1db1a0ebe2f95347b0317613063381165c01f08fea1048ea59a6f2273e02707fdd7defc02bde3192360593169594710bddd04aead6c89c87778555de42d23236534ba1a799a63eb4532003a703b249e4628e4706bccc7a264ee85014d99a7fd4565d3c416c835a741eb4e97140e834013724d23450072f0087ac65295ca0d7c601c30de0161560e2d20c5b1052e9b208e25470e9fa884ecd2082ec38b3cb19c083"}, {0x0, 0x1b, "14a142ef59c04e8e7b4db5309006bd98ec79847a52ed68124e8a24d3079fc53b81c039a7d59f992dcb481043f510a0ce1ebb98c07a624ff8c8cc0b4fd3b8e700196d1f5696e184393de669ffaebfbd494a9d6a5fedac0738ffc3dcb3c1b96e48fd063786ae5701f6aa5022621e665607848e20f162630df96d0a773993e97ae6b847e51883d73d66bb30b4375229cfd0c9c41f511bfbf2bca94caa7ce76be257173a4eae2b484117ac32acf6ea1a32def26c919c93055c2f9a640b2d847d527357902538828abd66b3d1a9b85034066154f0b2ec054f6a8712ec98e5"}, {0x0, 0x1f, "8cf0833ae2772f05d302c778833be4f2b9c43c83284b82e71ca1ee382af46513079a2f52da08c93afdfc1a18e4b677b307a1c7df90787cbd143b129bc8dbc39104eb21674d26fd4ced8626df256869e168d42f4d160ad1442cae2bd8fda0fc44a08759d245bfe8eba42ec7967c1e953256a057369159333bca73b498a882fb5e840d429804169a6446c1d1b013144ae0ee276a463ef69ea4c4636751083041811c9b549256c6a3a71e451f8fd4de25629b3de61cba78315412fa14e350bb03feaf63909bd7320561df80bc77f36d4561a5efcc324450355ed398d9e46e798e23e2a4a2c787728b9c549a1894c53dcdfe834c7785fb3c4331"}, {0x0, 0x3, "6598975984c98199c07565e33783bc472344c2fc4e6a32"}, {0x0, 0x1f8, "631c74c9d1ae5f26763e689d7358d52b9d78e1af1392b0a090488b19cbc96370f62d48c23e1427c05acd9c3b3f073a763d782618ff1eec26b515a9b327cbc17f30d83b25eb0642880dfa19be7390bfd822af60a6c50ca6e86b5a7a713194fb7fd8d6fbabab53a0be384d6197ec95d58387c3c60474093fafe7b973081f27ecda4197fda48a1f93aef6f2fe0790ee4c44b9311e6a55f85e9a53c1b9d12d9b586d5e9c0f98d3d6f5e215a0392bc0f0747ce75347ce29eea158c0f1ff30ecf208af154508b0c1f57d03d6e884937b7d84b3170624b4ebb76df8681493b4ff2f5cb6ab9fc4745569c2105f1eef9e9e3b7f10aa79b3746d194b78719295ce4ca9a520a08a67241d6770b93eb3a0b12e0ae16886e6a6312f858009dfc6736efec7498718a3c84b37267e49860fcf486442c2f06179672b3a6d1afac32246207723f9f43a7afc4e63820609c8a44dd4a88cdec819602a152eb4403f842712fd75ea44c779e98ff01f41caba247ef6434df425ff6bf93d49d1a8a08e455f2d86ff55773d57b611dd0e464d6b5e139271a91c6c8c629b694364730a38ddbe897a252620a2e41167afc48833290e0859615328f9dd7ba13514af6e3b3ca4e6514d400ad062a3519a85c4c79265bc284308602e73254a6ad85e76649c9b48f6785971a0e01ff0fe22de2c1c0b7ff27cf7e46f022d0b1a3c3a9ba65bcba1901c95e20ce39c24ff76acf7c4a3771e114a760448dbcd88c54351ee97a903c554564866eefb0964b5fe6ba26e73b64273c3f5d8079620cd509a3d88c19d09b5cc4256f38d263e105a94cfd44305e8c2755f90fd580628f0550268c95a1193362c265e0025ebdb42e58e2afcc38edbb77eedc486564a16e2405a99a382cfe15b03b097c10cb1651c2cb4bc7c5df969fb5ce19a6c8d3accb5b67dcf11fcfb6c028107c6b93c6a9b9c659dc05549a6fb1732f67cfc0ae5fe425245b72dbb6a719f83887a8af64ea8d1b3764ce0684f2d748a057d3ee3158d58266a560f8e04777a1f303163304d08b5bd470f627e0a13928e46fd0847bde599510e6978d68bb75f40ac4e247fc8708ca82ad40e729c3de042c94756d3816083784644d5e666fb3810117a62f7508ae3cdcdf312e314acd9add8e9c3e473ae206bd9b25659db6c1f570777f408644dcc6d150e92f284ad68d4bbe1f52e0c36e88a0d083dee8f7d59540b2ddda7fd27c97abc268630cbcad1e9cdd88c0a075462288bbf59824497ba7df15bc34d9fd22f8508a6d1c90118676ad3f9fc03cea1c69594dff6e978f42d1da2011290872e062fb2cc3293030534a6cedb6f461b33b5fd90b2ee0a8ae6803f45f4f2e74fac772ce235d66e8625951d7acbc87f1c4e13cbf0c01e8909de72d3b78b7d945b53e50f38486556dc6fd58db1a1da7f9cda6b50278a73d58842f15117c0232e6860caaab9be2d010ab4c5689a0ea14d78a5ec2dde3e837cadd8e1c794168860a4e303d513cc099d79cbb7605419db906a76d44ea62c6a767fb0f5cf25325a63c4939e1e8eb8df73645b5e9c4eebe6f736706708a8b0b5eebe263d846a9dedd9cb30365f3605cde065ae8fa4cb1075b87485ec0ccbabbe3033901e273234c688136c0960932e2ecd38870b7e72ca635a6e6d23cac391686fd2b7e5aac1c6862242dffc5a656922fbd23a6a8cae9f5a19b8778409987b26442739325b05ce005b215d1843278d767de541646d03cb4a3cfe32ecd2c686b8a550e12945b53bd87ae4387bc7876d1d17f3043a536e2319b760100963de494461c3dff0dc546ade451a393f08107cd419d1a075e7ce14cb082dabb30f61e67a9772aa384ee22505f0f54a58637abea7d3aa2263e744d2f99deefc0a6e2c225b0e14f3eae792b74a289920331b5d08aa748a123e3ccd2e7918495de5ad88068f6a2bc49c0bea736aaf68c21991ddb622522c9e6907ccc0716f394fa97da40beb33db9dbea01e2d07c6425853baffdd8ed2dc0d3ef710f518393634d7e312ea87093957de12f667d2c7a73ada38d95583ec1c3b8ba18bb6f592592a690a63a257b2792c8e75b98b46584082f240301facf10ef823003392d908af8386a403810fbb14a0bf56c9c718ea0e2eb8f478974fb9beb74bfc3fb13fa71babce0fa67e57950c2022dc5580b4a0e66740bc2f11dd4866f786bfb8c4b0fa78cf36d0baff865e0051dfbadcc0fc1bb4a4d89544375500bd08c8b219aba4213e081549239847b1b11cf51a72c26654f0d40b42b69178377ee9819b896c36e70304705aa6d1de33b77b6456fdf05de27813089e6bb5089a1ff02c361a8cc0e35454eff7d06033d02b0e66fd1d542115523c25bc49aea964ff93fe12bafabe723c16a6f9e669540e83d2dd64296b59dccdd553659bf15eec6598f32dfddd5f08380f4382e88e4441135abff53f7990c0c38f8a9f103082bd6009d059852f44bbdd2d8fbeebee4fe0822d205534fa1bec74b8e41ad2314f4742201f32202c21875731f87b86e1062270a3620dc3c5d4818618063379c97a29cf76acd17caf996d186a70d8385655048299538c8eb91fd25891125e5d317d6ca064bee38526fdfb4da1769e1bfddda5e1e64e7eeef125895ab9cf9db641b03ab5ec70633e8b79c665fa37e98cfbf23b176fc6d60668b25020420c81d77bebb0d32c63326bc9f88a8d2c226a85e54d7a44583e0f5b1f7cb52dacb769b57834ddf38ef5abd017f20f115daa51dea5bcbd58ea7a90ca042357927032040291dedf20c20eab92a384a23ab282db6c2a5c89b001a4dea0688cc7ca51a120390be070e07c618cb6b0e8c9106c0d2eabfb645e5b1fa9ef878df5861431e78e9c7ac12ceec025304a4d3351204c9bf7045a3b889f20321599f3f4c9c23169d1d10ace235dfb44edc3b9582dacef2269d5d07bf4555eec665dc307daef0aaaa0f7e44764fda59a861e67c1ce55de3515df6cec910c5fbb87aa9e100c290696ef366bb69b5d2de38d2f2d99413428c9761b0dd6bc5bd8c9c5e4f22c5f2ea5b666fa694359339d2e7e9ab6622b205713c7815edaeb01b2e63ff267e4ad2f66c267a2dae50a830d0b58bb0041bbbe43f6da01fd29e6fae8a8676d366ce2e31d9f61e257dd3ba7da8504fd00eb265c02cbd9d5e1c4955b85190c9bf085fdb54350ee9074c57c7add37bf6a614be01bba4871816ddc0c7e47797ee0d7c53b06352957dd546063f1593263e945ff319dba2bcef8f18844fecb244e9ca42a012774b137e86346a021934d30f2f8fb2cd906b45260154ce17d1cf1836654791bbd378f329a588ddcfd26b87296a17fe5077ec9968f47c4ca921dface81395435873af808472eb42eb12b92dbb4cc26683e21811cd13d8d273fbf3aa75204af1f593a5b423f9537a63308a945757d5f44c99e7eeebc506ec5f28729bd38b988babc33b570f8feca7a50c0966c66f063324fa504de647f7fc7f1d18bf94ae0899b758ee0ad1bb238dfd26a4ce6f3e7fdd1dd1b062b5cd493f4aa6eb08c6cb0510c696983a254c09197c1bfb784d5947a1329d7add6d3ddef0ad4b9ec93dee717788dd223feeab64acf9a73f24996d2e7d698b18607fc9a12b94d6ceafc680d9d91a1cfbf2d5fd6d0a9070d77b7f2204665b3a94f1e6245ecf7a1c671ee987fc0c67e7a26ed5e41862c5ddfa9a8344e1d8a88ca653a2efeb6e8fba6153fff8b279317ef0d65115073b38ab74d451cb58b75812231fd6282b7544fe4412ccea896e899a8f352269f60eb2383acfe60ab315c0f7ca43112bb898c051f6f07097d584e4f743f75d304b46b6b8c0e4825f987de99f24995dde490d7da0b47400a77fc8c39e5953b491a1bddf5d55fbb27e322bdc33e04fcbaf26f93b79c3030d920472b7694810195a02dc792d9ed4b43cedb72647c3005002eab924aa8ffaaecba42aa79eb3f4fb0b9e87317df11a79320a2d5bc83ad25fb139d45b843db5f8002b5cbf33812685fd9d5b994d370e8fd5333fa936ca9940f236b2c2e201912a7781dfca80497df9327c167d4d985db50e45fdb81c6eca85a3a4d0574d75e897ff98a23bfb122438f8f62a8422e0aff85febdc54e42bd05569a95717faf06eaea46b6b3e9335a1a60a922d8e79c153324cad570ee4efa53687280de0814071352d9c6ee939eaf3e89a09887b3bd9105a888635fcd190bcebc98ce4688665b8f827a2f0f1992fa90c4921342026de6fb0d31df3aaeba026678d7425a9c2f7cb2bfd7037cf81f814492f299a29b61e2a6ae386510caf4823e520365204ebc962504cb8997a51aed2903cba9fb52e015659a4fed914f7ecaa3cf3080da45a3d95c881dbb17639c31c9d833f270af042acf467dd492e6fa636e3df3ce7f28455fdd984e609c63170ffd55a0bb2debe6a4efa7228b47d455da6bbd83319620c16c63c2675dedaea4c4d65fa50ae7786621f45b67d022d546b91edda149af142d2a720c238f5e940d701cdb27439c7ff666f80b31ab695d3852bc5f4da0c39e588badb3e49153ea153b5894ee9fdebdb1bc3b6270644fb9f9d9dd3c4089932ec8fd9090d01c7a4eda7e1c1f304b59fed6ab77440eefb0324a8f5d127be662264399b5a4a41979e2a10d2905d9c265dd492edc5df03312f89c5094ff1b7f9ec10b68eb230687b5850a6a5643066fd1ad5c05bc1e8caa2289efafca0e93a284069a2120dd96dc2677e5b913beea0e75afa45e0140aadb7e566799ecbb47c6aa0ce03503ef8da94b2668fcf90e6bba60581590a2ac73c1c419941d0f2c013306d6ea9091a9eacc053213a58b24a6f7497632690083653c19715bcabfeafcebc22b54c6a1f71132c45ae7af19f8b25bdd83851527c63f1d23cb3ea18040475372bc99090e70282d536df518e6e421b4749d2334db9212c01219d6be9693e2f313b61b3a3c34ec932300db3c696d9ee8cbc138c8828f4d956abd0ce0d4b7b4a1ca0904c096befac1d9e48c64f0063554cdff3b77bd80791408c7ddf5759c86b7ca79e55d81b624dfc7b1a7dad93497a3325c53101174876654ce91d827ee124df73708eb88364d9cc3b4847f735d21d5a4f1ed962f51bdd18ae17a4b31eb0044aaa52b561ed84326d39ed7ab2bde55ea620cee86e43b549e7440a9a64efd748b081def3a956e350b66de06bd20dbd5fc86e6eb502be1977c1c83fcb774bba5803cec4f8ef11d3f7d9fb5a225a2f3dd6c9ac755230d1fcba418bebe56ec0cc7318422e362ae7626dc803bda3bf720fb753e586188b030fc6f02a94860d66915b7d4360a87f742ef006eb7dead1d3c9dca6c7ad71096a3040e6869bafa190bb64efdf8ecabd4a61eac2a772e29bcfbfa5021c070fccbc769631e123748c43da6f9f3268ae92aa211ccff1e03368a643b65757b3620bff11a7399c08a851719bd2bd1fb5ae4a0e19002b52f4caef8573a6b4ccee2802f9726fece0e44e192ef4384fce88aa23ad46a36b32ceea3510aae6522f4d407b30f0c551f70ee6bab475df4ac6d75d9aaeac309247eab00e9556c45386522ab5922195895568ed0ccb47d5a0320080b2ec1bdbdf3013c10755eca1b30e04b50cf9cf9bed3074e8ee1eaba87787afc58129ac917ca80bbb86557c6288a99b3850f2137ebf51558ea68f854014b29e9f2329bfd01a2154fd3847c605f2d079f0b0b5c7f0871ca819e97192760f5c0407907a7d6c96950"}, {0x0, 0x1, "c3dc73ee76fa"}]}}}}}, 0x12ca) 10:40:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 253.865595] binder: 8383:8385 ioctl c0306201 0 returned -14 10:40:44 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) listen(0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000680)={@void, @val, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "a5c268", 0x1298, 0x3a, 0xff, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, [{0x5, 0x19, "e5fb000005005357cd99e33bca98e246dc9027eb3334ea443e7fdc4049b892d54090878bee496aa11e07fb0f1db1a0ebe2f95347b0317613063381165c01f08fea1048ea59a6f2273e02707fdd7defc02bde3192360593169594710bddd04aead6c89c87778555de42d23236534ba1a799a63eb4532003a703b249e4628e4706bccc7a264ee85014d99a7fd4565d3c416c835a741eb4e97140e834013724d23450072f0087ac65295ca0d7c601c30de0161560e2d20c5b1052e9b208e25470e9fa884ecd2082ec38b3cb19c083"}, {0x0, 0x1b, "14a142ef59c04e8e7b4db5309006bd98ec79847a52ed68124e8a24d3079fc53b81c039a7d59f992dcb481043f510a0ce1ebb98c07a624ff8c8cc0b4fd3b8e700196d1f5696e184393de669ffaebfbd494a9d6a5fedac0738ffc3dcb3c1b96e48fd063786ae5701f6aa5022621e665607848e20f162630df96d0a773993e97ae6b847e51883d73d66bb30b4375229cfd0c9c41f511bfbf2bca94caa7ce76be257173a4eae2b484117ac32acf6ea1a32def26c919c93055c2f9a640b2d847d527357902538828abd66b3d1a9b85034066154f0b2ec054f6a8712ec98e5"}, {0x0, 0x1f, "8cf0833ae2772f05d302c778833be4f2b9c43c83284b82e71ca1ee382af46513079a2f52da08c93afdfc1a18e4b677b307a1c7df90787cbd143b129bc8dbc39104eb21674d26fd4ced8626df256869e168d42f4d160ad1442cae2bd8fda0fc44a08759d245bfe8eba42ec7967c1e953256a057369159333bca73b498a882fb5e840d429804169a6446c1d1b013144ae0ee276a463ef69ea4c4636751083041811c9b549256c6a3a71e451f8fd4de25629b3de61cba78315412fa14e350bb03feaf63909bd7320561df80bc77f36d4561a5efcc324450355ed398d9e46e798e23e2a4a2c787728b9c549a1894c53dcdfe834c7785fb3c4331"}, {0x0, 0x3, "6598975984c98199c07565e33783bc472344c2fc4e6a32"}, {0x0, 0x1f8, "631c74c9d1ae5f26763e689d7358d52b9d78e1af1392b0a090488b19cbc96370f62d48c23e1427c05acd9c3b3f073a763d782618ff1eec26b515a9b327cbc17f30d83b25eb0642880dfa19be7390bfd822af60a6c50ca6e86b5a7a713194fb7fd8d6fbabab53a0be384d6197ec95d58387c3c60474093fafe7b973081f27ecda4197fda48a1f93aef6f2fe0790ee4c44b9311e6a55f85e9a53c1b9d12d9b586d5e9c0f98d3d6f5e215a0392bc0f0747ce75347ce29eea158c0f1ff30ecf208af154508b0c1f57d03d6e884937b7d84b3170624b4ebb76df8681493b4ff2f5cb6ab9fc4745569c2105f1eef9e9e3b7f10aa79b3746d194b78719295ce4ca9a520a08a67241d6770b93eb3a0b12e0ae16886e6a6312f858009dfc6736efec7498718a3c84b37267e49860fcf486442c2f06179672b3a6d1afac32246207723f9f43a7afc4e63820609c8a44dd4a88cdec819602a152eb4403f842712fd75ea44c779e98ff01f41caba247ef6434df425ff6bf93d49d1a8a08e455f2d86ff55773d57b611dd0e464d6b5e139271a91c6c8c629b694364730a38ddbe897a252620a2e41167afc48833290e0859615328f9dd7ba13514af6e3b3ca4e6514d400ad062a3519a85c4c79265bc284308602e73254a6ad85e76649c9b48f6785971a0e01ff0fe22de2c1c0b7ff27cf7e46f022d0b1a3c3a9ba65bcba1901c95e20ce39c24ff76acf7c4a3771e114a760448dbcd88c54351ee97a903c554564866eefb0964b5fe6ba26e73b64273c3f5d8079620cd509a3d88c19d09b5cc4256f38d263e105a94cfd44305e8c2755f90fd580628f0550268c95a1193362c265e0025ebdb42e58e2afcc38edbb77eedc486564a16e2405a99a382cfe15b03b097c10cb1651c2cb4bc7c5df969fb5ce19a6c8d3accb5b67dcf11fcfb6c028107c6b93c6a9b9c659dc05549a6fb1732f67cfc0ae5fe425245b72dbb6a719f83887a8af64ea8d1b3764ce0684f2d748a057d3ee3158d58266a560f8e04777a1f303163304d08b5bd470f627e0a13928e46fd0847bde599510e6978d68bb75f40ac4e247fc8708ca82ad40e729c3de042c94756d3816083784644d5e666fb3810117a62f7508ae3cdcdf312e314acd9add8e9c3e473ae206bd9b25659db6c1f570777f408644dcc6d150e92f284ad68d4bbe1f52e0c36e88a0d083dee8f7d59540b2ddda7fd27c97abc268630cbcad1e9cdd88c0a075462288bbf59824497ba7df15bc34d9fd22f8508a6d1c90118676ad3f9fc03cea1c69594dff6e978f42d1da2011290872e062fb2cc3293030534a6cedb6f461b33b5fd90b2ee0a8ae6803f45f4f2e74fac772ce235d66e8625951d7acbc87f1c4e13cbf0c01e8909de72d3b78b7d945b53e50f38486556dc6fd58db1a1da7f9cda6b50278a73d58842f15117c0232e6860caaab9be2d010ab4c5689a0ea14d78a5ec2dde3e837cadd8e1c794168860a4e303d513cc099d79cbb7605419db906a76d44ea62c6a767fb0f5cf25325a63c4939e1e8eb8df73645b5e9c4eebe6f736706708a8b0b5eebe263d846a9dedd9cb30365f3605cde065ae8fa4cb1075b87485ec0ccbabbe3033901e273234c688136c0960932e2ecd38870b7e72ca635a6e6d23cac391686fd2b7e5aac1c6862242dffc5a656922fbd23a6a8cae9f5a19b8778409987b26442739325b05ce005b215d1843278d767de541646d03cb4a3cfe32ecd2c686b8a550e12945b53bd87ae4387bc7876d1d17f3043a536e2319b760100963de494461c3dff0dc546ade451a393f08107cd419d1a075e7ce14cb082dabb30f61e67a9772aa384ee22505f0f54a58637abea7d3aa2263e744d2f99deefc0a6e2c225b0e14f3eae792b74a289920331b5d08aa748a123e3ccd2e7918495de5ad88068f6a2bc49c0bea736aaf68c21991ddb622522c9e6907ccc0716f394fa97da40beb33db9dbea01e2d07c6425853baffdd8ed2dc0d3ef710f518393634d7e312ea87093957de12f667d2c7a73ada38d95583ec1c3b8ba18bb6f592592a690a63a257b2792c8e75b98b46584082f240301facf10ef823003392d908af8386a403810fbb14a0bf56c9c718ea0e2eb8f478974fb9beb74bfc3fb13fa71babce0fa67e57950c2022dc5580b4a0e66740bc2f11dd4866f786bfb8c4b0fa78cf36d0baff865e0051dfbadcc0fc1bb4a4d89544375500bd08c8b219aba4213e081549239847b1b11cf51a72c26654f0d40b42b69178377ee9819b896c36e70304705aa6d1de33b77b6456fdf05de27813089e6bb5089a1ff02c361a8cc0e35454eff7d06033d02b0e66fd1d542115523c25bc49aea964ff93fe12bafabe723c16a6f9e669540e83d2dd64296b59dccdd553659bf15eec6598f32dfddd5f08380f4382e88e4441135abff53f7990c0c38f8a9f103082bd6009d059852f44bbdd2d8fbeebee4fe0822d205534fa1bec74b8e41ad2314f4742201f32202c21875731f87b86e1062270a3620dc3c5d4818618063379c97a29cf76acd17caf996d186a70d8385655048299538c8eb91fd25891125e5d317d6ca064bee38526fdfb4da1769e1bfddda5e1e64e7eeef125895ab9cf9db641b03ab5ec70633e8b79c665fa37e98cfbf23b176fc6d60668b25020420c81d77bebb0d32c63326bc9f88a8d2c226a85e54d7a44583e0f5b1f7cb52dacb769b57834ddf38ef5abd017f20f115daa51dea5bcbd58ea7a90ca042357927032040291dedf20c20eab92a384a23ab282db6c2a5c89b001a4dea0688cc7ca51a120390be070e07c618cb6b0e8c9106c0d2eabfb645e5b1fa9ef878df5861431e78e9c7ac12ceec025304a4d3351204c9bf7045a3b889f20321599f3f4c9c23169d1d10ace235dfb44edc3b9582dacef2269d5d07bf4555eec665dc307daef0aaaa0f7e44764fda59a861e67c1ce55de3515df6cec910c5fbb87aa9e100c290696ef366bb69b5d2de38d2f2d99413428c9761b0dd6bc5bd8c9c5e4f22c5f2ea5b666fa694359339d2e7e9ab6622b205713c7815edaeb01b2e63ff267e4ad2f66c267a2dae50a830d0b58bb0041bbbe43f6da01fd29e6fae8a8676d366ce2e31d9f61e257dd3ba7da8504fd00eb265c02cbd9d5e1c4955b85190c9bf085fdb54350ee9074c57c7add37bf6a614be01bba4871816ddc0c7e47797ee0d7c53b06352957dd546063f1593263e945ff319dba2bcef8f18844fecb244e9ca42a012774b137e86346a021934d30f2f8fb2cd906b45260154ce17d1cf1836654791bbd378f329a588ddcfd26b87296a17fe5077ec9968f47c4ca921dface81395435873af808472eb42eb12b92dbb4cc26683e21811cd13d8d273fbf3aa75204af1f593a5b423f9537a63308a945757d5f44c99e7eeebc506ec5f28729bd38b988babc33b570f8feca7a50c0966c66f063324fa504de647f7fc7f1d18bf94ae0899b758ee0ad1bb238dfd26a4ce6f3e7fdd1dd1b062b5cd493f4aa6eb08c6cb0510c696983a254c09197c1bfb784d5947a1329d7add6d3ddef0ad4b9ec93dee717788dd223feeab64acf9a73f24996d2e7d698b18607fc9a12b94d6ceafc680d9d91a1cfbf2d5fd6d0a9070d77b7f2204665b3a94f1e6245ecf7a1c671ee987fc0c67e7a26ed5e41862c5ddfa9a8344e1d8a88ca653a2efeb6e8fba6153fff8b279317ef0d65115073b38ab74d451cb58b75812231fd6282b7544fe4412ccea896e899a8f352269f60eb2383acfe60ab315c0f7ca43112bb898c051f6f07097d584e4f743f75d304b46b6b8c0e4825f987de99f24995dde490d7da0b47400a77fc8c39e5953b491a1bddf5d55fbb27e322bdc33e04fcbaf26f93b79c3030d920472b7694810195a02dc792d9ed4b43cedb72647c3005002eab924aa8ffaaecba42aa79eb3f4fb0b9e87317df11a79320a2d5bc83ad25fb139d45b843db5f8002b5cbf33812685fd9d5b994d370e8fd5333fa936ca9940f236b2c2e201912a7781dfca80497df9327c167d4d985db50e45fdb81c6eca85a3a4d0574d75e897ff98a23bfb122438f8f62a8422e0aff85febdc54e42bd05569a95717faf06eaea46b6b3e9335a1a60a922d8e79c153324cad570ee4efa53687280de0814071352d9c6ee939eaf3e89a09887b3bd9105a888635fcd190bcebc98ce4688665b8f827a2f0f1992fa90c4921342026de6fb0d31df3aaeba026678d7425a9c2f7cb2bfd7037cf81f814492f299a29b61e2a6ae386510caf4823e520365204ebc962504cb8997a51aed2903cba9fb52e015659a4fed914f7ecaa3cf3080da45a3d95c881dbb17639c31c9d833f270af042acf467dd492e6fa636e3df3ce7f28455fdd984e609c63170ffd55a0bb2debe6a4efa7228b47d455da6bbd83319620c16c63c2675dedaea4c4d65fa50ae7786621f45b67d022d546b91edda149af142d2a720c238f5e940d701cdb27439c7ff666f80b31ab695d3852bc5f4da0c39e588badb3e49153ea153b5894ee9fdebdb1bc3b6270644fb9f9d9dd3c4089932ec8fd9090d01c7a4eda7e1c1f304b59fed6ab77440eefb0324a8f5d127be662264399b5a4a41979e2a10d2905d9c265dd492edc5df03312f89c5094ff1b7f9ec10b68eb230687b5850a6a5643066fd1ad5c05bc1e8caa2289efafca0e93a284069a2120dd96dc2677e5b913beea0e75afa45e0140aadb7e566799ecbb47c6aa0ce03503ef8da94b2668fcf90e6bba60581590a2ac73c1c419941d0f2c013306d6ea9091a9eacc053213a58b24a6f7497632690083653c19715bcabfeafcebc22b54c6a1f71132c45ae7af19f8b25bdd83851527c63f1d23cb3ea18040475372bc99090e70282d536df518e6e421b4749d2334db9212c01219d6be9693e2f313b61b3a3c34ec932300db3c696d9ee8cbc138c8828f4d956abd0ce0d4b7b4a1ca0904c096befac1d9e48c64f0063554cdff3b77bd80791408c7ddf5759c86b7ca79e55d81b624dfc7b1a7dad93497a3325c53101174876654ce91d827ee124df73708eb88364d9cc3b4847f735d21d5a4f1ed962f51bdd18ae17a4b31eb0044aaa52b561ed84326d39ed7ab2bde55ea620cee86e43b549e7440a9a64efd748b081def3a956e350b66de06bd20dbd5fc86e6eb502be1977c1c83fcb774bba5803cec4f8ef11d3f7d9fb5a225a2f3dd6c9ac755230d1fcba418bebe56ec0cc7318422e362ae7626dc803bda3bf720fb753e586188b030fc6f02a94860d66915b7d4360a87f742ef006eb7dead1d3c9dca6c7ad71096a3040e6869bafa190bb64efdf8ecabd4a61eac2a772e29bcfbfa5021c070fccbc769631e123748c43da6f9f3268ae92aa211ccff1e03368a643b65757b3620bff11a7399c08a851719bd2bd1fb5ae4a0e19002b52f4caef8573a6b4ccee2802f9726fece0e44e192ef4384fce88aa23ad46a36b32ceea3510aae6522f4d407b30f0c551f70ee6bab475df4ac6d75d9aaeac309247eab00e9556c45386522ab5922195895568ed0ccb47d5a0320080b2ec1bdbdf3013c10755eca1b30e04b50cf9cf9bed3074e8ee1eaba87787afc58129ac917ca80bbb86557c6288a99b3850f2137ebf51558ea68f854014b29e9f2329bfd01a2154fd3847c605f2d079f0b0b5c7f0871ca819e97192760f5c0407907a7d6c96950"}, {0x0, 0x1, "c3dc73ee76fa"}]}}}}}, 0x12ca) [ 253.963197] binder: 8396:8398 ioctl c0306201 0 returned -14 [ 253.984369] binder: 8391:8393 ioctl c0306201 20000180 returned -14 10:40:45 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2}, 0x1c) listen(0xffffffffffffffff, 0x1) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000680)={@void, @val, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "a5c268", 0x1298, 0x3a, 0xff, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, [{0x5, 0x19, "e5fb000005005357cd99e33bca98e246dc9027eb3334ea443e7fdc4049b892d54090878bee496aa11e07fb0f1db1a0ebe2f95347b0317613063381165c01f08fea1048ea59a6f2273e02707fdd7defc02bde3192360593169594710bddd04aead6c89c87778555de42d23236534ba1a799a63eb4532003a703b249e4628e4706bccc7a264ee85014d99a7fd4565d3c416c835a741eb4e97140e834013724d23450072f0087ac65295ca0d7c601c30de0161560e2d20c5b1052e9b208e25470e9fa884ecd2082ec38b3cb19c083"}, {0x0, 0x1b, "14a142ef59c04e8e7b4db5309006bd98ec79847a52ed68124e8a24d3079fc53b81c039a7d59f992dcb481043f510a0ce1ebb98c07a624ff8c8cc0b4fd3b8e700196d1f5696e184393de669ffaebfbd494a9d6a5fedac0738ffc3dcb3c1b96e48fd063786ae5701f6aa5022621e665607848e20f162630df96d0a773993e97ae6b847e51883d73d66bb30b4375229cfd0c9c41f511bfbf2bca94caa7ce76be257173a4eae2b484117ac32acf6ea1a32def26c919c93055c2f9a640b2d847d527357902538828abd66b3d1a9b85034066154f0b2ec054f6a8712ec98e5"}, {0x0, 0x1f, "8cf0833ae2772f05d302c778833be4f2b9c43c83284b82e71ca1ee382af46513079a2f52da08c93afdfc1a18e4b677b307a1c7df90787cbd143b129bc8dbc39104eb21674d26fd4ced8626df256869e168d42f4d160ad1442cae2bd8fda0fc44a08759d245bfe8eba42ec7967c1e953256a057369159333bca73b498a882fb5e840d429804169a6446c1d1b013144ae0ee276a463ef69ea4c4636751083041811c9b549256c6a3a71e451f8fd4de25629b3de61cba78315412fa14e350bb03feaf63909bd7320561df80bc77f36d4561a5efcc324450355ed398d9e46e798e23e2a4a2c787728b9c549a1894c53dcdfe834c7785fb3c4331"}, {0x0, 0x3, "6598975984c98199c07565e33783bc472344c2fc4e6a32"}, {0x0, 0x1f8, "631c74c9d1ae5f26763e689d7358d52b9d78e1af1392b0a090488b19cbc96370f62d48c23e1427c05acd9c3b3f073a763d782618ff1eec26b515a9b327cbc17f30d83b25eb0642880dfa19be7390bfd822af60a6c50ca6e86b5a7a713194fb7fd8d6fbabab53a0be384d6197ec95d58387c3c60474093fafe7b973081f27ecda4197fda48a1f93aef6f2fe0790ee4c44b9311e6a55f85e9a53c1b9d12d9b586d5e9c0f98d3d6f5e215a0392bc0f0747ce75347ce29eea158c0f1ff30ecf208af154508b0c1f57d03d6e884937b7d84b3170624b4ebb76df8681493b4ff2f5cb6ab9fc4745569c2105f1eef9e9e3b7f10aa79b3746d194b78719295ce4ca9a520a08a67241d6770b93eb3a0b12e0ae16886e6a6312f858009dfc6736efec7498718a3c84b37267e49860fcf486442c2f06179672b3a6d1afac32246207723f9f43a7afc4e63820609c8a44dd4a88cdec819602a152eb4403f842712fd75ea44c779e98ff01f41caba247ef6434df425ff6bf93d49d1a8a08e455f2d86ff55773d57b611dd0e464d6b5e139271a91c6c8c629b694364730a38ddbe897a252620a2e41167afc48833290e0859615328f9dd7ba13514af6e3b3ca4e6514d400ad062a3519a85c4c79265bc284308602e73254a6ad85e76649c9b48f6785971a0e01ff0fe22de2c1c0b7ff27cf7e46f022d0b1a3c3a9ba65bcba1901c95e20ce39c24ff76acf7c4a3771e114a760448dbcd88c54351ee97a903c554564866eefb0964b5fe6ba26e73b64273c3f5d8079620cd509a3d88c19d09b5cc4256f38d263e105a94cfd44305e8c2755f90fd580628f0550268c95a1193362c265e0025ebdb42e58e2afcc38edbb77eedc486564a16e2405a99a382cfe15b03b097c10cb1651c2cb4bc7c5df969fb5ce19a6c8d3accb5b67dcf11fcfb6c028107c6b93c6a9b9c659dc05549a6fb1732f67cfc0ae5fe425245b72dbb6a719f83887a8af64ea8d1b3764ce0684f2d748a057d3ee3158d58266a560f8e04777a1f303163304d08b5bd470f627e0a13928e46fd0847bde599510e6978d68bb75f40ac4e247fc8708ca82ad40e729c3de042c94756d3816083784644d5e666fb3810117a62f7508ae3cdcdf312e314acd9add8e9c3e473ae206bd9b25659db6c1f570777f408644dcc6d150e92f284ad68d4bbe1f52e0c36e88a0d083dee8f7d59540b2ddda7fd27c97abc268630cbcad1e9cdd88c0a075462288bbf59824497ba7df15bc34d9fd22f8508a6d1c90118676ad3f9fc03cea1c69594dff6e978f42d1da2011290872e062fb2cc3293030534a6cedb6f461b33b5fd90b2ee0a8ae6803f45f4f2e74fac772ce235d66e8625951d7acbc87f1c4e13cbf0c01e8909de72d3b78b7d945b53e50f38486556dc6fd58db1a1da7f9cda6b50278a73d58842f15117c0232e6860caaab9be2d010ab4c5689a0ea14d78a5ec2dde3e837cadd8e1c794168860a4e303d513cc099d79cbb7605419db906a76d44ea62c6a767fb0f5cf25325a63c4939e1e8eb8df73645b5e9c4eebe6f736706708a8b0b5eebe263d846a9dedd9cb30365f3605cde065ae8fa4cb1075b87485ec0ccbabbe3033901e273234c688136c0960932e2ecd38870b7e72ca635a6e6d23cac391686fd2b7e5aac1c6862242dffc5a656922fbd23a6a8cae9f5a19b8778409987b26442739325b05ce005b215d1843278d767de541646d03cb4a3cfe32ecd2c686b8a550e12945b53bd87ae4387bc7876d1d17f3043a536e2319b760100963de494461c3dff0dc546ade451a393f08107cd419d1a075e7ce14cb082dabb30f61e67a9772aa384ee22505f0f54a58637abea7d3aa2263e744d2f99deefc0a6e2c225b0e14f3eae792b74a289920331b5d08aa748a123e3ccd2e7918495de5ad88068f6a2bc49c0bea736aaf68c21991ddb622522c9e6907ccc0716f394fa97da40beb33db9dbea01e2d07c6425853baffdd8ed2dc0d3ef710f518393634d7e312ea87093957de12f667d2c7a73ada38d95583ec1c3b8ba18bb6f592592a690a63a257b2792c8e75b98b46584082f240301facf10ef823003392d908af8386a403810fbb14a0bf56c9c718ea0e2eb8f478974fb9beb74bfc3fb13fa71babce0fa67e57950c2022dc5580b4a0e66740bc2f11dd4866f786bfb8c4b0fa78cf36d0baff865e0051dfbadcc0fc1bb4a4d89544375500bd08c8b219aba4213e081549239847b1b11cf51a72c26654f0d40b42b69178377ee9819b896c36e70304705aa6d1de33b77b6456fdf05de27813089e6bb5089a1ff02c361a8cc0e35454eff7d06033d02b0e66fd1d542115523c25bc49aea964ff93fe12bafabe723c16a6f9e669540e83d2dd64296b59dccdd553659bf15eec6598f32dfddd5f08380f4382e88e4441135abff53f7990c0c38f8a9f103082bd6009d059852f44bbdd2d8fbeebee4fe0822d205534fa1bec74b8e41ad2314f4742201f32202c21875731f87b86e1062270a3620dc3c5d4818618063379c97a29cf76acd17caf996d186a70d8385655048299538c8eb91fd25891125e5d317d6ca064bee38526fdfb4da1769e1bfddda5e1e64e7eeef125895ab9cf9db641b03ab5ec70633e8b79c665fa37e98cfbf23b176fc6d60668b25020420c81d77bebb0d32c63326bc9f88a8d2c226a85e54d7a44583e0f5b1f7cb52dacb769b57834ddf38ef5abd017f20f115daa51dea5bcbd58ea7a90ca042357927032040291dedf20c20eab92a384a23ab282db6c2a5c89b001a4dea0688cc7ca51a120390be070e07c618cb6b0e8c9106c0d2eabfb645e5b1fa9ef878df5861431e78e9c7ac12ceec025304a4d3351204c9bf7045a3b889f20321599f3f4c9c23169d1d10ace235dfb44edc3b9582dacef2269d5d07bf4555eec665dc307daef0aaaa0f7e44764fda59a861e67c1ce55de3515df6cec910c5fbb87aa9e100c290696ef366bb69b5d2de38d2f2d99413428c9761b0dd6bc5bd8c9c5e4f22c5f2ea5b666fa694359339d2e7e9ab6622b205713c7815edaeb01b2e63ff267e4ad2f66c267a2dae50a830d0b58bb0041bbbe43f6da01fd29e6fae8a8676d366ce2e31d9f61e257dd3ba7da8504fd00eb265c02cbd9d5e1c4955b85190c9bf085fdb54350ee9074c57c7add37bf6a614be01bba4871816ddc0c7e47797ee0d7c53b06352957dd546063f1593263e945ff319dba2bcef8f18844fecb244e9ca42a012774b137e86346a021934d30f2f8fb2cd906b45260154ce17d1cf1836654791bbd378f329a588ddcfd26b87296a17fe5077ec9968f47c4ca921dface81395435873af808472eb42eb12b92dbb4cc26683e21811cd13d8d273fbf3aa75204af1f593a5b423f9537a63308a945757d5f44c99e7eeebc506ec5f28729bd38b988babc33b570f8feca7a50c0966c66f063324fa504de647f7fc7f1d18bf94ae0899b758ee0ad1bb238dfd26a4ce6f3e7fdd1dd1b062b5cd493f4aa6eb08c6cb0510c696983a254c09197c1bfb784d5947a1329d7add6d3ddef0ad4b9ec93dee717788dd223feeab64acf9a73f24996d2e7d698b18607fc9a12b94d6ceafc680d9d91a1cfbf2d5fd6d0a9070d77b7f2204665b3a94f1e6245ecf7a1c671ee987fc0c67e7a26ed5e41862c5ddfa9a8344e1d8a88ca653a2efeb6e8fba6153fff8b279317ef0d65115073b38ab74d451cb58b75812231fd6282b7544fe4412ccea896e899a8f352269f60eb2383acfe60ab315c0f7ca43112bb898c051f6f07097d584e4f743f75d304b46b6b8c0e4825f987de99f24995dde490d7da0b47400a77fc8c39e5953b491a1bddf5d55fbb27e322bdc33e04fcbaf26f93b79c3030d920472b7694810195a02dc792d9ed4b43cedb72647c3005002eab924aa8ffaaecba42aa79eb3f4fb0b9e87317df11a79320a2d5bc83ad25fb139d45b843db5f8002b5cbf33812685fd9d5b994d370e8fd5333fa936ca9940f236b2c2e201912a7781dfca80497df9327c167d4d985db50e45fdb81c6eca85a3a4d0574d75e897ff98a23bfb122438f8f62a8422e0aff85febdc54e42bd05569a95717faf06eaea46b6b3e9335a1a60a922d8e79c153324cad570ee4efa53687280de0814071352d9c6ee939eaf3e89a09887b3bd9105a888635fcd190bcebc98ce4688665b8f827a2f0f1992fa90c4921342026de6fb0d31df3aaeba026678d7425a9c2f7cb2bfd7037cf81f814492f299a29b61e2a6ae386510caf4823e520365204ebc962504cb8997a51aed2903cba9fb52e015659a4fed914f7ecaa3cf3080da45a3d95c881dbb17639c31c9d833f270af042acf467dd492e6fa636e3df3ce7f28455fdd984e609c63170ffd55a0bb2debe6a4efa7228b47d455da6bbd83319620c16c63c2675dedaea4c4d65fa50ae7786621f45b67d022d546b91edda149af142d2a720c238f5e940d701cdb27439c7ff666f80b31ab695d3852bc5f4da0c39e588badb3e49153ea153b5894ee9fdebdb1bc3b6270644fb9f9d9dd3c4089932ec8fd9090d01c7a4eda7e1c1f304b59fed6ab77440eefb0324a8f5d127be662264399b5a4a41979e2a10d2905d9c265dd492edc5df03312f89c5094ff1b7f9ec10b68eb230687b5850a6a5643066fd1ad5c05bc1e8caa2289efafca0e93a284069a2120dd96dc2677e5b913beea0e75afa45e0140aadb7e566799ecbb47c6aa0ce03503ef8da94b2668fcf90e6bba60581590a2ac73c1c419941d0f2c013306d6ea9091a9eacc053213a58b24a6f7497632690083653c19715bcabfeafcebc22b54c6a1f71132c45ae7af19f8b25bdd83851527c63f1d23cb3ea18040475372bc99090e70282d536df518e6e421b4749d2334db9212c01219d6be9693e2f313b61b3a3c34ec932300db3c696d9ee8cbc138c8828f4d956abd0ce0d4b7b4a1ca0904c096befac1d9e48c64f0063554cdff3b77bd80791408c7ddf5759c86b7ca79e55d81b624dfc7b1a7dad93497a3325c53101174876654ce91d827ee124df73708eb88364d9cc3b4847f735d21d5a4f1ed962f51bdd18ae17a4b31eb0044aaa52b561ed84326d39ed7ab2bde55ea620cee86e43b549e7440a9a64efd748b081def3a956e350b66de06bd20dbd5fc86e6eb502be1977c1c83fcb774bba5803cec4f8ef11d3f7d9fb5a225a2f3dd6c9ac755230d1fcba418bebe56ec0cc7318422e362ae7626dc803bda3bf720fb753e586188b030fc6f02a94860d66915b7d4360a87f742ef006eb7dead1d3c9dca6c7ad71096a3040e6869bafa190bb64efdf8ecabd4a61eac2a772e29bcfbfa5021c070fccbc769631e123748c43da6f9f3268ae92aa211ccff1e03368a643b65757b3620bff11a7399c08a851719bd2bd1fb5ae4a0e19002b52f4caef8573a6b4ccee2802f9726fece0e44e192ef4384fce88aa23ad46a36b32ceea3510aae6522f4d407b30f0c551f70ee6bab475df4ac6d75d9aaeac309247eab00e9556c45386522ab5922195895568ed0ccb47d5a0320080b2ec1bdbdf3013c10755eca1b30e04b50cf9cf9bed3074e8ee1eaba87787afc58129ac917ca80bbb86557c6288a99b3850f2137ebf51558ea68f854014b29e9f2329bfd01a2154fd3847c605f2d079f0b0b5c7f0871ca819e97192760f5c0407907a7d6c96950"}, {0x0, 0x1, "c3dc73ee76fa"}]}}}}}, 0x12ca) 10:40:45 executing program 4: r0 = gettid() r1 = creat(&(0x7f0000000100)='./file0\x00', 0x10003) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) close(r1) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) 10:40:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 254.236075] binder: 8409:8413 ioctl c0306201 0 returned -14 [ 254.336356] ptrace attach of "/root/syz-executor.4"[8415] was attempted by "/root/syz-executor.4"[8417] [ 254.353023] ptrace attach of "/root/syz-executor.4"[8415] was attempted by "/root/syz-executor.4"[8424] 10:40:45 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = gettid() r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)) read(r1, &(0x7f0000000300)=""/128, 0x80) tkill(r0, 0x1000000000016) 10:40:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:45 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) sched_setscheduler(0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000680)={@void, @val, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "a5c268", 0x1298, 0x3a, 0xff, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, [{0x5, 0x19, "e5fb000005005357cd99e33bca98e246dc9027eb3334ea443e7fdc4049b892d54090878bee496aa11e07fb0f1db1a0ebe2f95347b0317613063381165c01f08fea1048ea59a6f2273e02707fdd7defc02bde3192360593169594710bddd04aead6c89c87778555de42d23236534ba1a799a63eb4532003a703b249e4628e4706bccc7a264ee85014d99a7fd4565d3c416c835a741eb4e97140e834013724d23450072f0087ac65295ca0d7c601c30de0161560e2d20c5b1052e9b208e25470e9fa884ecd2082ec38b3cb19c083"}, {0x0, 0x1b, "14a142ef59c04e8e7b4db5309006bd98ec79847a52ed68124e8a24d3079fc53b81c039a7d59f992dcb481043f510a0ce1ebb98c07a624ff8c8cc0b4fd3b8e700196d1f5696e184393de669ffaebfbd494a9d6a5fedac0738ffc3dcb3c1b96e48fd063786ae5701f6aa5022621e665607848e20f162630df96d0a773993e97ae6b847e51883d73d66bb30b4375229cfd0c9c41f511bfbf2bca94caa7ce76be257173a4eae2b484117ac32acf6ea1a32def26c919c93055c2f9a640b2d847d527357902538828abd66b3d1a9b85034066154f0b2ec054f6a8712ec98e5"}, {0x0, 0x1f, "8cf0833ae2772f05d302c778833be4f2b9c43c83284b82e71ca1ee382af46513079a2f52da08c93afdfc1a18e4b677b307a1c7df90787cbd143b129bc8dbc39104eb21674d26fd4ced8626df256869e168d42f4d160ad1442cae2bd8fda0fc44a08759d245bfe8eba42ec7967c1e953256a057369159333bca73b498a882fb5e840d429804169a6446c1d1b013144ae0ee276a463ef69ea4c4636751083041811c9b549256c6a3a71e451f8fd4de25629b3de61cba78315412fa14e350bb03feaf63909bd7320561df80bc77f36d4561a5efcc324450355ed398d9e46e798e23e2a4a2c787728b9c549a1894c53dcdfe834c7785fb3c4331"}, {0x0, 0x3, "6598975984c98199c07565e33783bc472344c2fc4e6a32"}, {0x0, 0x1f8, "631c74c9d1ae5f26763e689d7358d52b9d78e1af1392b0a090488b19cbc96370f62d48c23e1427c05acd9c3b3f073a763d782618ff1eec26b515a9b327cbc17f30d83b25eb0642880dfa19be7390bfd822af60a6c50ca6e86b5a7a713194fb7fd8d6fbabab53a0be384d6197ec95d58387c3c60474093fafe7b973081f27ecda4197fda48a1f93aef6f2fe0790ee4c44b9311e6a55f85e9a53c1b9d12d9b586d5e9c0f98d3d6f5e215a0392bc0f0747ce75347ce29eea158c0f1ff30ecf208af154508b0c1f57d03d6e884937b7d84b3170624b4ebb76df8681493b4ff2f5cb6ab9fc4745569c2105f1eef9e9e3b7f10aa79b3746d194b78719295ce4ca9a520a08a67241d6770b93eb3a0b12e0ae16886e6a6312f858009dfc6736efec7498718a3c84b37267e49860fcf486442c2f06179672b3a6d1afac32246207723f9f43a7afc4e63820609c8a44dd4a88cdec819602a152eb4403f842712fd75ea44c779e98ff01f41caba247ef6434df425ff6bf93d49d1a8a08e455f2d86ff55773d57b611dd0e464d6b5e139271a91c6c8c629b694364730a38ddbe897a252620a2e41167afc48833290e0859615328f9dd7ba13514af6e3b3ca4e6514d400ad062a3519a85c4c79265bc284308602e73254a6ad85e76649c9b48f6785971a0e01ff0fe22de2c1c0b7ff27cf7e46f022d0b1a3c3a9ba65bcba1901c95e20ce39c24ff76acf7c4a3771e114a760448dbcd88c54351ee97a903c554564866eefb0964b5fe6ba26e73b64273c3f5d8079620cd509a3d88c19d09b5cc4256f38d263e105a94cfd44305e8c2755f90fd580628f0550268c95a1193362c265e0025ebdb42e58e2afcc38edbb77eedc486564a16e2405a99a382cfe15b03b097c10cb1651c2cb4bc7c5df969fb5ce19a6c8d3accb5b67dcf11fcfb6c028107c6b93c6a9b9c659dc05549a6fb1732f67cfc0ae5fe425245b72dbb6a719f83887a8af64ea8d1b3764ce0684f2d748a057d3ee3158d58266a560f8e04777a1f303163304d08b5bd470f627e0a13928e46fd0847bde599510e6978d68bb75f40ac4e247fc8708ca82ad40e729c3de042c94756d3816083784644d5e666fb3810117a62f7508ae3cdcdf312e314acd9add8e9c3e473ae206bd9b25659db6c1f570777f408644dcc6d150e92f284ad68d4bbe1f52e0c36e88a0d083dee8f7d59540b2ddda7fd27c97abc268630cbcad1e9cdd88c0a075462288bbf59824497ba7df15bc34d9fd22f8508a6d1c90118676ad3f9fc03cea1c69594dff6e978f42d1da2011290872e062fb2cc3293030534a6cedb6f461b33b5fd90b2ee0a8ae6803f45f4f2e74fac772ce235d66e8625951d7acbc87f1c4e13cbf0c01e8909de72d3b78b7d945b53e50f38486556dc6fd58db1a1da7f9cda6b50278a73d58842f15117c0232e6860caaab9be2d010ab4c5689a0ea14d78a5ec2dde3e837cadd8e1c794168860a4e303d513cc099d79cbb7605419db906a76d44ea62c6a767fb0f5cf25325a63c4939e1e8eb8df73645b5e9c4eebe6f736706708a8b0b5eebe263d846a9dedd9cb30365f3605cde065ae8fa4cb1075b87485ec0ccbabbe3033901e273234c688136c0960932e2ecd38870b7e72ca635a6e6d23cac391686fd2b7e5aac1c6862242dffc5a656922fbd23a6a8cae9f5a19b8778409987b26442739325b05ce005b215d1843278d767de541646d03cb4a3cfe32ecd2c686b8a550e12945b53bd87ae4387bc7876d1d17f3043a536e2319b760100963de494461c3dff0dc546ade451a393f08107cd419d1a075e7ce14cb082dabb30f61e67a9772aa384ee22505f0f54a58637abea7d3aa2263e744d2f99deefc0a6e2c225b0e14f3eae792b74a289920331b5d08aa748a123e3ccd2e7918495de5ad88068f6a2bc49c0bea736aaf68c21991ddb622522c9e6907ccc0716f394fa97da40beb33db9dbea01e2d07c6425853baffdd8ed2dc0d3ef710f518393634d7e312ea87093957de12f667d2c7a73ada38d95583ec1c3b8ba18bb6f592592a690a63a257b2792c8e75b98b46584082f240301facf10ef823003392d908af8386a403810fbb14a0bf56c9c718ea0e2eb8f478974fb9beb74bfc3fb13fa71babce0fa67e57950c2022dc5580b4a0e66740bc2f11dd4866f786bfb8c4b0fa78cf36d0baff865e0051dfbadcc0fc1bb4a4d89544375500bd08c8b219aba4213e081549239847b1b11cf51a72c26654f0d40b42b69178377ee9819b896c36e70304705aa6d1de33b77b6456fdf05de27813089e6bb5089a1ff02c361a8cc0e35454eff7d06033d02b0e66fd1d542115523c25bc49aea964ff93fe12bafabe723c16a6f9e669540e83d2dd64296b59dccdd553659bf15eec6598f32dfddd5f08380f4382e88e4441135abff53f7990c0c38f8a9f103082bd6009d059852f44bbdd2d8fbeebee4fe0822d205534fa1bec74b8e41ad2314f4742201f32202c21875731f87b86e1062270a3620dc3c5d4818618063379c97a29cf76acd17caf996d186a70d8385655048299538c8eb91fd25891125e5d317d6ca064bee38526fdfb4da1769e1bfddda5e1e64e7eeef125895ab9cf9db641b03ab5ec70633e8b79c665fa37e98cfbf23b176fc6d60668b25020420c81d77bebb0d32c63326bc9f88a8d2c226a85e54d7a44583e0f5b1f7cb52dacb769b57834ddf38ef5abd017f20f115daa51dea5bcbd58ea7a90ca042357927032040291dedf20c20eab92a384a23ab282db6c2a5c89b001a4dea0688cc7ca51a120390be070e07c618cb6b0e8c9106c0d2eabfb645e5b1fa9ef878df5861431e78e9c7ac12ceec025304a4d3351204c9bf7045a3b889f20321599f3f4c9c23169d1d10ace235dfb44edc3b9582dacef2269d5d07bf4555eec665dc307daef0aaaa0f7e44764fda59a861e67c1ce55de3515df6cec910c5fbb87aa9e100c290696ef366bb69b5d2de38d2f2d99413428c9761b0dd6bc5bd8c9c5e4f22c5f2ea5b666fa694359339d2e7e9ab6622b205713c7815edaeb01b2e63ff267e4ad2f66c267a2dae50a830d0b58bb0041bbbe43f6da01fd29e6fae8a8676d366ce2e31d9f61e257dd3ba7da8504fd00eb265c02cbd9d5e1c4955b85190c9bf085fdb54350ee9074c57c7add37bf6a614be01bba4871816ddc0c7e47797ee0d7c53b06352957dd546063f1593263e945ff319dba2bcef8f18844fecb244e9ca42a012774b137e86346a021934d30f2f8fb2cd906b45260154ce17d1cf1836654791bbd378f329a588ddcfd26b87296a17fe5077ec9968f47c4ca921dface81395435873af808472eb42eb12b92dbb4cc26683e21811cd13d8d273fbf3aa75204af1f593a5b423f9537a63308a945757d5f44c99e7eeebc506ec5f28729bd38b988babc33b570f8feca7a50c0966c66f063324fa504de647f7fc7f1d18bf94ae0899b758ee0ad1bb238dfd26a4ce6f3e7fdd1dd1b062b5cd493f4aa6eb08c6cb0510c696983a254c09197c1bfb784d5947a1329d7add6d3ddef0ad4b9ec93dee717788dd223feeab64acf9a73f24996d2e7d698b18607fc9a12b94d6ceafc680d9d91a1cfbf2d5fd6d0a9070d77b7f2204665b3a94f1e6245ecf7a1c671ee987fc0c67e7a26ed5e41862c5ddfa9a8344e1d8a88ca653a2efeb6e8fba6153fff8b279317ef0d65115073b38ab74d451cb58b75812231fd6282b7544fe4412ccea896e899a8f352269f60eb2383acfe60ab315c0f7ca43112bb898c051f6f07097d584e4f743f75d304b46b6b8c0e4825f987de99f24995dde490d7da0b47400a77fc8c39e5953b491a1bddf5d55fbb27e322bdc33e04fcbaf26f93b79c3030d920472b7694810195a02dc792d9ed4b43cedb72647c3005002eab924aa8ffaaecba42aa79eb3f4fb0b9e87317df11a79320a2d5bc83ad25fb139d45b843db5f8002b5cbf33812685fd9d5b994d370e8fd5333fa936ca9940f236b2c2e201912a7781dfca80497df9327c167d4d985db50e45fdb81c6eca85a3a4d0574d75e897ff98a23bfb122438f8f62a8422e0aff85febdc54e42bd05569a95717faf06eaea46b6b3e9335a1a60a922d8e79c153324cad570ee4efa53687280de0814071352d9c6ee939eaf3e89a09887b3bd9105a888635fcd190bcebc98ce4688665b8f827a2f0f1992fa90c4921342026de6fb0d31df3aaeba026678d7425a9c2f7cb2bfd7037cf81f814492f299a29b61e2a6ae386510caf4823e520365204ebc962504cb8997a51aed2903cba9fb52e015659a4fed914f7ecaa3cf3080da45a3d95c881dbb17639c31c9d833f270af042acf467dd492e6fa636e3df3ce7f28455fdd984e609c63170ffd55a0bb2debe6a4efa7228b47d455da6bbd83319620c16c63c2675dedaea4c4d65fa50ae7786621f45b67d022d546b91edda149af142d2a720c238f5e940d701cdb27439c7ff666f80b31ab695d3852bc5f4da0c39e588badb3e49153ea153b5894ee9fdebdb1bc3b6270644fb9f9d9dd3c4089932ec8fd9090d01c7a4eda7e1c1f304b59fed6ab77440eefb0324a8f5d127be662264399b5a4a41979e2a10d2905d9c265dd492edc5df03312f89c5094ff1b7f9ec10b68eb230687b5850a6a5643066fd1ad5c05bc1e8caa2289efafca0e93a284069a2120dd96dc2677e5b913beea0e75afa45e0140aadb7e566799ecbb47c6aa0ce03503ef8da94b2668fcf90e6bba60581590a2ac73c1c419941d0f2c013306d6ea9091a9eacc053213a58b24a6f7497632690083653c19715bcabfeafcebc22b54c6a1f71132c45ae7af19f8b25bdd83851527c63f1d23cb3ea18040475372bc99090e70282d536df518e6e421b4749d2334db9212c01219d6be9693e2f313b61b3a3c34ec932300db3c696d9ee8cbc138c8828f4d956abd0ce0d4b7b4a1ca0904c096befac1d9e48c64f0063554cdff3b77bd80791408c7ddf5759c86b7ca79e55d81b624dfc7b1a7dad93497a3325c53101174876654ce91d827ee124df73708eb88364d9cc3b4847f735d21d5a4f1ed962f51bdd18ae17a4b31eb0044aaa52b561ed84326d39ed7ab2bde55ea620cee86e43b549e7440a9a64efd748b081def3a956e350b66de06bd20dbd5fc86e6eb502be1977c1c83fcb774bba5803cec4f8ef11d3f7d9fb5a225a2f3dd6c9ac755230d1fcba418bebe56ec0cc7318422e362ae7626dc803bda3bf720fb753e586188b030fc6f02a94860d66915b7d4360a87f742ef006eb7dead1d3c9dca6c7ad71096a3040e6869bafa190bb64efdf8ecabd4a61eac2a772e29bcfbfa5021c070fccbc769631e123748c43da6f9f3268ae92aa211ccff1e03368a643b65757b3620bff11a7399c08a851719bd2bd1fb5ae4a0e19002b52f4caef8573a6b4ccee2802f9726fece0e44e192ef4384fce88aa23ad46a36b32ceea3510aae6522f4d407b30f0c551f70ee6bab475df4ac6d75d9aaeac309247eab00e9556c45386522ab5922195895568ed0ccb47d5a0320080b2ec1bdbdf3013c10755eca1b30e04b50cf9cf9bed3074e8ee1eaba87787afc58129ac917ca80bbb86557c6288a99b3850f2137ebf51558ea68f854014b29e9f2329bfd01a2154fd3847c605f2d079f0b0b5c7f0871ca819e97192760f5c0407907a7d6c96950"}, {0x0, 0x1, "c3dc73ee76fa"}]}}}}}, 0x12ca) 10:40:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:45 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, 0x0) socket(0x0, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x600000, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) lsetxattr$system_posix_acl(0x0, 0x0, 0x0, 0x0, 0x0) 10:40:45 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast2}, 0x1c) listen(0xffffffffffffffff, 0x1) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000680)={@void, @val, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "a5c268", 0x1298, 0x3a, 0xff, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, [{0x5, 0x19, "e5fb000005005357cd99e33bca98e246dc9027eb3334ea443e7fdc4049b892d54090878bee496aa11e07fb0f1db1a0ebe2f95347b0317613063381165c01f08fea1048ea59a6f2273e02707fdd7defc02bde3192360593169594710bddd04aead6c89c87778555de42d23236534ba1a799a63eb4532003a703b249e4628e4706bccc7a264ee85014d99a7fd4565d3c416c835a741eb4e97140e834013724d23450072f0087ac65295ca0d7c601c30de0161560e2d20c5b1052e9b208e25470e9fa884ecd2082ec38b3cb19c083"}, {0x0, 0x1b, "14a142ef59c04e8e7b4db5309006bd98ec79847a52ed68124e8a24d3079fc53b81c039a7d59f992dcb481043f510a0ce1ebb98c07a624ff8c8cc0b4fd3b8e700196d1f5696e184393de669ffaebfbd494a9d6a5fedac0738ffc3dcb3c1b96e48fd063786ae5701f6aa5022621e665607848e20f162630df96d0a773993e97ae6b847e51883d73d66bb30b4375229cfd0c9c41f511bfbf2bca94caa7ce76be257173a4eae2b484117ac32acf6ea1a32def26c919c93055c2f9a640b2d847d527357902538828abd66b3d1a9b85034066154f0b2ec054f6a8712ec98e5"}, {0x0, 0x1f, "8cf0833ae2772f05d302c778833be4f2b9c43c83284b82e71ca1ee382af46513079a2f52da08c93afdfc1a18e4b677b307a1c7df90787cbd143b129bc8dbc39104eb21674d26fd4ced8626df256869e168d42f4d160ad1442cae2bd8fda0fc44a08759d245bfe8eba42ec7967c1e953256a057369159333bca73b498a882fb5e840d429804169a6446c1d1b013144ae0ee276a463ef69ea4c4636751083041811c9b549256c6a3a71e451f8fd4de25629b3de61cba78315412fa14e350bb03feaf63909bd7320561df80bc77f36d4561a5efcc324450355ed398d9e46e798e23e2a4a2c787728b9c549a1894c53dcdfe834c7785fb3c4331"}, {0x0, 0x3, "6598975984c98199c07565e33783bc472344c2fc4e6a32"}, {0x0, 0x1f8, "631c74c9d1ae5f26763e689d7358d52b9d78e1af1392b0a090488b19cbc96370f62d48c23e1427c05acd9c3b3f073a763d782618ff1eec26b515a9b327cbc17f30d83b25eb0642880dfa19be7390bfd822af60a6c50ca6e86b5a7a713194fb7fd8d6fbabab53a0be384d6197ec95d58387c3c60474093fafe7b973081f27ecda4197fda48a1f93aef6f2fe0790ee4c44b9311e6a55f85e9a53c1b9d12d9b586d5e9c0f98d3d6f5e215a0392bc0f0747ce75347ce29eea158c0f1ff30ecf208af154508b0c1f57d03d6e884937b7d84b3170624b4ebb76df8681493b4ff2f5cb6ab9fc4745569c2105f1eef9e9e3b7f10aa79b3746d194b78719295ce4ca9a520a08a67241d6770b93eb3a0b12e0ae16886e6a6312f858009dfc6736efec7498718a3c84b37267e49860fcf486442c2f06179672b3a6d1afac32246207723f9f43a7afc4e63820609c8a44dd4a88cdec819602a152eb4403f842712fd75ea44c779e98ff01f41caba247ef6434df425ff6bf93d49d1a8a08e455f2d86ff55773d57b611dd0e464d6b5e139271a91c6c8c629b694364730a38ddbe897a252620a2e41167afc48833290e0859615328f9dd7ba13514af6e3b3ca4e6514d400ad062a3519a85c4c79265bc284308602e73254a6ad85e76649c9b48f6785971a0e01ff0fe22de2c1c0b7ff27cf7e46f022d0b1a3c3a9ba65bcba1901c95e20ce39c24ff76acf7c4a3771e114a760448dbcd88c54351ee97a903c554564866eefb0964b5fe6ba26e73b64273c3f5d8079620cd509a3d88c19d09b5cc4256f38d263e105a94cfd44305e8c2755f90fd580628f0550268c95a1193362c265e0025ebdb42e58e2afcc38edbb77eedc486564a16e2405a99a382cfe15b03b097c10cb1651c2cb4bc7c5df969fb5ce19a6c8d3accb5b67dcf11fcfb6c028107c6b93c6a9b9c659dc05549a6fb1732f67cfc0ae5fe425245b72dbb6a719f83887a8af64ea8d1b3764ce0684f2d748a057d3ee3158d58266a560f8e04777a1f303163304d08b5bd470f627e0a13928e46fd0847bde599510e6978d68bb75f40ac4e247fc8708ca82ad40e729c3de042c94756d3816083784644d5e666fb3810117a62f7508ae3cdcdf312e314acd9add8e9c3e473ae206bd9b25659db6c1f570777f408644dcc6d150e92f284ad68d4bbe1f52e0c36e88a0d083dee8f7d59540b2ddda7fd27c97abc268630cbcad1e9cdd88c0a075462288bbf59824497ba7df15bc34d9fd22f8508a6d1c90118676ad3f9fc03cea1c69594dff6e978f42d1da2011290872e062fb2cc3293030534a6cedb6f461b33b5fd90b2ee0a8ae6803f45f4f2e74fac772ce235d66e8625951d7acbc87f1c4e13cbf0c01e8909de72d3b78b7d945b53e50f38486556dc6fd58db1a1da7f9cda6b50278a73d58842f15117c0232e6860caaab9be2d010ab4c5689a0ea14d78a5ec2dde3e837cadd8e1c794168860a4e303d513cc099d79cbb7605419db906a76d44ea62c6a767fb0f5cf25325a63c4939e1e8eb8df73645b5e9c4eebe6f736706708a8b0b5eebe263d846a9dedd9cb30365f3605cde065ae8fa4cb1075b87485ec0ccbabbe3033901e273234c688136c0960932e2ecd38870b7e72ca635a6e6d23cac391686fd2b7e5aac1c6862242dffc5a656922fbd23a6a8cae9f5a19b8778409987b26442739325b05ce005b215d1843278d767de541646d03cb4a3cfe32ecd2c686b8a550e12945b53bd87ae4387bc7876d1d17f3043a536e2319b760100963de494461c3dff0dc546ade451a393f08107cd419d1a075e7ce14cb082dabb30f61e67a9772aa384ee22505f0f54a58637abea7d3aa2263e744d2f99deefc0a6e2c225b0e14f3eae792b74a289920331b5d08aa748a123e3ccd2e7918495de5ad88068f6a2bc49c0bea736aaf68c21991ddb622522c9e6907ccc0716f394fa97da40beb33db9dbea01e2d07c6425853baffdd8ed2dc0d3ef710f518393634d7e312ea87093957de12f667d2c7a73ada38d95583ec1c3b8ba18bb6f592592a690a63a257b2792c8e75b98b46584082f240301facf10ef823003392d908af8386a403810fbb14a0bf56c9c718ea0e2eb8f478974fb9beb74bfc3fb13fa71babce0fa67e57950c2022dc5580b4a0e66740bc2f11dd4866f786bfb8c4b0fa78cf36d0baff865e0051dfbadcc0fc1bb4a4d89544375500bd08c8b219aba4213e081549239847b1b11cf51a72c26654f0d40b42b69178377ee9819b896c36e70304705aa6d1de33b77b6456fdf05de27813089e6bb5089a1ff02c361a8cc0e35454eff7d06033d02b0e66fd1d542115523c25bc49aea964ff93fe12bafabe723c16a6f9e669540e83d2dd64296b59dccdd553659bf15eec6598f32dfddd5f08380f4382e88e4441135abff53f7990c0c38f8a9f103082bd6009d059852f44bbdd2d8fbeebee4fe0822d205534fa1bec74b8e41ad2314f4742201f32202c21875731f87b86e1062270a3620dc3c5d4818618063379c97a29cf76acd17caf996d186a70d8385655048299538c8eb91fd25891125e5d317d6ca064bee38526fdfb4da1769e1bfddda5e1e64e7eeef125895ab9cf9db641b03ab5ec70633e8b79c665fa37e98cfbf23b176fc6d60668b25020420c81d77bebb0d32c63326bc9f88a8d2c226a85e54d7a44583e0f5b1f7cb52dacb769b57834ddf38ef5abd017f20f115daa51dea5bcbd58ea7a90ca042357927032040291dedf20c20eab92a384a23ab282db6c2a5c89b001a4dea0688cc7ca51a120390be070e07c618cb6b0e8c9106c0d2eabfb645e5b1fa9ef878df5861431e78e9c7ac12ceec025304a4d3351204c9bf7045a3b889f20321599f3f4c9c23169d1d10ace235dfb44edc3b9582dacef2269d5d07bf4555eec665dc307daef0aaaa0f7e44764fda59a861e67c1ce55de3515df6cec910c5fbb87aa9e100c290696ef366bb69b5d2de38d2f2d99413428c9761b0dd6bc5bd8c9c5e4f22c5f2ea5b666fa694359339d2e7e9ab6622b205713c7815edaeb01b2e63ff267e4ad2f66c267a2dae50a830d0b58bb0041bbbe43f6da01fd29e6fae8a8676d366ce2e31d9f61e257dd3ba7da8504fd00eb265c02cbd9d5e1c4955b85190c9bf085fdb54350ee9074c57c7add37bf6a614be01bba4871816ddc0c7e47797ee0d7c53b06352957dd546063f1593263e945ff319dba2bcef8f18844fecb244e9ca42a012774b137e86346a021934d30f2f8fb2cd906b45260154ce17d1cf1836654791bbd378f329a588ddcfd26b87296a17fe5077ec9968f47c4ca921dface81395435873af808472eb42eb12b92dbb4cc26683e21811cd13d8d273fbf3aa75204af1f593a5b423f9537a63308a945757d5f44c99e7eeebc506ec5f28729bd38b988babc33b570f8feca7a50c0966c66f063324fa504de647f7fc7f1d18bf94ae0899b758ee0ad1bb238dfd26a4ce6f3e7fdd1dd1b062b5cd493f4aa6eb08c6cb0510c696983a254c09197c1bfb784d5947a1329d7add6d3ddef0ad4b9ec93dee717788dd223feeab64acf9a73f24996d2e7d698b18607fc9a12b94d6ceafc680d9d91a1cfbf2d5fd6d0a9070d77b7f2204665b3a94f1e6245ecf7a1c671ee987fc0c67e7a26ed5e41862c5ddfa9a8344e1d8a88ca653a2efeb6e8fba6153fff8b279317ef0d65115073b38ab74d451cb58b75812231fd6282b7544fe4412ccea896e899a8f352269f60eb2383acfe60ab315c0f7ca43112bb898c051f6f07097d584e4f743f75d304b46b6b8c0e4825f987de99f24995dde490d7da0b47400a77fc8c39e5953b491a1bddf5d55fbb27e322bdc33e04fcbaf26f93b79c3030d920472b7694810195a02dc792d9ed4b43cedb72647c3005002eab924aa8ffaaecba42aa79eb3f4fb0b9e87317df11a79320a2d5bc83ad25fb139d45b843db5f8002b5cbf33812685fd9d5b994d370e8fd5333fa936ca9940f236b2c2e201912a7781dfca80497df9327c167d4d985db50e45fdb81c6eca85a3a4d0574d75e897ff98a23bfb122438f8f62a8422e0aff85febdc54e42bd05569a95717faf06eaea46b6b3e9335a1a60a922d8e79c153324cad570ee4efa53687280de0814071352d9c6ee939eaf3e89a09887b3bd9105a888635fcd190bcebc98ce4688665b8f827a2f0f1992fa90c4921342026de6fb0d31df3aaeba026678d7425a9c2f7cb2bfd7037cf81f814492f299a29b61e2a6ae386510caf4823e520365204ebc962504cb8997a51aed2903cba9fb52e015659a4fed914f7ecaa3cf3080da45a3d95c881dbb17639c31c9d833f270af042acf467dd492e6fa636e3df3ce7f28455fdd984e609c63170ffd55a0bb2debe6a4efa7228b47d455da6bbd83319620c16c63c2675dedaea4c4d65fa50ae7786621f45b67d022d546b91edda149af142d2a720c238f5e940d701cdb27439c7ff666f80b31ab695d3852bc5f4da0c39e588badb3e49153ea153b5894ee9fdebdb1bc3b6270644fb9f9d9dd3c4089932ec8fd9090d01c7a4eda7e1c1f304b59fed6ab77440eefb0324a8f5d127be662264399b5a4a41979e2a10d2905d9c265dd492edc5df03312f89c5094ff1b7f9ec10b68eb230687b5850a6a5643066fd1ad5c05bc1e8caa2289efafca0e93a284069a2120dd96dc2677e5b913beea0e75afa45e0140aadb7e566799ecbb47c6aa0ce03503ef8da94b2668fcf90e6bba60581590a2ac73c1c419941d0f2c013306d6ea9091a9eacc053213a58b24a6f7497632690083653c19715bcabfeafcebc22b54c6a1f71132c45ae7af19f8b25bdd83851527c63f1d23cb3ea18040475372bc99090e70282d536df518e6e421b4749d2334db9212c01219d6be9693e2f313b61b3a3c34ec932300db3c696d9ee8cbc138c8828f4d956abd0ce0d4b7b4a1ca0904c096befac1d9e48c64f0063554cdff3b77bd80791408c7ddf5759c86b7ca79e55d81b624dfc7b1a7dad93497a3325c53101174876654ce91d827ee124df73708eb88364d9cc3b4847f735d21d5a4f1ed962f51bdd18ae17a4b31eb0044aaa52b561ed84326d39ed7ab2bde55ea620cee86e43b549e7440a9a64efd748b081def3a956e350b66de06bd20dbd5fc86e6eb502be1977c1c83fcb774bba5803cec4f8ef11d3f7d9fb5a225a2f3dd6c9ac755230d1fcba418bebe56ec0cc7318422e362ae7626dc803bda3bf720fb753e586188b030fc6f02a94860d66915b7d4360a87f742ef006eb7dead1d3c9dca6c7ad71096a3040e6869bafa190bb64efdf8ecabd4a61eac2a772e29bcfbfa5021c070fccbc769631e123748c43da6f9f3268ae92aa211ccff1e03368a643b65757b3620bff11a7399c08a851719bd2bd1fb5ae4a0e19002b52f4caef8573a6b4ccee2802f9726fece0e44e192ef4384fce88aa23ad46a36b32ceea3510aae6522f4d407b30f0c551f70ee6bab475df4ac6d75d9aaeac309247eab00e9556c45386522ab5922195895568ed0ccb47d5a0320080b2ec1bdbdf3013c10755eca1b30e04b50cf9cf9bed3074e8ee1eaba87787afc58129ac917ca80bbb86557c6288a99b3850f2137ebf51558ea68f854014b29e9f2329bfd01a2154fd3847c605f2d079f0b0b5c7f0871ca819e97192760f5c0407907a7d6c96950"}, {0x0, 0x1, "c3dc73ee76fa"}]}}}}}, 0x12ca) 10:40:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 254.706580] binder: 8433:8442 ioctl c0306201 20000180 returned -14 10:40:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:45 executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) syz_open_procfs(0x0, 0x0) creat(0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) lchown(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') [ 254.849503] kvm: emulating exchange as write 10:40:45 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmmsg$inet(r0, &(0x7f00000003c0)=[{{&(0x7f0000000440)={0x2, 0x0, @remote}, 0x10, &(0x7f0000001d80)=[{&(0x7f0000000a40)="801d", 0x2}], 0x1}}, {{&(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @broadcast, @remote}}}, @ip_pktinfo={{0x58, 0x0, 0x8, {0x0, @local, @multicast1}}}, @ip_tos_u8={{0x11}}], 0x58}}], 0x2, 0x0) [ 254.878448] binder: 8454:8458 ioctl c0306201 20000180 returned -14 10:40:45 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:46 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = gettid() r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)) read(r1, &(0x7f0000000300)=""/128, 0x80) tkill(r0, 0x1000000000016) 10:40:46 executing program 4: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x2}) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 10:40:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:46 executing program 5: syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001400)={[{@size={'size', 0x3d, [0x35]}}, {@mpol={'mpol', 0x3d, {'prefer', '=relative', @void}}}]}) 10:40:46 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(r1, &(0x7f0000000340), 0x41395527) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f00000002c0)=ANY=[@ANYBLOB="230228efb40400000000000000cb000000005d6fe0eb92552fba4701426e3edbcc7e060000000000ab006c0e09d1efe6c1f37b9c3593e9b5302ef8ae47315800004380"], 0x43) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) 10:40:46 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:46 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:46 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 255.603813] tmpfs: Bad value 'prefer=relative' for mount option 'mpol' 10:40:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:46 executing program 5: r0 = socket(0x2, 0x1, 0x0) getsockopt(r0, 0x0, 0x1e, 0x0, 0x0) [ 255.677464] tmpfs: Bad value 'prefer=relative' for mount option 'mpol' 10:40:46 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:47 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = gettid() r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)) read(r1, &(0x7f0000000300)=""/128, 0x80) tkill(r0, 0x1000000000016) 10:40:47 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000440)=ANY=[@ANYBLOB="b8000000190001000000000000000000ff010000000000000000000001000001e000000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000051000000000000000000000000000000000000000000c6173a7c361ea744000000000000000000000000000000000000000000000000000000000000000000000000000000000000e30000000000000000000000003f00000000006a6d9900002bb19d7e1f24d209d461d9c4705841df"], 0xb8}, 0x1, 0xfffff000}, 0x0) 10:40:47 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:47 executing program 5: syz_mount_image$hfsplus(&(0x7f00000000c0)='hfsplus\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)={[{@nobarrier='nobarrier'}]}) 10:40:47 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:47 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x84000}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x89) write$binfmt_script(r2, &(0x7f00000002c0)=ANY=[@ANYBLOB="230228efb40400000000000000cb000000005d6fe0eb92552fba4701426e3edbcc7e060000000000ab006c0e09d1efe6c1f37b9c3593e9b5302ef8ae47315800004380a8cf35d7000000c68c37cfbef5000000faf8228bf63bb300000000000000007fe72e8d5b7cc216aade7fe0080df58b5407003dc26626071882c601f2b49e32098f6919c7234cebfe065d74e03c995de2c3abca4d16b1a91730000003f183a2fea322fa9fa3f5f0d213551db0a31a06eb5e0686e1bdad10a6bd6b9b81cb4bbaad4682c449496e68148df8d36eabf204b6457d5aaad9cb6b0d8f1a2db54a0a3decf4a257a992e6000051ce236edbd5544882b8be19ce5992ac891b0300000000000000832932992669a86cb80178d8ae9243692b9e6bdacf46ba7e106912f9b332db18be22cff50000000000000042623a6ee3fb95d972c29de2365032f9b9fc46a5b394b00effb89bfe80860c350b483e397af24f56dbf36340697cfe56dada7ae993b980ecffda240a4136fb7c9e755c8b94b140378da595e8ffb3ef2207b888d61248423d7f3bbb1b5203535c179af81c718f1c3aa9ed36fd09f4d923da75020ca1805556fa7e1cdbdeb0880d2c59229c1309f01243952619c0d249ac7581fd56ab6edd318641772ffff5f5030000000d9342efd4005cc098dac4cfce2a70e86bb2071d730600000006a86f4e9a95fe3b9a9e99268ef0862b30e31b06"], 0x200) dup(0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) 10:40:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:47 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 256.473813] hfsplus: unable to find HFS+ superblock 10:40:47 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000180)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x1, [0x0, 0x3f000000, 0x3]}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x30}}}, 0xb8}, 0x1, 0xfffff000}, 0x0) [ 256.542758] hfsplus: unable to find HFS+ superblock 10:40:47 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000280)="080db5055e0bcfe847a071") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000180)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x1, [0x0, 0x3f000000]}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}, 0x1, 0xfffff000}, 0x0) [ 256.563885] binder: 8540:8545 ioctl c0306201 20000180 returned -14 [ 256.577348] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.4'. 10:40:47 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 256.677438] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 256.740867] binder: 8559:8561 ioctl c0306201 20000180 returned -14 10:40:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:48 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r1, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) fcntl$setlease(r2, 0x400, 0x0) 10:40:48 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000440)=ANY=[@ANYBLOB="b8000000190001000000000000000000ff010000000000000000000000000001e000000100000000000000000000030000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000051000000000000000000000000000000000000000000c6173a7c361ea744000000000000000000000000000000000000000000000000000000000000000000000000000000000000e30000000000000000000000003f00000000006a6d9900002bb19d7e1f24d209d461d9c4705841df"], 0xb8}, 0x1, 0xfffff000}, 0x0) 10:40:48 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(r1, 0x1000000000016) 10:40:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:48 executing program 0: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write(0xffffffffffffffff, &(0x7f0000000000)="fc0000001c000705ab092506b86807020aab087a0500000001003a93210001", 0x1f) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 10:40:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0x0, 0x719000, 0x0}) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x10, 0x0, &(0x7f0000000180)=[@release={0x40046305}, @acquire={0x630b}], 0x0, 0x719000, 0x0}) [ 257.231874] binder: 8565:8569 unknown command 25349 [ 257.242927] binder: 8565:8569 ioctl c0306201 20000200 returned -22 10:40:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 257.288685] binder: 8566:8574 ioctl c0306201 20000180 returned -14 10:40:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 257.329899] binder: 8579:8581 unknown command 0 10:40:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 257.350524] binder: 8583:8587 unknown command 25349 [ 257.356881] binder: 8579:8581 ioctl c0306201 20000080 returned -22 [ 257.367633] binder: 8588:8589 ioctl c0306201 20000180 returned -14 [ 257.371126] binder: 8583:8587 ioctl c0306201 20000200 returned -22 10:40:48 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) chdir(&(0x7f0000000300)='./file0\x00') creat(&(0x7f0000000040)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x40000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 10:40:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 257.396584] binder: 8590:8591 ioctl c0306201 20000180 returned -14 [ 257.409662] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.0'. 10:40:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 257.461300] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=8592 comm=syz-executor.0 [ 257.476217] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=8592 comm=syz-executor.0 [ 257.491649] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=8592 comm=syz-executor.0 [ 257.505139] binder: 8598:8600 unknown command 25349 [ 257.511510] binder: 8598:8600 ioctl c0306201 20000200 returned -22 [ 257.518480] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=8592 comm=syz-executor.0 [ 257.549050] binder: 8601:8604 ioctl c0306201 20000180 returned -14 [ 257.552245] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=8592 comm=syz-executor.0 [ 257.569600] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=8592 comm=syz-executor.0 [ 257.587389] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=8592 comm=syz-executor.0 [ 257.601583] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=8592 comm=syz-executor.0 [ 257.616649] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=8592 comm=syz-executor.0 [ 257.629337] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=8592 comm=syz-executor.0 10:40:48 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x18, 0x0, &(0x7f0000000180)=[@release={0x40046304}, @decrefs={0x40046304}, @acquire={0x630b}], 0x0, 0x719000, 0x0}) 10:40:48 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000440)=ANY=[@ANYBLOB="b8000000190001000000000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000051000000000000000000000000000000000000000000c6173a7c361ea744000000000000000000000000000000000000000000000000000000000000000000000000000000000000e30000000000000000000000003f00000000006a6d9900002bb19d7e1f24d209d461d9c4705841df"], 0xb8}, 0x1, 0xfffff000}, 0x0) 10:40:49 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(r1, 0x1000000000016) 10:40:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 258.056886] binder: 8607:8608 unknown command 0 [ 258.067032] binder: 8607:8608 ioctl c0306201 20000080 returned -22 [ 258.098364] binder: 8611:8614 unknown command 287493 10:40:49 executing program 0: 10:40:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:49 executing program 5: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write(0xffffffffffffffff, &(0x7f0000000000)="fc0000001c000705ab092506b86807020aab087a0500000001003a93210001c0f0060000000000010000000000039815", 0x30) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 10:40:49 executing program 4: [ 258.122083] binder: 8611:8614 ioctl c0306201 20000200 returned -22 10:40:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 258.177716] binder: 8619:8623 ioctl c0306201 0 returned -14 10:40:49 executing program 0: 10:40:49 executing program 4: [ 258.222343] binder: 8619:8623 ioctl c0306201 20000180 returned -14 [ 258.247145] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.5'. 10:40:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:49 executing program 0: 10:40:49 executing program 4: [ 258.273680] binder: 8628:8635 unknown command 287493 [ 258.285297] binder: 8628:8635 ioctl c0306201 20000200 returned -22 [ 258.357809] binder: 8637:8640 ioctl c0306201 0 returned -14 [ 258.395159] binder: 8637:8640 ioctl c0306201 20000180 returned -14 10:40:49 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(r1, 0x1000000000016) 10:40:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:49 executing program 4: 10:40:49 executing program 0: 10:40:49 executing program 5: 10:40:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:49 executing program 0: 10:40:49 executing program 4: 10:40:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 258.959744] binder: 8648:8651 unknown command 287493 [ 258.978961] binder: 8648:8651 ioctl c0306201 20000200 returned -22 10:40:50 executing program 0: 10:40:50 executing program 5: [ 259.049239] binder: 8657:8662 ioctl c0306201 0 returned -14 10:40:50 executing program 4: [ 259.123421] binder: 8657:8662 ioctl c0306201 20000180 returned -14 10:40:50 executing program 0: 10:40:50 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:40:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:50 executing program 4: 10:40:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:50 executing program 5: 10:40:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:50 executing program 5: 10:40:50 executing program 4: 10:40:50 executing program 0: [ 259.847649] binder: 8683:8685 ioctl c0306201 20000180 returned -14 10:40:50 executing program 4: 10:40:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:50 executing program 0: 10:40:50 executing program 5: [ 260.005475] binder: 8698:8703 ioctl c0306201 20000180 returned -14 10:40:53 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:40:53 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:53 executing program 0: 10:40:53 executing program 4: 10:40:53 executing program 5: 10:40:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:53 executing program 5: 10:40:53 executing program 4: 10:40:53 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:53 executing program 0: [ 262.899891] binder: 8712:8716 ioctl c0306201 20000180 returned -14 10:40:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:53 executing program 4: [ 263.045068] binder: 8729:8735 ioctl c0306201 20000180 returned -14 10:40:56 executing program 0: 10:40:56 executing program 5: 10:40:56 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:40:56 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:56 executing program 4: 10:40:56 executing program 0: 10:40:56 executing program 4: 10:40:56 executing program 5: 10:40:56 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 265.931512] binder: 8743:8745 ioctl c0306201 20000180 returned -14 10:40:56 executing program 0: 10:40:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 266.073583] binder_alloc: 8757: binder_alloc_buf, no vma [ 266.121714] binder: 8763:8764 ioctl c0306201 20000180 returned -14 10:40:59 executing program 2: timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:40:59 executing program 4: 10:40:59 executing program 5: 10:40:59 executing program 0: 10:40:59 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:40:59 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:40:59 executing program 4: 10:40:59 executing program 5: 10:40:59 executing program 0: perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x18, 0x0, &(0x7f0000000100)) [ 268.984948] binder_alloc: 8773: binder_alloc_buf, no vma [ 268.990998] binder: 8771:8775 ioctl c0306201 20000180 returned -14 10:41:00 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:00 executing program 5: r0 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r0, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x1}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f0000000200), 0x8) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r2) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000000)={'veth0_to_bridge\x00', {0x2, 0x4e22, @local}}) [ 269.115806] binder_alloc: 8788: binder_alloc_buf, no vma [ 269.158997] binder: 8792:8794 ioctl c0306201 20000180 returned -14 10:41:02 executing program 2: timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:02 executing program 0: perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$vcsa(0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x0, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8}, @IFLA_IPTUN_6RD_RELAY_PREFIXLEN={0x6}]}}}]}, 0x40}}, 0x0) 10:41:02 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4001}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x2, 0x2) ioctl$VIDIOC_LOG_STATUS(r0, 0x5646, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 10:41:02 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:02 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x8}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) sendto(r0, &(0x7f0000000140)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{0x0, 0x14e, 0x0, 0x0, 0x0, 0x24b, 0x58c}}], 0x34, 0xac0, 0x0) 10:41:02 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:02 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 272.021129] binder: 8801:8807 ioctl c0306201 20000180 returned -14 [ 272.062955] vivid-004: ================= START STATUS ================= [ 272.071256] vivid-004: Radio HW Seek Mode: Bounded [ 272.099895] vivid-004: Radio Programmable HW Seek: false [ 272.124549] vivid-004: RDS Rx I/O Mode: Block I/O [ 272.132414] binder: 8818:8821 unknown command 25349 [ 272.136066] vivid-004: Generate RBDS Instead of RDS: false [ 272.157167] vivid-004: RDS Reception: true 10:41:03 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:03 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/user\x00') 10:41:03 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x8}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) sendto(r0, &(0x7f0000000140)="120000001200e7ef007b1a3fcd00000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{0x0, 0x14e, 0x0, 0x0, 0x0, 0x24b, 0x58c}}], 0x34, 0xac0, 0x0) [ 272.168831] binder: 8818:8821 ioctl c0306201 20000200 returned -22 [ 272.173151] vivid-004: RDS Program Type: 0 inactive [ 272.193373] binder: 8818:8826 ioctl c0306201 20000180 returned -14 [ 272.203191] vivid-004: RDS PS Name: inactive [ 272.215879] vivid-004: RDS Radio Text: inactive 10:41:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 272.252047] vivid-004: RDS Traffic Announcement: false inactive [ 272.298723] vivid-004: RDS Traffic Program: false inactive [ 272.319594] vivid-004: RDS Music: false inactive [ 272.329335] vivid-004: ================== END STATUS ================== [ 272.356519] binder: 8837:8839 unknown command 25349 [ 272.375575] binder: 8837:8839 ioctl c0306201 20000200 returned -22 [ 272.389071] binder: 8837:8839 ioctl c0306201 20000180 returned -14 10:41:05 executing program 2: timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:05 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000180)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f00000000c0)={0xa1}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 10:41:05 executing program 4: r0 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000240)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) keyctl$get_persistent(0x16, 0x0, r0) 10:41:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:05 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000000140)=[{&(0x7f0000001600)="d083b8778d9e055daedb2fb28df629afabdb0b25311ef1e77295a000a43e2610b846a5a59c06a800d3d76df145cad9aaddefb439dffeeefe701249890b", 0x3d}, {&(0x7f00000016c0)="7507747dd9bcc24bc9201e9ab3851c2352e456a59990f36599f89b848cf73dba62e0ee4d214b4ea417ba047283d923aa85916b00b017843fb4dd334d8bf4ab10c73e81992e6fd44138b794415b5cc26106b7db3a6b8796ce064e031f8f35e3f749cb730bb38dcfb2cf9155bf417d427a6ea7c2284e317a87736058c4140d8fe5d67450f4e38f91d2457b1f20672e51d2a112668d", 0x94}, {&(0x7f0000001780)="a45d4e26c6fadcbd663ccd6c0aca006b802c18d131b5427b3d4515dee8f10570a5923f3f543435278f94c3f8f0d4c35488ecfb1bd630b2e1e0e4247bb44938f03d603b27e44942ddcd3f11f086e6bf39ab074b690284b6d6aff6cc1e736b32f7d781c315bad312c6e8062089abe9838cd011d5227aa050589d2e5f34e10165336747bc2156f8e2570a4a76d4af1ef57edb31f57834ba2486c9f253a1737d59d15a11571414ec61c17dc20d9974e58cf2925c7c6e56216d4e35e39a9977e27e21450596008761c86e216667c6f72b64fdcad802718d16b390d4b4dc05bffb838b7e6831cc53b65b1de0bbf6af1311a722a80065913d37bea8c988e3b3f05ab1eb02d6b52a11191f1ced75b0200502e5f2881204104e152b5644da9d26301ed8905156a069c61444d44d82c135ff4f20574247a4a5cc963e3c395a029125ccae1f1564a3e28e06b1a08e47bd1a9621edf1003d167cbdfc0be2a4914908198575a688a38d24bdc9881ced9fe04e119a87b9286ea15aa168163a9650a26a926c571f2f0e0b2102de1fd1a6920cb71d846f02b2c23f80a3c0116b48d14925e69c4a65126e544995e0cb5fefaa870ddd66e8eb47a3be8f07fcd361dcf144c865fe355e3b98e6d4694d74aa6d3d75c7c568feabdcb483c5c22ca40782cd2dea789dc677c603227878c369a3b7a3204bf1bc9b1fdb1e00447152e854095b9527d6e980b1bac1b1ec6e9706084ac77b383bd4e555a11410f6a830966ec9b0fa58abf22238638ea06bad5baa2b55174b0db5108d79849c10", 0x233}, {&(0x7f0000000300)="c9be9ccc6aeb99edf480dd9158d5818ed363362992dd1fb54c321b9a93c187d50220f4b1fece138b81f09d639d7c693acc610026f77f0d8af3575fefce", 0x3d}], 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0x1801, 0x4) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f652cb967481241ba7860005cf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 10:41:06 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 275.054653] usb usb2: usbfs: process 8850 (syz-executor.0) did not claim interface 0 before use [ 275.072498] binder: 8848:8852 unknown command 25349 [ 275.089320] binder: 8848:8852 ioctl c0306201 20000200 returned -22 10:41:06 executing program 0: perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sysfs$2(0x2, 0x0, &(0x7f00000002c0)=""/177) 10:41:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={[], [], @multicast1}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4}]}, 0x5c}}, 0x0) [ 275.108146] binder: 8848:8852 ioctl c0306201 20000180 returned -14 10:41:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:06 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, &(0x7f0000000080)=""/63) getpid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setuid(0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000001a40)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10000174a3ac8694525952f44500a1f0db500800000000000008f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde318ead4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28b774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a800655d127de6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047666865c84f7cff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d8191643"}) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000080)=0x10000000002) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 275.234272] binder: 8871:8874 unknown command 287493 [ 275.239507] binder: 8871:8874 ioctl c0306201 20000200 returned -22 [ 275.248483] binder: 8871:8874 ioctl c0306201 20000180 returned -14 10:41:09 executing program 2: timer_create(0x0, 0x0, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:09 executing program 0: 10:41:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:09 executing program 4: 10:41:09 executing program 5: 10:41:09 executing program 5: [ 278.106118] binder: 8890:8894 unknown command 287493 [ 278.122584] binder: 8893:8897 ioctl c0306201 0 returned -14 10:41:09 executing program 0: 10:41:09 executing program 4: [ 278.146424] binder: 8890:8894 ioctl c0306201 20000200 returned -22 [ 278.162898] binder: 8890:8902 ioctl c0306201 20000180 returned -14 10:41:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x3, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:09 executing program 0: 10:41:09 executing program 2: timer_create(0x0, 0x0, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:09 executing program 4: 10:41:09 executing program 5: [ 278.259535] binder: 8910:8911 unknown command 287493 [ 278.265093] binder: 8910:8911 ioctl c0306201 20000200 returned -22 10:41:09 executing program 4: 10:41:09 executing program 5: 10:41:09 executing program 0: [ 278.314689] binder: 8910:8920 ioctl c0306201 20000180 returned -14 [ 278.349441] binder: 8909:8923 ioctl c0306201 0 returned -14 10:41:09 executing program 2: timer_create(0x0, 0x0, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:09 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:09 executing program 5: 10:41:09 executing program 0: 10:41:09 executing program 4: 10:41:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:09 executing program 4: [ 278.537210] binder: 8935:8938 ioctl c0306201 0 returned -14 10:41:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:09 executing program 5: 10:41:09 executing program 0: 10:41:09 executing program 4: 10:41:09 executing program 5: 10:41:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:12 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:12 executing program 4: 10:41:12 executing program 0: 10:41:12 executing program 5: 10:41:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:12 executing program 4: 10:41:12 executing program 0: 10:41:12 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x6db6e559) 10:41:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:12 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x0) symlinkat(&(0x7f0000000200)='/', r2, &(0x7f0000d06ff8)='./file0\x00') faccessat(r2, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) 10:41:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 283.360646] NOHZ: local_softirq_pending 08 10:41:15 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:15 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x420000015001}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x308) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}) 10:41:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:15 executing program 0: r0 = memfd_create(&(0x7f0000000080)='$\xbbeth0nodev*\x00', 0x0) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x0, 0x11, r0, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)='net/igmp\x00') 10:41:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:15 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x9, 0x9}) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "eaffffff090000000000000000000000000053"}) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[], 0x35b) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000000)={0x15, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000001000"}) 10:41:15 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) readv(r0, &(0x7f0000002700)=[{&(0x7f0000000400)=""/4096, 0x1000}], 0x1) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x8001, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) write$binfmt_misc(r0, &(0x7f0000000200)=ANY=[], 0xffdc) 10:41:15 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f00000000c0)="3a277687099ecb49d1fa740fadb624855569a7705a08c0186a0884bfaa1dec6cef4e8017a3c7298367a0b993b4c20d3e4363ac66aa6f5510f89b05296625a2443d07cb0cc7bc3817ca198191158235a45c1e9d7bba5faa42d6e3bc8f7b5aff351335e39a75fee33cac7921dac9293ec547ef7a03a341322e49c5c21df82ed5119cff7c78ad649f640c41619e10c13f46e12be42c83ae6a34054bda4374d677f40a24435ee7fba6b2946f1449ee556ca3f52de328b4a529c5960f945428642b028086d2e8e65b22b7b4bf7558f441d9b980c618eaf839249314df84ed88b309515d95d1629b05aeb7952052cebb", 0xfffffea6) 10:41:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:15 executing program 0: sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x0, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = open(&(0x7f0000000180)='./bus\x00', 0x151042, 0x0) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000780)=ANY=[@ANYBLOB='h'], 0x1) clone(0x20986100, 0x0, 0x0, 0x0, &(0x7f0000000040)) 10:41:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 284.724339] binder_alloc: 9022: binder_alloc_buf, no vma [ 284.730455] binder: 9022:9034 ioctl c0306201 20000180 returned -14 10:41:18 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:18 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x23, &(0x7f0000000240)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000000200000002000053024000007a40000080000000000000006d5ebe5a0000ffff53ef", 0x4db, 0x400}], 0x4810, 0x0) 10:41:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:18 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) dup3(r1, r2, 0x0) 10:41:18 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) pipe(&(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$ASHMEM_GET_SIZE(r2, 0x7704, 0x0) 10:41:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:18 executing program 4: 10:41:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 287.631193] binder_alloc: 9053: binder_alloc_buf, no vma [ 287.638535] EXT4-fs: Warning: mounting with data=journal disables delayed allocation and O_DIRECT support! [ 287.659608] binder: 9053:9060 ioctl c0306201 20000180 returned -14 [ 287.670482] EXT4-fs (loop5): Invalid log cluster size: 1392508930 10:41:18 executing program 0: 10:41:18 executing program 4: 10:41:18 executing program 0: [ 287.755612] EXT4-fs (loop5): Invalid log cluster size: 1392508930 [ 287.783038] binder_alloc: 9073: binder_alloc_buf, no vma [ 287.822938] binder: 9073:9080 ioctl c0306201 20000180 returned -14 10:41:21 executing program 5: 10:41:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:21 executing program 4: 10:41:21 executing program 0: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x807284, 0x0) getrandom(&(0x7f00000000c0)=""/20, 0x14, 0x2) r0 = open(&(0x7f0000000440)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000080), 0x12) 10:41:21 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:21 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) sendmsg$netlink(r1, &(0x7f0000000400)={&(0x7f0000000040)=@proc, 0xc, 0x0}, 0x0) 10:41:21 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x6a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) lseek(r0, 0x7ffffc, 0x0) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[@ANYRESDEC], 0xfd14) fallocate(r0, 0x100000003, 0x0, 0x28120001) 10:41:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x2, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 290.682190] binder: 9089:9096 ioctl c0306201 20000180 returned -14 10:41:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:21 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmmsg$inet(r0, &(0x7f0000001f00)=[{{&(0x7f0000000440)={0x2, 0x0, @remote}, 0x10, &(0x7f0000001d80)=[{&(0x7f0000000a40)="801d", 0x2}], 0x1, &(0x7f0000001e00)=[@ip_retopts={{0x18, 0x0, 0x7, {[@end, @timestamp_addr={0x44, 0x4}]}}}], 0x18}}], 0x1, 0x0) 10:41:21 executing program 0: syz_open_procfs(0x0, 0x0) perf_event_open(0x0, 0x0, 0xffff7fffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setresgid(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x6a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffff7fffffffffff, 0xffffffffffffffff, 0x0) setresgid(0x0, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000002c0)=@proc={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000340), 0x0, &(0x7f0000000600)=ANY=[@ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRESHEX, @ANYRES32=0x0, @ANYBLOB="f1a62a0f804cbd3b923d7c633874ca37e204c12bbc1c089bda8cb2bcec8a62fe27de28583c0782d415bb36c428d0563b227d38c6a171a5f3749d1c41a3f0356695daabbd39ca27de6a0b5abc61d6b7387393e5a654fd0182e4703e296a16a2fdfb6dad7fbce8124d0b54a1447e1828fefc3db605a68c58fbfea208a94e4af744fe89d4e97b9b8b19896a5bb8dfefc78ca7f1d0d826adf7847da07aaa531ac7a043b4", @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0xdc, 0x4010}, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', &(0x7f0000000300)='y\x00', 0x2, 0x1) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x1000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000002c0)="eb3c906d5766732e666174000204010002000270fff8", 0x16}], 0x1, 0x0) statfs(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)=""/205) [ 290.756997] binder: 9108:9109 unknown command 25349 10:41:21 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fcntl$getflags(r1, 0x1) 10:41:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x2, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 290.803561] binder: 9108:9109 ioctl c0306201 20000280 returned -22 [ 290.827635] binder: 9112:9117 ioctl c0306201 20000180 returned -14 [ 290.946115] binder: 9125:9128 unknown command 25349 [ 290.974756] binder: 9125:9128 ioctl c0306201 20000280 returned -22 10:41:24 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:24 executing program 4: r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2324}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sendfile(r0, r1, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNGETIFF(r4, 0x800454d2, &(0x7f0000000000)) sendfile(r3, 0xffffffffffffffff, &(0x7f0000000200), 0xa198) sendmsg$NFT_MSG_GETSET(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000800)=ANY=[]}, 0x1, 0x0, 0x0, 0x8040}, 0x90) pipe(0x0) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x0) 10:41:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:24 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000400)={'wg1\x00'}) 10:41:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x2, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:24 executing program 0: r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000080)='threaded\x00', 0xfffffe58) fsetxattr(r0, &(0x7f0000000140)=@known='trusted.overlay.metacopy\x00', 0x0, 0x0, 0x0) fallocate(r0, 0x0, 0x0, 0xfff9) [ 293.723392] audit: type=1800 audit(1585824084.667:52): pid=9143 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="collect_data" cause="failed(directio)" comm="syz-executor.4" name="file0" dev="sda1" ino=16863 res=0 [ 293.724870] binder: 9140:9144 ioctl c0306201 20000180 returned -14 [ 293.762819] binder: 9142:9146 unknown command 25349 10:41:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x3, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 293.775293] binder: 9142:9146 ioctl c0306201 20000280 returned -22 [ 293.788220] audit: type=1804 audit(1585824084.697:53): pid=9143 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir113885774/syzkaller.KP2diE/74/file0" dev="sda1" ino=16863 res=1 [ 293.849339] audit: type=1804 audit(1585824084.787:54): pid=9153 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir113885774/syzkaller.KP2diE/74/file0" dev="sda1" ino=16863 res=1 10:41:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x3, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 293.899328] binder: 9158:9159 ioctl c0306201 20000180 returned -14 [ 293.925606] binder: 9163:9164 unknown command 287493 [ 293.936907] binder: 9163:9164 ioctl c0306201 20000280 returned -22 10:41:24 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 293.997798] binder: 9166:9167 ioctl c0306201 20000180 returned -14 [ 294.033213] binder: 9169:9172 unknown command 287493 10:41:25 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 294.044586] FAT-fs (loop5): bogus number of reserved sectors [ 294.061304] binder: 9169:9172 ioctl c0306201 20000280 returned -22 [ 294.073870] FAT-fs (loop5): Can't find a valid FAT filesystem [ 294.114298] binder: 9176:9178 ioctl c0306201 20000180 returned -14 [ 294.175991] FAT-fs (loop5): bogus number of reserved sectors [ 294.184315] FAT-fs (loop5): Can't find a valid FAT filesystem [ 294.531684] audit: type=1804 audit(1585824085.477:55): pid=9153 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir113885774/syzkaller.KP2diE/74/file0" dev="sda1" ino=16863 res=1 [ 294.561917] audit: type=1804 audit(1585824085.477:56): pid=9153 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir113885774/syzkaller.KP2diE/74/file0" dev="sda1" ino=16863 res=1 10:41:27 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x3, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:27 executing program 5: r0 = getpid() prctl$PR_SET_PTRACER(0x59616d61, r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000005c0)="665307a60a05057b513c27050076003639080000000000000000043c2dbd3a795b65fccfffb644d89c2d275747f139439082c46419d833011d9dcf8223df094d12ec4546fdbbaf3fb308e69a9ac7a457822775051cbc2d42b0746d3b86367b8bb4a2fa7c4a5cf03f92d51d3676704e21953a4c82264f03", 0x77}], 0x4, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x25) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) 10:41:27 executing program 0: fchownat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setresgid(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x6a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffff7fffffffffff, 0xffffffffffffffff, 0x0) setresgid(0x0, 0x0, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000240)='./file0\x00', 0x0, 0x0, 0x0, 0x1) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x1000000, 0x1, &(0x7f0000000000)=[{&(0x7f00000002c0)="eb3c906d5766732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) 10:41:27 executing program 4: r0 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x4d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2324}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) write(r0, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sendfile(r0, r1, 0x0, 0x7fffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xffffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNGETIFF(r4, 0x800454d2, &(0x7f0000000000)) sendfile(r3, 0xffffffffffffffff, &(0x7f0000000200), 0xa198) sendmsg$NFT_MSG_GETSET(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000800)=ANY=[]}, 0x1, 0x0, 0x0, 0x8040}, 0x90) pipe(0x0) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x0) [ 296.795581] binder: 9190:9195 ioctl c0306201 0 returned -14 [ 296.808275] audit: type=1800 audit(1585824087.747:57): pid=9198 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="collect_data" cause="failed(directio)" comm="syz-executor.4" name="file0" dev="sda1" ino=16886 res=0 [ 296.822630] binder: 9188:9199 unknown command 287493 [ 296.837012] binder: 9188:9199 ioctl c0306201 20000280 returned -22 10:41:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 296.838584] binder: 9190:9195 ioctl c0306201 20000180 returned -14 10:41:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 296.878041] audit: type=1804 audit(1585824087.787:58): pid=9206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir113885774/syzkaller.KP2diE/75/file0" dev="sda1" ino=16886 res=1 [ 296.922902] audit: type=1804 audit(1585824087.867:59): pid=9206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="ToMToU" comm="syz-executor.4" name="/root/syzkaller-testdir113885774/syzkaller.KP2diE/75/file0" dev="sda1" ino=16886 res=1 10:41:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 296.981031] binder: 9211:9215 ioctl c0306201 0 returned -14 [ 296.988248] binder: 9211:9215 ioctl c0306201 20000180 returned -14 10:41:28 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 297.064584] binder: 9217:9221 ioctl c0306201 0 returned -14 [ 297.076469] binder: 9217:9221 ioctl c0306201 20000180 returned -14 [ 297.162817] binder: 9228:9230 ioctl c0306201 20000180 returned -14 10:41:30 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:30 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:30 executing program 0: 10:41:30 executing program 4: 10:41:30 executing program 5: 10:41:30 executing program 4: 10:41:30 executing program 0: 10:41:30 executing program 5: [ 299.847604] binder: 9237:9242 ioctl c0306201 0 returned -14 [ 299.859225] binder: 9239:9243 ioctl c0306201 20000180 returned -14 10:41:30 executing program 4: 10:41:30 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 299.979657] binder: 9254:9255 ioctl c0306201 20000180 returned -14 [ 299.992824] binder: 9256:9257 ioctl c0306201 0 returned -14 10:41:33 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:33 executing program 0: 10:41:33 executing program 5: 10:41:33 executing program 4: 10:41:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:33 executing program 4: 10:41:33 executing program 0: 10:41:33 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/stat\x00') getdents64(r0, 0x0, 0xc0000000) 10:41:33 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000240)="6653f3528d4641144f8176003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805acf4f8f36460234432479aed75d492b415bcee0f0fc00008e99adaf81dcfc6afd983f79e65199615607676f8f9fc0ebf8b0970fe2b9a77f08ad", 0x63}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffffffffffffff9b, 0x0, 0x0, 0x0, 0x45}, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) [ 302.890440] binder: 9266:9269 ioctl c0306201 20000180 returned -14 [ 302.916160] binder: 9267:9271 ioctl c0306201 0 returned -14 10:41:33 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 303.058540] binder: 9288:9291 ioctl c0306201 20000180 returned -14 10:41:36 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x20082, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x4, 0x9}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$UI_GET_SYSNAME(0xffffffffffffffff, 0x8040552c, 0x0) recvmmsg(r2, &(0x7f0000007880)=[{{&(0x7f00000000c0)=@ethernet={0x0, @local}, 0x80, &(0x7f0000000800)=[{&(0x7f0000000140)=""/35, 0x23}, {&(0x7f0000000980)=""/4096, 0x1000}, {&(0x7f0000000200)=""/10, 0xa}, {&(0x7f00000004c0)=""/22, 0x16}, {&(0x7f0000001980)=""/4096, 0x1000}], 0x5, &(0x7f0000002980)=""/223, 0xdf}, 0x5}, {{&(0x7f0000000880)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast1}}, 0x80, &(0x7f0000002c00)=[{&(0x7f0000000900)=""/33, 0x21}, {&(0x7f0000002a80)=""/45, 0x2d}, {&(0x7f0000002ac0)=""/149, 0x95}, {&(0x7f0000002b80)=""/101, 0x65}, {0x0}], 0x5}, 0x200}, {{&(0x7f0000002c80)=@ethernet={0x0, @multicast}, 0x80, &(0x7f0000003100)=[{&(0x7f0000002d00)=""/189, 0xbd}, {&(0x7f0000002dc0)=""/38, 0x26}, {&(0x7f0000002e00)=""/114, 0x72}, {&(0x7f0000002e80)=""/192, 0xc0}, {&(0x7f0000002f40)=""/211, 0xd3}, {&(0x7f0000003040)=""/26, 0x1a}, {&(0x7f0000003080)=""/110, 0x6e}], 0x7}, 0x38000000}, {{&(0x7f0000003180)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f00000046c0)=[{&(0x7f0000003200)=""/226, 0xe2}, {&(0x7f0000003300)}, {&(0x7f0000003340)=""/4096, 0x1000}, {&(0x7f0000004340)=""/155, 0x9b}, {&(0x7f0000004400)=""/62, 0x3e}, {&(0x7f0000004440)=""/156, 0x9c}, {&(0x7f0000004540)=""/135, 0x87}, {&(0x7f0000007a80)=""/132, 0x84}], 0x8}, 0xa07}, {{&(0x7f0000004780)=@x25, 0x80, &(0x7f00000048c0)=[{&(0x7f0000004800)=""/99, 0x63}, {&(0x7f0000004880)=""/36, 0x24}], 0x2, &(0x7f0000004900)=""/131, 0x83}}, {{&(0x7f00000049c0)=@vsock, 0x80, &(0x7f0000005e40)=[{&(0x7f0000004a40)=""/4096, 0x1000}, {&(0x7f0000005a40)=""/234, 0xea}, {&(0x7f0000005b40)=""/53, 0x35}, {&(0x7f0000005b80)=""/195, 0xc3}, {&(0x7f0000006640)=""/183, 0xb7}, {0x0}, {&(0x7f0000005dc0)=""/121, 0x79}], 0x7}, 0x23}, {{0x0, 0x0, &(0x7f0000006480)=[{&(0x7f0000005f40)=""/177, 0xb1}, {&(0x7f0000006000)=""/19, 0x13}, {&(0x7f0000006040)=""/8, 0x8}, {&(0x7f0000006080)=""/55, 0x37}, {&(0x7f00000060c0)=""/34, 0x22}, {&(0x7f0000006100)=""/214, 0xd6}, {&(0x7f0000006200)=""/242, 0xf2}, {&(0x7f0000006300)=""/193, 0xc1}, {&(0x7f0000006400)=""/126, 0x7e}], 0x9, &(0x7f0000006540)=""/76, 0x4c}, 0xffff}, {{&(0x7f00000065c0)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f0000007800), 0x0, &(0x7f0000007840)=""/32, 0x20}, 0x5}], 0x8, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x1, 0x0, 0x3, 0x20000000000, 0x1000000000000000}, 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9, 0xffffffff}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) r6 = perf_event_open(0x0, 0x0, 0xefffffffffffffff, r4, 0x0) pivot_root(&(0x7f0000000180)='./file0\x00', 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000940)='fuse\x00', 0x0, &(0x7f0000006700)=ANY=[@ANYPTR64=&(0x7f00000003c0)=ANY=[@ANYPTR=&(0x7f00000006c0)=ANY=[@ANYRESDEC, @ANYRESHEX, @ANYRESDEC=r6, @ANYBLOB="43eb86049ab78e537c364645a477ba70e528e26faf0eb2dd6837bbd1625f2d6ba89ab3151c4676a3deda16f9cfc933", @ANYRES64=0x0], @ANYRES32, @ANYPTR, @ANYRES32, @ANYBLOB="9a55dfd4613779eb1c4864d121c3fb04b8f18a4d489b9d0789f1baf90b1842e543b5938aa668baf3eaabfe98269979c6f55c8119128b2c2086cd0e0b0df392f2700f5b87b4518f26568994d6794c8c3dde79", @ANYRESOCT, @ANYRESHEX, @ANYPTR64=&(0x7f0000000380)=ANY=[@ANYRESOCT=0x0, @ANYRES64=r5]], @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYBLOB="00000000000000000000dffe9a05db15566e192c70d561b4e1805ea18cbd177d5ed42a62c18abdfd1ed322b19368ec12ff09e6f505438097d779d51593ee789dd3add5b38e777b8eded90e624c17bb59d0363f377ed47ebc0a81a3a63d11b0bdd94e515fb6857ecee68c164d78b4579472f5a2a70a70e23e6bbf5075ee4c51d4ba12f0c69a573d538feebad9fc9d1b3b22e989e2bdadf44d9ff6e9f9af9f57c1b695736cbfe8a2d887e0f1460657c6f7095ba8", @ANYPTR, @ANYBLOB="5626eaf450e4798088184a39e7762a90ccdccd4e856e06b2e4eb15e2fdc1f2632a3bdcfcb600d938c24c3ad735f355b5cef8ccf9af68826d3aba3e19e37bd1f8219a34e1684cf8e08a567cfb1f5e71e00d40ad8000000000000000f084c8bb660d94742b7f26da076324846dadebff59d0902af9f52640e7e50e4bd5ee0b6e325f40d0b89ea0c2"]) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='maps\x00') r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) sendfile(r8, r7, 0x0, 0x800000080004103) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000280)=""/233) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000000)) 10:41:36 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:36 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:36 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000240)="6653f3528d4641144f8176003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805acf4f8f36460234432479aed75d492b415bcee0f0fc00008e99adaf81dcfc6afd983f79e65199615607676f8f9fc0ebf8b0970fe2b9a77f08add3eac478b16d6f2c59957ab364884b3c5d05692e664ebf68e6faa53367f05f4ad61421349faf11e931e7d6a4cf10ce619ad2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f480800b1003f5435282d27194a232de4acfd96ffffff7f00000000c23b418118d2e3f904c989499190019750a400000000000000000000000000000000f7d6862db17ecb11c6f3a9c25255fd24d74c5846b79f2860", 0x124}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 10:41:36 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(r1, 0x1000000000016) 10:41:36 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:36 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000240)="6653f3528d4641144f8176003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805acf4f8f36460234432479aed75d492b415bcee0f0fc00008e99adaf81dcfc6afd983f79e65199615607676f8f9fc0ebf8b0970fe2b9a77f08add3eac478b16d6f2c59957ab364884b3c5d05692e664ebf68e6faa53367f05f4ad61421349faf11e931e7d6a4cf10ce619ad2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f480800b1003f5435282d27194a232de4acfd96ffffff7f00000000c23b418118d2e3f904c989499190019750a400000000000000000000000000000000f7d6862db17ecb11c6f3a9c25255fd24d74c5846b79f286063d2a9db23", 0x129}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 10:41:36 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 305.926879] binder: 9298:9304 ioctl c0306201 20000180 returned -14 [ 305.961205] binder: 9311:9312 ioctl c0306201 20000180 returned -14 [ 306.024369] binder: 9320:9323 ioctl c0306201 20000180 returned -14 10:41:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:37 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syncfs(0xffffffffffffffff) 10:41:37 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000080)="441f0801000000e8c94ef56491ee54be0e1c2074ed27c1c6fe76cef3e2", 0x1d) sendto$inet(r0, 0x0, 0x0, 0x240007bd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) 10:41:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x2, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:37 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000001440)={0x2, 0x4e23, @multicast2}, 0x18) sendto$inet(r0, 0x0, 0x0, 0x2600cff9, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) sendmmsg$inet(r0, &(0x7f00000041c0)=[{{0x0, 0x0, &(0x7f0000003cc0)=[{&(0x7f00000029c0)='W', 0x1}], 0x1}}], 0x1, 0x488d5) recvmsg(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0x22e8}], 0x1, 0x0, 0xff96ce4aaaa47475}, 0x0) [ 306.147808] binder: 9333:9334 ioctl c0306201 20000180 returned -14 [ 306.194437] binder: 9338:9341 unknown command 25349 [ 306.199681] binder: 9338:9341 ioctl c0306201 20000280 returned -22 [ 306.208702] binder: 9338:9341 ioctl c0306201 20000180 returned -14 10:41:37 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(r1, 0x1000000000016) 10:41:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x2, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:37 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 306.758506] binder: 9347:9348 unknown command 25349 [ 306.768320] binder: 9347:9348 ioctl c0306201 20000280 returned -22 [ 306.782569] binder: 9347:9348 ioctl c0306201 20000180 returned -14 10:41:39 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000f00f88)) msgsnd(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="95"], 0x1, 0x0) msgrcv(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="000000000001e1345900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000e2ffffffffffffff83ad8f6e062c443e8f4c10208aa8ed17ae4f5bcb0ce1a4fe57c2ff8ad8d705f99c2058d7d2d0cabfd3fdcb52d934b4bb2eb049c8735274"], 0xda, 0x0, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000580)={{0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}) 10:41:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x2, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 308.917668] binder: 9359:9360 unknown command 25349 [ 308.922859] binder: 9359:9360 ioctl c0306201 20000280 returned -22 [ 308.930992] binder: 9359:9360 ioctl c0306201 20000180 returned -14 10:41:39 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000240)="6653f3528d4641144f8176003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805acf4f8f36460234432479aed75d492b415bcee0f0fc00008e99adaf81dcfc6afd983f79e65199615607676f8f9fc0ebf8b0970fe2b9a77f08add3eac478b16d6f2c59957ab364884b3c5d05692e664ebf68e6faa53367f05f4ad61421349faf11e931e7d6a4cf10ce619ad2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f480800b1003f5435282d27194a232de4acfd96ffffff7f00000000c23b418118d2e3f904c989499190019750a400000000000000000000000000000000f7d6862db17ecb11c6f3a9c25255fd24d74c5846b79f286063d2a9db238ef5f977", 0x12d}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 10:41:39 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_MCE_KILL(0x35, 0x0, 0x4) 10:41:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xa8, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @exit_looper, @acquire_done], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:39 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(r1, 0x1000000000016) 10:41:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x3, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:39 executing program 5: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='fuse\x00', 0x900024, &(0x7f0000000ec0)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@allow_other='allow_other'}, {@max_read={'max_read', 0x3d, 0x4000000}}, {@max_read={'max_read', 0x3d, 0x7}}, {@allow_other='allow_other'}, {@default_permissions='default_permissions'}, {@default_permissions='default_permissions'}, {@blksize={'blksize', 0x3d, 0x1400}}, {@max_read={'max_read', 0x3d, 0x23718000000}}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@obj_user={'obj_user', 0x3d, '}'}}, {@smackfshat={'smackfshat', 0x3d, '+cgroup'}}, {@hash='hash'}]}}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000900)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r3, 0xc004743e, &(0x7f0000000640)=""/246) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r4, 0x4004743d, &(0x7f0000001080)=""/246) 10:41:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xa8, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @exit_looper, @acquire_done], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:40 executing program 0: 10:41:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x3, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 309.033159] binder: 9374:9377 unknown command 287493 [ 309.049245] binder: 9374:9377 ioctl c0306201 20000280 returned -22 [ 309.066907] binder: 9374:9377 ioctl c0306201 20000180 returned -14 10:41:40 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xa8, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @exit_looper, @acquire_done], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:40 executing program 0: 10:41:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x3, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 309.148632] binder: 9391:9393 unknown command 287493 [ 309.159763] binder: 9391:9393 ioctl c0306201 20000280 returned -22 [ 309.172986] binder: 9391:9393 ioctl c0306201 20000180 returned -14 [ 309.238379] binder: 9399:9401 unknown command 287493 [ 309.244051] binder: 9399:9401 ioctl c0306201 20000280 returned -22 [ 309.255379] binder: 9399:9401 ioctl c0306201 20000180 returned -14 10:41:42 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x9c, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @exit_looper, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:42 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(r1, 0x1000000000016) 10:41:42 executing program 0: 10:41:42 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_MCE_KILL(0x35, 0x1, 0x2) 10:41:42 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/ipc\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/user\x00') 10:41:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:43 executing program 0: capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000804000)) mq_open(&(0x7f0000000000)='gth0\x00\xd2\xbd\xa3\xa9\x17\xe7s\x9d\xff8A\xdf\xa3uR\"\x1a\r\x10\x0e\xb9\x88Y\xbfgm\xbe\x03r\xe6F\x15\xa7;\xe8$S\xe1$\x96\xb1\xbep1&\xac\x0eG\x12\xe8\x98]\x19,B\xedc\x1c\xe3\xd9V9\xdd\x0f\x13;S42q\xe4:^?\x9d\xebb@z]\x96\x91\x1c/\x15v\xef\xd1\xcf\xce\x97&q\x06\xc7u\xc2?\xf6\xbfN\xf7#\xc6\xdc\x8b\x8f0\xdc\xba Q\x7f~\xa9\xce!', 0x0, 0x0, 0x0) 10:41:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x9c, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @exit_looper, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:43 executing program 5: [ 312.066524] binder: 9410:9416 ioctl c0306201 20000180 returned -14 10:41:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 312.108904] capability: warning: `syz-executor.0' uses 32-bit capabilities (legacy support in use) 10:41:43 executing program 4: 10:41:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x9c, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @exit_looper, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:43 executing program 0: 10:41:43 executing program 5: [ 312.235903] binder: 9429:9434 ioctl c0306201 20000180 returned -14 10:41:43 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(r1, 0x1000000000016) 10:41:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xac, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:43 executing program 4: 10:41:43 executing program 0: 10:41:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:43 executing program 5: 10:41:43 executing program 0: 10:41:43 executing program 4: 10:41:43 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xac, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:43 executing program 5: [ 312.917560] binder: 9446:9451 ioctl c0306201 20000180 returned -14 10:41:43 executing program 0: 10:41:43 executing program 4: 10:41:44 executing program 4: 10:41:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xac, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:44 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(r1, 0x1000000000016) 10:41:44 executing program 0: 10:41:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:44 executing program 5: 10:41:44 executing program 5: 10:41:44 executing program 0: 10:41:44 executing program 4: 10:41:44 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xa8, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:44 executing program 5: [ 313.797440] binder: 9472:9475 ioctl c0306201 20000180 returned -14 10:41:44 executing program 0: 10:41:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:44 executing program 4: [ 313.943249] binder: 9491:9493 ioctl c0306201 20000180 returned -14 10:41:45 executing program 5: 10:41:45 executing program 0: 10:41:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xa8, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:45 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:45 executing program 4: 10:41:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:45 executing program 0: 10:41:45 executing program 5: 10:41:45 executing program 4: 10:41:45 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xa8, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:45 executing program 0: 10:41:45 executing program 4: 10:41:45 executing program 5: [ 314.701137] binder: 9501:9504 ioctl c0306201 20000180 returned -14 10:41:45 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:45 executing program 0: [ 314.843046] binder: 9523:9524 ioctl c0306201 20000180 returned -14 10:41:46 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:46 executing program 5: 10:41:46 executing program 4: 10:41:46 executing program 0: 10:41:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x6c, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:46 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:46 executing program 4: 10:41:46 executing program 0: 10:41:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') sendmsg$FOU_CMD_GET(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)={0x1c, r1, 0xe09, 0x0, 0x0, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e24}]}, 0x1c}}, 0x0) 10:41:46 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x6c, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 315.563206] binder: 9533:9536 ioctl c0306201 20000180 returned -14 10:41:46 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000280)) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff000000000900010068667363000000000800020000000000"], 0x38}}, 0x0) 10:41:46 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x807284, 0x0) r0 = open(&(0x7f0000000280)='./file0\x00', 0x45e881, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="7f454c4600000000000000000000000000000000000000004000"], 0x1a) 10:41:47 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:47 executing program 5: fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000240)=""/101) 10:41:47 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x6c, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:47 executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0) mkdir(&(0x7f0000000200)='./file0/file0\x00', 0x0) rename(&(0x7f0000000300)='./file0/file0\x00', &(0x7f0000000080)='./file0/file1\x00') 10:41:47 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b"], 0x1) 10:41:47 executing program 4: r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000010020507000200"/20, @ANYRES32, @ANYBLOB="00000016010000001800120008000100736974000c00020008000300", @ANYRES32], 0x38}}, 0x0) 10:41:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) [ 316.419367] binder: 9563:9570 ioctl c0306201 20000180 returned -14 10:41:47 executing program 5: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000000)='\x00') mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0) 10:41:47 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xb0, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000a00)}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:47 executing program 4: semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000240)=""/60) 10:41:47 executing program 0: perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="6786252c22a590e2d1c7d750141e9c6732a1e88f64d7b5bf5acd682d79ce52e613e898bd7a5ea24f0db38243ec285f92ef44951529c63dfabf6ac9ce42c3f3c09b2c096f19d64fedb0cca4cad9c9354d5981763b5fbab13158c5aa33d81264b358fef368c72247921bf214fc0ad6cf20425c2c9ed513f5da4aa3860877", 0x7d) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) socket$inet6(0xa, 0x3, 0x2c) close(r1) 10:41:48 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:48 executing program 4: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x807284, 0x0) r0 = open(&(0x7f0000000280)='./file0\x00', 0x45e881, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="7f"], 0x1) 10:41:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xb0, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000a00)}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="c800000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000009c0012001000010069703665727370616e000000880002001400060000000000000000000000ffffe0000002140007000000000000000000000800ffac1e010108000f008e000000040012000800aeb7a40000000400120008000800000000001400060000000000000000000000ffff0000000014000000000000000000000000bb14000d00ff0200000000000000000000000000010c000a00aaaaaaaaaa1c000014757c6d63098e6ea2f71a8e51f2cc9fae11af3ee00e67559dad94ac5e0504ca3848d2798588b99a9b3fbca3dad6ce063f15efb18e1ac7ba8567f5335a759b7754bf0757c03e02e72525d2353ea874b9fb26e2583d1f870f094f81f798bd9cd2356397afa99a1b6c0000000000000008d8f78541ba83c1df1cfe9fa5b7f3879ab415f311dd3d4ee2ea47608bc43f56d0254a7ac198fee092bf1cfe6ca9b59bc850033bf18e7e8e437db5bd4284f5cabae09b3ea3ddd2107aebfdcb83590fc042d794f6829e799abbaac1aca4049982a2adb1d49d6464d91889785c041bc97e72de2e8ad0861a30a0f925d7df6eba3bd59cb4c3a0dd55ce9a40975cd66329c79964443665ad2028fcadf49f72ac935f44adea343161d1a38258e6f30907dadb270c4eb94dbc223eb427491f54093ea3bd8c7ac25fc9a4349c70eebcafdf5c13f16f444a669462dbea6c185b47e30fe425eaf1af76a672fe4f95c9f668b337f48870049c9aa83099dc7b216c0cfa2942d16d2e14f9c2ce46dc391ae315e978fd528d8cf8e9a468fb12d3f19b48ceae264e629c0b9718726bad639c78d0f4ad8c1600"/603], 0xc8}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x249, 0x7a) 10:41:48 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r0, &(0x7f0000000100)={{0x1b, 0x63, 0x8, 0x3b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0x78) 10:41:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xb0, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000a00)}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:48 executing program 4: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x14, 0x1, 0x1, 0x201}, 0x14}}, 0x0) r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000240)="24000000010a07051dfffd946ff20c0020200a0005000140021d8568031baba20400ff7e", 0x24}], 0x14}, 0x0) 10:41:48 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:48 executing program 5: perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x100000000001, 0x0) shutdown(r0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, 0x0, 0x0) semctl$SETALL(0x0, 0x0, 0x11, 0x0) 10:41:48 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x807284, 0x0) rmdir(&(0x7f0000000100)='./file0\x00') 10:41:48 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000080)) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 10:41:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xb0, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:48 executing program 0: preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000240)=""/101) [ 317.565948] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 10:41:48 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:48 executing program 5: perf_event_open(&(0x7f00000004c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="6786252c22a590e2d1c7d750141e9c6732a1e88f64d7b5bf5acd682d79ce52e613e898bd7a5ea24f0db38243ec285f92ef44951529c63dfabf6ac9ce42c3f3c09b2c096f19d64fedb0cca4cad9c9354d5981763b5fbab13158c5aa33d81264b358fef368c72247921bf214fc0ad6cf20425c2c9ed513f5da4aa3860877688a42afe3f2629daac75a232faefd", 0x8c) getpid() bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x7a6}, 0x1c) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000000)) syz_open_procfs(r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) close(0xffffffffffffffff) 10:41:48 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000300)={0xd, 0x0, @ioapic}) [ 317.657903] binder: 9637:9642 ioctl c0306201 0 returned -14 [ 317.743461] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 10:41:48 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0x7b, 0x0, &(0x7f00000000c0)) 10:41:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xb0, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 10:41:48 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:48 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x7fff}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0x400086) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000280), 0x12) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.events\x00', 0x2da8020000100008, 0x500001c) openat$cgroup_ro(r0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40305829, &(0x7f0000000040)) 10:41:48 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x7fff}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0x400086) perf_event_open(0x0, 0x0, 0x7, 0xffffffffffffffff, 0x0) write$cgroup_int(r1, &(0x7f0000000280), 0x12) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x80444, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000280), 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xe43) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, r2, 0x0, 0xe, &(0x7f0000000100)='memory.events\x00'}, 0x30) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.events\x00', 0x2da8020000100008, 0x500001c) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0xfffffffffffffff8) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40305829, &(0x7f0000000040)) close(r1) 10:41:48 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0) read(r3, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:48 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(0xffffffffffffffff, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xb0, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, 0x0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) [ 318.130156] audit: type=1804 audit(1585824109.057:60): pid=9678 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="memory.events" dev="sda1" ino=16984 res=1 [ 318.160437] binder: BINDER_SET_CONTEXT_MGR already set [ 318.180351] binder: 9687:9691 ioctl 40046207 0 returned -16 [ 318.206025] binder: 9687:9691 ioctl c0306201 0 returned -14 [ 318.251475] audit: type=1804 audit(1585824109.197:61): pid=9684 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir113885774/syzkaller.KP2diE/104/memory.events" dev="sda1" ino=17004 res=1 10:41:49 executing program 5: syz_mount_image$iso9660(&(0x7f0000000280)='iso9660\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)={[{@block={'block'}}]}) 10:41:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xb0, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, 0x0}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:49 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(0xffffffffffffffff, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) 10:41:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0}) [ 318.407257] audit: type=1804 audit(1585824109.347:62): pid=9670 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="memory.events" dev="sda1" ino=16984 res=1 10:41:49 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000440)="bebc37573417944e7c2e03cd77c119789d8a3bd37ed060d2a27a9d8658601124aef9306601e9d9e910d8702b49885eeae2e2c79adbe7b9c69d191179dc90710a5b961ab56918e740d6484bcc8e02dfd85165c2055ee6ca47380c123f6afa4b64b1be4e4530cbcdd80b7a3b36edea7dee952aad83d71412f2ce0562d75ce8e78e07b7919375b738dad3cdadfa4453796749d043dc488dcd8b990b0a2e25d5cccfea2a80991321a4c85faa66693bd9e4532012ce66cd46f6dd811dda1e3bc40b8cfebc9012ad3324ac9a6e40c874e166536b0d9789053ef029fe5312a3fd1d05478810b025a1828aa8f97e8a05cde70c0b0b6d29fafdc0906e311584acb30f7f148809fd56e0455fb63c99715ea6b5bb10df741e63e6be60dd7bfd7a2d423f1761a84d33af84ec9f51f9414dd14f7a7825222faaf0741d4726b74659d3181772373eac23473ac228859a0ab8f1b6814637dc7f88b9015058a87a0aa1ce52f174b940aeed39b842fe52813d1dff1493379e14b2d188cfb19ce141faaf361e08c41afed6aeb68694725e4a7da9444d94ddf8a0a90066024447ab1d3ac4a4d2159047391ee9d1edb2516d40fbc9276957804563ea7f1acc92854b12bb8ba24cda6f11335ea7b88491883820e637afcf7df7bcec4611b4a532123533b59fd6e6758b02265d51c4b6e9f35a079fe93d73889910e606f5499f6b0e2c69f0ad2d5330254e9fc01e1cf6078e499208a44a7f9dec43b1d19ad62b11bf0dddf8c08b02ae24b771f30bf280903e9df9b97627f30e81e085f7ce8f0e540500eeaf2af13b945ff792fb0f7330c13e5d399305d19254881ad5dee59232c1c54e7d068fddfac69105f314d6bcd1959fd5d67dd7198f6b6912447b816b091815a1cd1fc4765f25b8e6974419d272a99badb9b226f8bf7cf3a7fdc670899d3f5a0f785cf686d5bf9f388ebb5f697fea841ef3690652a6b2ede1adfc2347b8b7f9897a523a3422b5bb3203b22fafe5996b91c64df2788dc9c9053ce0e27fcc9683563e82bd9497b70cfe747eda866bde0ce503e1afe32960ddd5d26a39995284758d6512ce0e124057833a67a0096a43336ed6cf5ae906378346606e27eb63ede50f666c27e00f8a2aea0042e348094fbd597b1ec1356d680290c4097c103070ba3df10c5c7445f8550af1361d701199fcfe7f79b4f7d947a06b64bbf60d33c0306f73bd3fb9e012681023d234c5d8927702e8ef643693b6d670791177bd7b31731bd351aa1a59a7cd1160772b0558a96a0ee21af013f0d84bda1542358ef0bad052f313853e0f32b43153200daa4bc5c4f51a314ead071cf67bb8177560bad893ff28953758441b6b2d909a35db8ab60a7bc798524ec75a53d0e5d43aff61827aad8b7584118152e3c7dbea9668133ff5ced4e8c70b2974afaca774e5dccbb3892a20c78682f8b9a716f3bc3c264ba3f1b5882f3a38669385ba6db9816c9cf08f462a6272a6c37649b6a40826ab7ceb2605f69e1bf65d0747163111f6897a1c85f10f1bf4a8aaf96b29ed15cd32fa24cac2ddda49d0fcde093c10e77fbcdc20c565ef2da60828ff953f2b82d7ed15c20ac2781708bf56cc551ae1bea960d7979f55fba87b67e5b76e48648503f84db9cf6dd44a799e28da8852082f06395a5da958be0d0c2ba74fcfddd525b565502f1709e5f9e51893974c890f39b2406c111442fba90f48739821e9908fd446f55aae6a7c00aec7c4ad2dafa911053ff49f57d79a8b0eb1747f40eb15ffa7aca8fc303460b16d448e74fae08d4b7434a86d4f6e2acb6e9ccac8ad3e6706de64c750d17d93261a2c34e69b55131604f4de452c6c08c2635dee21c6896c9d696706088155941ddb006f8d7b85978787f34200426488b433b3ad6906bb950b986267870289d2bffe1e0887ce3d9326af20b66fb230d4ace95c11536243a3b1f1ea00108f9c354a16ad3fab45f6ae536d3bdafad2712e9ff7184a80b7555cc506b2b094f01b73bcdee9cfe7483352e196346907f7c07931bebf967ee4798825a018d3565c29d27205e57347ba3498cb33e926809e8ac625b2c52afca8705c44ff8bd3e413fc3260dfa2ff4a099bfb074c4f77697581bb271a076e92bf8e26d4175ee95eae3af28a9ffe8abf59562d4a8d9766794e2347e6f07d7642a64d019bf6c0f96c6269a0787976b8c1446555dc66983d5a4ffa13cb7f5e47a0142cef49f28eabe8c1f3045a112bb841f2ac5ea79ccaea80b60dcb182e5c52535556702eef9a3338ce164d4fbf5c285d15ad307ae86315f1b122505841f7d8b09ec2facf4dfbc3a8253b5f0fe44fef960ecffd251e8ddb8f56b9ffa8f1da238961eafed5feea260000c8104a96541f9197e867534e81cf36850036676588e23a1035482014905934c9d49bc302bb9e9fbaf56008e27c3899bc4c56797a2de50887e6b770b848ac304317a1cfe408928016892e06a5d62272390fa5aec7c45a6e936d20ff009a0946d64acc35c542e2f6e4c7bd2c0e71bc93b76c47feb6474e5a9d2f7be3b0ddc67e82341d2cfe8314c2ccb587b4dc63d10eaf5e13afc1ed0fd9abd4f52a225cf2ebc5cbfac192440c754fbd3df589e72e03c05b7f120c85aaf82c07ab055345c61ab416bf385dbcd14c34e2a2e562970882a6f8e2bceb8a24d59c7db40edfafb3e66f44496b8575de7405b2d9fec42b40ef142efec36cd271b6207b6c668d24965de5ead6daa861679e0ff97185c841ea6865887c43fe44be254d2cf300b5b608d1bf58bf35866e10b178a35cf740cbff0c649e80851f130e00e35ea751f3e28dc835f1966d26bad82aff363925ab93437ea172b699e72e8949d6734f35b8556b138dadcc839797aca2a1e64fb63369a20007507b8af45cc0c66f6ded5d45e1c818bc89de4ce4298f098e35fbaeccd65e6508495acff22980bc3229fa863faf48e50be1bef352c0371874a6dc41799ac6686d80f214c900d6cb03769255537246dc3db2e61e119745044f5a52389dbabe153efcfcb0b6d3ff779a367e99a55b046aec47715b32a34b693bf2591ba71c0a03e1820fc9cacd15f2a0f5fbcb8d6f1401e3198910ee241463627e22093178a44c6ab0030436fbb4bcf580276120fc79b97fb2d73b9f26a1d4d37da7db64caa8b9f30fb1002d5e1eaf737373a9f203732547c4ad65d40fa91dd0e084c5dfce72e481349988474a443a15fd0b380fd1934346b1bd4cee07c021313dc69eb6888bf113c414310c7ad2bcd7e90663468d9d6cd5a3137d4592fc7bbcd076cfda7d7a846512025979c93216f046a6b4f77807a17caa183fd885a99646612f9f5c612281f4b08f86b8ac2fcb8695a6dcdc82e19cb239b6b757abf7bb93c1a3a0c70f05fd4884b19c6560f1e233ca3d03156338404a5b29fb34cb96cc2c21ea5bfd776ab4c900f63249417df63d301c7c789a08cfcedb44a10dd74265afdeeb84b3bb73d45d632b9695991d416b0d84764ef89259632ae961c10747e99f986589f9287e20b2616fc3c6c4fc3e51888c868b18b117fe3c7b37760bd324614c7238d433f3885346871a3746c6ca983c4712e9762b57cf570f42e9afe954338783d479fa3af9ccc3f4bb90ac2c0e4e253e7b54bf594a49d2f99b9f1d2b4b5f33e1472e4699010a562833905493dfda63216ab26846b076fc80291452f4314c2a6b52473af7a9133343006e62ce7f0a9696e8f4c874af2ec034271e644ed0b1d54bda457e83e9ed2ec4ab1318726729811fe8828f28c18727d195c5f46980182e790ad974c9418aa52a1b24b487c9f527a8290b455d759688f348f3815af29d197296173e027650c0f00da2e4a246dc42343ef6f998b08743813d2ddb9d6c9bbe4621300d0dd15560da9f34c07fe21f1e310be5fe936b6723bda266122d3831aba433a3951b92990d0546048cfd731a5d18ffa8e935d6a1dd56763f4caa2848ba46788a8ec29608d25c463d9d6cded45ae8a3d0f3b3b9aca3ff94e23281ff8cf500a245fc784c5afbd226f9becd9fbed3ddd44aa26ce1c5b8bbfd433a7163bf5f280139244cc7e50f84c773588c0a2f58627a24db7d3d5bd17f32072e8300bdd0344d7080b9877343f241a1f02026b9b8399267e2ea588c01ab0a3e0f942e37a051fa66fd148dd48a804a5ff80b5ac6bfe27083e11545eca3e403a0ce4ace2a24c6058b2dc75226260eacf5224ce18743f54e19f8dbb5b0077848b999a036077fe2fb4efcf7e03538dfe79d1fbed137d8c15c84694d582c7e5b0e6bcb8cab04097a2e824fb25c6b5d5506e3e4086a694d281ccdac65e96eddaf131d46f2ad5105e1ccbb1bbd9239cd73ec105c8d1636cc3094701ce826c1f2331e4d85870b7639e4e2cb4e13651b1b66c558df71d288187c8bbaf7137689d6324931cce22eec300bb2083e2abf274dd3f34309040aa006711277657c1b1ff5526d765cacbf91b22cdc755ed44901508c10de333dd126fc4b890cc9cb035a6ddf915ecc3c805a9bff67d901e4f5aeb4353c5ed1ef6f92590b0362acae8a8a54b3959d542a588432112aaa7a8a297930a352656f4e5565c10dbbcdffddf6125a4d2c1043f2feb6d31e3acc9ce2c9e374b28c602b01cab72768658b77bd7e0706cea5dc069fd700b0e29ad04eabd8fd579a80c3f39482d3ac338574e0c548e45fa649873ed7a684dce43f5bd023b5aa5eeb52f8c08dceef8644d8c553cb45d6bb0aa1c7adc928d47ced61a17eed3d869b9268decd67a72aa844c9e05eba7a88d9bdcdd78517a27e2c4c2021d589ad848f1c37d52e40fc8c0430b49b3d15cc9d7ec4123fee314dc5e67ffba13afb85ee7c3b8f0be23b801a7a56fccf281880ed00e46f425f33c9c7269e9185851625ff2c93d94f2c6cfb54376f4a0945e2aaae69b27877d034afcebb5a4427af74949a0e1c26ed295e59b0e7ad350528b8e5faf862ab81e8700c25990e7d3b8687513a059cee1d316aacb7f066851db7f46eca8f7ef09cf55a386b0921cf62a005920888512e9de8606696e320667ce594987be25a3b4e0ec1bfa799b1beb23b32eb6ef30b9b6bd41f5fea792afd383785d3bc22a6a4ec99f6954ed18193d4bd34007eb6a3a7c0867f000195d972cbefd71abce2aafd346b786bb0a4d7c71992bb25d8dedfa1b2e0f081f0a7481acd86bff78b34a23a7dc7db92026dd1ebcf59d04e99106ad46ecc04681af67bef188960bd77229a881492eeb2bafe5c224be28e339b54c53c4fb432bbe244b2598899fc9ffc3276c5a6325a582b60e9788933040af7815df6817cdbd4b640cdd2a9a4cb9389ec7b93839ae9f00cddc42294da71b935870841debeba960871221b47068ae1be1996fbbb59b1c447b7573f8601aca223ffccddc18b64ec92760c847b112a8fe7bb1dee83c740e598a70dcae0060f0dc81f34c0aa9d632680b4547fbe8f314546bc1f1cdf5dd2d63208b4f7991a0069486eae07cfed63aebcb7370d0a923b3c074d5b7fae5f5d7fb0e430a9c077c8d47156626df0c9ee4c18e4294ba7dedb9f847e2767df8987745dd4e7a4eaf03b695676879bfa0b96cb184645963f9a9ea70aa3b1328237f5d8e508571d6e06c7e7590a8b79567c39195bffc83c81055d170c59219dc26756b1e72e64d32e1247812e18694bf4e62fe65d5c1485b59effa289bc939ce4b2c9a0bb353b6f0ca529b90fc47b8776be1b036a63da934bac5a5fb91af74ba1128882bda602a8a05e2c890e52f2e627275406fcb701608469ab5a0cd57743aef63a33a7edba3433efa5c49d03e20b17e221f1cc45", 0x1000}], 0x1) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) pipe(&(0x7f0000000000)) r3 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r6 = fcntl$dupfd(r4, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r3, 0x0, 0x5, 0x0, &(0x7f0000000200)="5cdd30cb7f", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x100000}) ioctl$KVM_NMI(r2, 0xae9a) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)) ioctl$KVM_RUN(r2, 0xae80, 0x0) 10:41:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0}) 10:41:49 executing program 4: perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f00000000c0)={0x0, 0x8, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x0, 0x0, [], @p_u16=0x0}}) 10:41:49 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r0, &(0x7f0000000200), 0x400086) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0xe43) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.events\x00', 0x2da8020000100008, 0x500001c) 10:41:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xb0, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, 0x0}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:49 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(0xffffffffffffffff, &(0x7f0000000300)=""/128, 0x80) tkill(r2, 0x1000000000016) [ 318.527940] audit: type=1804 audit(1585824109.407:63): pid=9677 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.4" name="/root/syzkaller-testdir113885774/syzkaller.KP2diE/104/memory.events" dev="sda1" ino=17004 res=1 10:41:49 executing program 0: perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f00000000c0)={0x0, 0x8, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x0, 0x0, [], @p_u16=0x0}}) 10:41:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0}) 10:41:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xb0, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)={0x0, 0x20, 0x40}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, 0x0}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:49 executing program 4: perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f00000000c0)={0x0, 0x8, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x0, 0x0, [], @p_u16=0x0}}) 10:41:49 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, 0x0, 0x0) tkill(r2, 0x1000000000016) 10:41:49 executing program 4: perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f00000000c0)=""/106) 10:41:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x1000000, 0x0}) 10:41:49 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0x400086) write$cgroup_int(r1, &(0x7f0000000280), 0x12) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xe43) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.events\x00', 0x2da8020000100008, 0x500001c) 10:41:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x6c, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 319.018479] audit: type=1804 audit(1585824109.947:64): pid=9732 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.5" name="/root/syzkaller-testdir415563708/syzkaller.lha5EB/106/memory.events" dev="sda1" ino=16984 res=1 [ 319.093842] audit: type=1804 audit(1585824110.037:65): pid=9759 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="memory.events" dev="sda1" ino=17016 res=1 10:41:50 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000300)={0x0, 0x0, @ioapic}) 10:41:50 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, 0x0, 0x0) tkill(r2, 0x1000000000016) 10:41:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x1000000, 0x0}) 10:41:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x6c, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:50 executing program 4: socket(0x0, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=ANY=[@ANYBLOB="500000001000050700"/20, @ANYRES32=0x0, @ANYBLOB="65350600000000001c0012800b0001006970766c616e00000c00028006000100020000000a000500040000000000000008000a00", @ANYRES32, @ANYBLOB="98fd5fb61241a11cf401ed2ca7af9c028b3099d15d1cebc41bfedaa758b24b4582038a4b68"], 0x50}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 10:41:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x6c, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224, 0xe0}}, &(0x7f0000000a00)={0x0, 0x18, 0x30}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x50, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:50 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)) read(r3, 0x0, 0x0) tkill(r2, 0x1000000000016) 10:41:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x1000000, 0x0}) [ 319.312057] device ipvlan2 entered promiscuous mode 10:41:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:50 executing program 2: timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) gettid() r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)) read(r2, &(0x7f0000000300)=""/128, 0x80) tkill(0x0, 0x1000000000016) [ 319.419258] audit: type=1804 audit(1585824110.357:66): pid=9757 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="memory.events" dev="sda1" ino=17016 res=1 [ 319.489498] device ipvlan2 entered promiscuous mode 10:41:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:50 executing program 5: perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000080)={0xfffffff8}) 10:41:50 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f0000000000)) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) dup2(r3, r0) 10:41:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:50 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, 0x0, &(0x7f00000000c0)) 10:41:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffd1d, 0x1000000, 0x0}) 10:41:50 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x7fff}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0x400086) write$cgroup_int(r1, &(0x7f0000000280), 0x12) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x80444, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000280), 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xe43) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, r2, 0x0, 0xe, &(0x7f0000000100)='memory.events\x00'}, 0x30) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x2da8020000100008, 0x500001c) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0xfffffffffffffff8) openat$cgroup_ro(r0, &(0x7f0000000080)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40305829, &(0x7f0000000040)) close(r1) [ 319.578618] binder: 9798:9803 ioctl c0306201 20000180 returned -14 10:41:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) 10:41:50 executing program 5: r0 = syz_open_dev$swradio(&(0x7f0000000200)='/dev/swradio#\x00', 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000440)={0x0, 0x9, 0x4, {0xb, @sdr={0x0, 0x1}}}) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000440)={0x0, 0x3f, 0x1, {0xb, @sliced={0x0, [0x0, 0xfff]}}}) 10:41:50 executing program 0: 10:41:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={@fda, @fda, @flat=@handle}, &(0x7f0000000080)}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)={@fd, @flat, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/224}}, &(0x7f0000000a00)={0x0, 0x6}}}, @acquire, @exit_looper, @acquire_done, @decrefs], 0x46, 0x0, &(0x7f00000004c0)="fc94561e713700686326b4b71c2b3e473427aaccae04f53c12af005aee9848463982a48ab9fbddc0b306432ba8ca11bbd85d292b5bed08d4bf0cc2f517d7330d2afc6c8f7cf41fe566d7dc53ca41c954"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040010000000000000000000000000000c6a6f01a52c9"], 0x0, 0x1000000, 0x0}) [ 319.711597] binder: 9811:9820 ioctl c0306201 20000180 returned -14 [ 319.759825] ------------[ cut here ]------------ [ 319.764793] WARNING: CPU: 1 PID: 9818 at drivers/dma-buf/dma-buf.c:1039 dma_buf_vunmap+0x181/0x1f0 [ 319.773905] Kernel panic - not syncing: panic_on_warn set ... [ 319.773905] [ 319.781306] CPU: 1 PID: 9818 Comm: syz-executor.5 Not tainted 4.14.174-syzkaller #0 [ 319.789095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 319.798443] Call Trace: [ 319.801089] dump_stack+0x13e/0x194 [ 319.804808] panic+0x1f9/0x42d [ 319.807990] ? add_taint.cold+0x16/0x16 [ 319.811960] ? dma_buf_vunmap+0x181/0x1f0 [ 319.816102] ? dma_buf_vunmap+0x181/0x1f0 [ 319.820237] __warn.cold+0x2f/0x30 [ 319.823771] ? ist_end_non_atomic+0x10/0x10 [ 319.828112] ? dma_buf_vunmap+0x181/0x1f0 [ 319.832280] report_bug+0x20a/0x248 [ 319.836003] do_error_trap+0x195/0x2d0 [ 319.839880] ? math_error+0x2d0/0x2d0 [ 319.843701] ? save_trace+0x290/0x290 [ 319.847510] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 319.852373] invalid_op+0x1b/0x40 [ 319.855823] RIP: 0010:dma_buf_vunmap+0x181/0x1f0 [ 319.860565] RSP: 0018:ffff88804edb7c48 EFLAGS: 00010297 [ 319.865921] RAX: ffff88804f63c100 RBX: 0000000000000000 RCX: 0000000000000000 [ 319.873194] RDX: 0000000000000000 RSI: ffffc900142ec000 RDI: 0000000000000000 [ 319.880449] RBP: ffffc900142ec000 R08: dffffc0000000000 R09: ffffffff8a095880 [ 319.887707] R10: ffff88804edb7d50 R11: ffff88804f63c100 R12: ffffc900142ec000 [ 319.894996] R13: ffff8880a9abc5e8 R14: ffff8880a97f2280 R15: 0000000000000000 [ 319.902269] ? dma_buf_vunmap+0x181/0x1f0 [ 319.906455] vb2_vmalloc_detach_dmabuf+0x57/0x80 [ 319.911203] ? vb2_vmalloc_map_dmabuf+0x90/0x90 [ 319.915876] __vb2_plane_dmabuf_put.isra.0+0x10b/0x2e0 [ 319.921144] __vb2_queue_free+0x5f5/0x7b0 [ 319.925337] ? __vb2_queue_cancel+0x3c2/0x8a0 [ 319.929841] vb2_core_queue_release+0x5b/0x70 [ 319.934330] _vb2_fop_release+0x1c1/0x280 [ 319.938514] vivid_fop_release+0x17d/0x3e0 [ 319.942778] ? fcntl_setlk+0xb40/0xb40 [ 319.946660] ? vivid_remove+0x3d0/0x3d0 [ 319.950666] ? dev_debug_store+0xe0/0xe0 [ 319.954722] v4l2_release+0xf4/0x190 [ 319.958451] __fput+0x25f/0x790 [ 319.961772] task_work_run+0x113/0x190 [ 319.965666] exit_to_usermode_loop+0x1d6/0x220 [ 319.970256] do_syscall_64+0x4a3/0x640 [ 319.974160] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 319.979349] RIP: 0033:0x4163e1 [ 319.982529] RSP: 002b:00007ffe1d5cad40 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 319.990232] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00000000004163e1 [ 319.997491] RDX: 0000001b2ca20000 RSI: 0000000000001bb6 RDI: 0000000000000003 [ 320.004751] RBP: 0000000000000001 R08: 00000000f6c41bb6 R09: 00000000f6c41bba [ 320.012017] R10: 00007ffe1d5cae20 R11: 0000000000000293 R12: 000000000076bf00 [ 320.019286] R13: 0000000000771178 R14: 000000000004e122 R15: 000000000076bf0c [ 320.027865] Kernel Offset: disabled [ 320.031543] Rebooting in 86400 seconds..