2b15a4075a7fb954bc5a9e63d5ceea09e0381202720d7c6f82b084af7a2862f3be9c4f456d1ba5c9e288a7159d168b7643dd3c2754cb3d24ab1652d6a329e8a54f0b4a454ceae37c987cd275fe2f0727f3657ea6f9ec7826143e959515e6843dcedc2f84f43c9ff844d1a7862d9a32cdb838748fbac5b22a757a17097b8547d0cd2c8801e6a0a048acf7dfd7a579896636a48f65d955004220c1bf3fdd79b0289885327577d7ff253c35bb714358f72a287ed80e1c0efb009b6c872ecfd963e81ad80e401d8dc4c9f70f79757d48f49c3b66e67ecf4b71f3cfa8c2474d5d02df97fd943346d4b57712758a05366d5b45b171a4721b10c2b8317bd54d1305ce3161ac488c3e1b34fc9f61c22cf542de4943b63cac0eb281ececb0a779e4a169202495840fd50599ae4dd35ebfb08ae2a62d5b145aeeaa0c7a1daeb65e74210081a1557c021302f172048517ce0ed199df00cfe6dbfd5fb14193ac518c9b0df6abaf86d0a748657fdf90eb0b83a07696073c1ae0f392cfbbd4d06aae5f3fe5aef58cf9ed1d70b0ab0bda158cbdfba7d7e41ceb", &(0x7f0000000100), &(0x7f0000000040), &(0x7f0000000080)="666df841f5c1947dd76d9c6f8b14d5f51824bdff625ae2520d28cc1f53563cef2b12069ec0ddbc50579aa07ec39191cc37d342f52450f2ecaf06fe4b501c8a9003defe40a0e4187f74ecb2368a70d747a3565d4c") syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r4 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3, 0x20010, r0, 0x8000000) r5 = mmap$IORING_OFF_SQES(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x110, r0, 0x10000000) syz_io_uring_submit(r4, r5, &(0x7f0000001240)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x1, 0x0, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x1, {0x3}}, 0xffff) 00:40:09 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0x8}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1806.607613][ T8712] device wlan1 entered promiscuous mode 00:40:09 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x8e00}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1806.671761][ T8715] xt_cgroup: xt_cgroup: no path or classid specified [ 1806.691849][ T8712] device wlan1 left promiscuous mode 00:40:10 executing program 0: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MAC_ACL(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0xf8, r0, 0x100, 0x70bd2a, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC_ADDRS={0x34, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}]}, @NL80211_ATTR_MAC_ADDRS={0x28, 0xa6, 0x0, 0x1, [{0xa}, {0xa, 0x6, @device_b}, {0xa, 0x6, @broadcast}]}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_MAC_ADDRS={0x4}, @NL80211_ATTR_MAC_ADDRS={0x1c, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}]}, @NL80211_ATTR_MAC_ADDRS={0x58, 0xa6, 0x0, 0x1, [{0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @broadcast}]}, @NL80211_ATTR_ACL_POLICY={0x8}]}, 0xf8}, 0x1, 0x0, 0x0, 0x20000}, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3000002, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0}) [ 1806.747783][ T8723] xt_cgroup: xt_cgroup: no path or classid specified [ 1806.788163][ T8729] xt_cgroup: xt_cgroup: no path or classid specified [ 1806.792865][ T8725] binder: 8718:8725 ioctl c010f508 20000000 returned -22 [ 1806.808067][ T8725] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1806.883239][ T8740] xt_cgroup: xt_cgroup: no path or classid specified 00:40:10 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\aF\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:10 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0xf}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:10 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3000002, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000040)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x5a, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:40:10 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x9603}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1807.258540][ T8779] xt_cgroup: xt_cgroup: no path or classid specified [ 1807.271030][ T8776] binder: 8762:8776 unknown command 0 [ 1807.290694][ T8783] xt_cgroup: xt_cgroup: no path or classid specified [ 1807.299172][ T8793] xt_cgroup: xt_cgroup: no path or classid specified 00:40:10 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x9a02}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1807.307921][ T8776] binder: 8762:8776 ioctl c0306201 20000200 returned -22 00:40:10 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0x12}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:10 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xa202}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1807.400294][ T8804] device wlan1 entered promiscuous mode [ 1807.439989][ T8804] device wlan1 left promiscuous mode [ 1807.456607][ T8823] xt_cgroup: xt_cgroup: no path or classid specified [ 1807.488407][ T8828] xt_cgroup: xt_cgroup: no path or classid specified [ 1807.523154][ T8833] xt_cgroup: xt_cgroup: no path or classid specified 00:40:15 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x1c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f630c4001000000000000000000000000efbd5664bd8958000000"], 0x8e, 0x0, &(0x7f0000000040)="48c9054206136a29f7eeb46a01bf73a3cda4ae7979ca9214667baa712fe7f7103d254a85b847bde8bd333783447dd1de8077847d5417c9152494579a1dbd021b3a843723a1d6bd915c204bef01b8ff98c7d7499cdb31c4ce3ef8f226a27738ad0f4447a43704955253d3dc17a3345c4d37a9d7d1eaea2196025682833d11f9d70b32b23e1b7900df43003fc6c553"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) 00:40:15 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3000002, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) ioctl$BTRFS_IOC_DEFRAG_RANGE(r2, 0x40309410, &(0x7f0000000040)={0xfff, 0x858e, 0x2, 0x7, 0x2, [0x0, 0x101, 0x86, 0x5]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:40:15 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0x48}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:15 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xb801}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:15 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\bF\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:15 executing program 4: r0 = signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0x134293c6]}, 0x8) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0x31b, 0x5, 0xfb, 0x3f}, {0x101, 0x1, 0x9, 0x9}]}, 0x10) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40086602, 0x400500) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14) sendmsg$nl_route_sched(r2, &(0x7f00000005c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000500)={0x0}, 0x1, 0x0, 0x0, 0x4000006}, 0x4044040) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x2) [ 1811.983726][ T8883] device wlan1 entered promiscuous mode [ 1811.984515][ T8882] xt_cgroup: xt_cgroup: no path or classid specified [ 1811.997120][ T8885] binder: 8878:8885 ioctl 40086602 400500 returned -22 [ 1812.008444][ T8890] xt_cgroup: xt_cgroup: no path or classid specified [ 1812.014542][ T8893] binder: 8888:8893 ioctl 40086602 400500 returned -22 [ 1812.025763][ T8883] device wlan1 left promiscuous mode 00:40:15 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xba03}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:15 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0x4c}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1812.034420][ T8886] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1812.040514][ T8897] xt_cgroup: xt_cgroup: no path or classid specified [ 1812.088698][ T8898] binder: 8889:8898 unknown command 1455288064 [ 1812.095822][ T8900] binder: BINDER_SET_CONTEXT_MGR already set [ 1812.103010][ T8899] binder: 8875:8899 unknown command 0 [ 1812.115780][ T8898] binder: 8889:8898 ioctl c0306201 20000100 returned -22 [ 1812.127839][ T8900] binder: 8889:8900 ioctl 40046207 0 returned -16 [ 1812.136078][ T8899] binder: 8875:8899 ioctl c0306201 20000200 returned -22 [ 1812.154811][ T8904] binder: 8889:8904 ioctl 40086602 40b301 returned -22 [ 1812.160467][ T8905] xt_cgroup: xt_cgroup: no path or classid specified [ 1812.164096][ T8906] xt_cgroup: xt_cgroup: no path or classid specified 00:40:15 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0x5a}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1812.186121][ T8909] xt_cgroup: xt_cgroup: no path or classid specified [ 1812.190364][ T8904] binder: 8889:8904 unknown command 1455288064 [ 1812.205234][ T8904] binder: 8889:8904 ioctl c0306201 20000100 returned -22 [ 1812.240338][ T8898] binder: BINDER_SET_CONTEXT_MGR already set [ 1812.250142][ T8904] binder: 8889:8904 ioctl 40086602 40b301 returned -22 [ 1812.258107][ T8898] binder: 8889:8898 ioctl 40046207 0 returned -16 00:40:15 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0x5c}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:15 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000180), 0x2, 0x2) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000200)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) fallocate(r1, 0x4, 0x9, 0x3f) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) clone(0xaf1ed68b71866465, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x400, &(0x7f0000000040)="8d85017d62a8a823f20a00223184e9ca4b02ef52305b317e30b1d5b8a55ad81a1b5b9dfc3406bd0d9dedae3b0bcc66", &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)="d274b58f63c052a8f98dcd26ba6df284556a976554a93d09ed57a9bdff6ea0557a8ec0673bc0f6942cec527c8e28b2560a721bb1268d8b7f176e648055fb4273cb303d51eb2308f5") r4 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40086602, 0x40b301) [ 1812.287000][ T8915] xt_cgroup: xt_cgroup: no path or classid specified [ 1812.301542][ T8916] xt_cgroup: xt_cgroup: no path or classid specified [ 1812.318596][ T8919] xt_cgroup: xt_cgroup: no path or classid specified 00:40:15 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0x60}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1812.434373][ T8924] xt_cgroup: xt_cgroup: no path or classid specified [ 1812.439210][ T8923] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:40:15 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0x68}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1812.540627][ T8930] binder: 8920:8930 ioctl 40086602 40b301 returned -22 [ 1812.556625][ T8933] xt_cgroup: xt_cgroup: no path or classid specified [ 1812.576604][ T8937] xt_cgroup: xt_cgroup: no path or classid specified [ 1812.681271][ T8939] xt_cgroup: xt_cgroup: no path or classid specified [ 1812.748031][ T8930] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1812.764850][ T8886] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1812.786971][ T8944] binder: 8920:8944 ioctl 40086602 40b301 returned -22 00:40:16 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x9b) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3000002, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000780)=[{&(0x7f0000000540)=""/165, 0xa5}, {&(0x7f0000000600)=""/201, 0xc9}, {&(0x7f0000000700)=""/59, 0x3b}, {&(0x7f0000000740)=""/34, 0x22}], 0x4, 0x4, 0xe9) ioctl$VHOST_GET_VRING_BASE(r0, 0xc008af12, &(0x7f0000000040)) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x5c, 0x0, &(0x7f0000000400)=[@decrefs, @increfs, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000340)={@fda={0x66646185, 0x6, 0x2, 0x25}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/244, 0xf4, 0x1, 0x11}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/153, 0x99, 0x1, 0x1d}}, &(0x7f00000003c0)={0x0, 0x20, 0x48}}, 0x1000}], 0x54, 0x0, &(0x7f0000000480)="8aaaf6d2b31ac343b68940e07cd1f4a5e8f500f522c43e41caf7c631c5f4904055f68d672c52d2faa8267f7ed8260181d534dcd35d0a4ec0b73d2adaf6c1cdaf21a79b62425f76fb8d72523472f0107c4d0f57cd"}) 00:40:16 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0x6c}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:16 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xc801}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:16 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x0fF\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:16 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x200, &(0x7f0000000200)="e052aa7969bbcfef196d5570b80e2c14102b0eb0e7fcf2c5b40c56734315e60e5f540b5a0987f970b7d72047ad6527bb6344636e84bb024e455d8ee2a2054f3a01dbe61892d548bb0dbdc17fdb3f5d9802f037c3126ec14536b874bcd976111d62b9db948ca02edb15a46c14e68584e2b810bdd9a801c79cc7baa0f91576dbcde6f4772adf098659c9ca134e1548e4d1a5e907d680a2d14998cff55f769f6c691ce9df5caa33eb42e9661f3097896a6852a5c9fba7516c9a2099c7069e9acf459fecc7fc837a7ed2c7c383aa07f3700b6116c92755b0081008e194914e6c21842a27c7881bc83e4458a3bf6d4a44e66b80318cff", &(0x7f0000000140), &(0x7f0000000180), &(0x7f0000000300)="af7ee2c01d28241331646b2e6baac9c3fbf802cb65d46c57c7875f7cee7d5b4b101c399fa4da62c5c57185efc5b99b082e1681f2a5f42baa8290d06c0de582d1631e7eca8436cadebc995f8666e3") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) clone(0x80000000, &(0x7f0000000000)="887014746b305ca7de4cb74b5015ebfd259276bed5a577aa9e3ff02382d50a3f077c095def0390c50c3330dd62d049a48a2692a10bd382f96ad75949eb2ccdb201efec5a5777a6", &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)="d7ef9865b7db67cc5e5b1939568734e94076") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) [ 1812.914257][ T8948] xt_cgroup: xt_cgroup: no path or classid specified [ 1812.929781][ T8955] xt_cgroup: xt_cgroup: no path or classid specified [ 1812.944276][ T8956] xt_cgroup: xt_cgroup: no path or classid specified 00:40:16 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0x74}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:16 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xd401}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1812.965537][ T8959] device wlan1 entered promiscuous mode [ 1812.969895][ T8960] binder: 8950:8960 unknown command 0 [ 1812.989663][ T8960] binder: 8950:8960 ioctl c0306201 20000200 returned -22 [ 1813.034620][ T8959] device wlan1 left promiscuous mode [ 1813.035116][ T8964] binder: 8950:8964 unknown command 0 [ 1813.080922][ T8962] binder: 8965:8962 ioctl 40086602 40b301 returned -22 [ 1813.111067][ T8975] xt_cgroup: xt_cgroup: no path or classid specified [ 1813.118160][ T8964] binder: 8950:8964 ioctl c0306201 20000200 returned -22 00:40:16 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x10900, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) [ 1813.120114][ T8979] xt_cgroup: xt_cgroup: no path or classid specified [ 1813.143627][ T8981] xt_cgroup: xt_cgroup: no path or classid specified 00:40:16 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0x7a}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1813.249654][ T8991] xt_cgroup: xt_cgroup: no path or classid specified [ 1813.276810][ T8995] xt_cgroup: xt_cgroup: no path or classid specified [ 1813.287047][ T8996] binder: 8990:8996 ioctl 40086602 40b301 returned -22 00:40:16 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0x8e}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1813.326959][ T8999] binder: 8997:8999 ioctl 40086602 40b301 returned -22 00:40:16 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000005c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000500)={0x0}, 0x1, 0x0, 0x0, 0x4000006}, 0x4044040) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=@newnexthop={0x80, 0x68, 0x4, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x4, 0x0, 0x4}, [@NHA_GROUP_TYPE={0x6}, @NHA_BLACKHOLE={0x4}, @NHA_GROUP={0x44, 0x2, [{0x1, 0x1f}, {0x0, 0x6}, {0x2, 0xee}, {0x0, 0x98}, {0x1, 0x7}, {0x1, 0x2}, {0x0, 0x7e}, {}]}, @NHA_ENCAP={0x14, 0x8, 0x0, 0x1, @MPLS_IPTUNNEL_DST={0x10, 0x1, [{0x7f}, {0x9df2}, {0x3, 0x0, 0x1}]}}, @NHA_FDB={0x4}]}, 0x80}, 0x1, 0x0, 0x0, 0x4048804}, 0x8084) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40086602, 0x40b301) 00:40:16 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {0xda}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1813.388337][ T9001] xt_cgroup: xt_cgroup: no path or classid specified [ 1813.410736][ T9004] xt_cgroup: xt_cgroup: no path or classid specified [ 1813.469688][ T9006] binder: 9005:9006 ioctl 40086602 40b301 returned -22 [ 1813.500654][ T9008] binder: 9007:9008 ioctl 40086602 40b301 returned -22 00:40:16 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x800) timerfd_create(0x1, 0x800) r1 = syz_io_uring_setup(0x4c8f, &(0x7f0000000080)={0x0, 0x348c, 0x2, 0x1, 0x11d}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000100), &(0x7f0000000140)) r2 = signalfd(r1, &(0x7f0000000040), 0x8) r3 = pidfd_getfd(r2, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40086602, 0x40b301) [ 1813.526889][ T9012] xt_cgroup: xt_cgroup: no path or classid specified [ 1813.551538][ T9015] xt_cgroup: xt_cgroup: no path or classid specified 00:40:16 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x2}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:16 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3000002, 0x12, r0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r6, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) preadv(r4, &(0x7f0000000340)=[{&(0x7f0000000440)=""/145, 0x91}, {&(0x7f0000000140)=""/189, 0xbd}, {&(0x7f0000000240)=""/132, 0x84}, {&(0x7f00000005c0)=""/252, 0xfc}], 0x4, 0xd9f, 0x0) r7 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1813.690567][ T9024] xt_ecn: cannot match TCP bits for non-tcp packets [ 1813.705606][ T9028] xt_ecn: cannot match TCP bits for non-tcp packets [ 1813.730979][ T9030] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1813.795135][ T9031] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1813.836661][ T9030] binder: 9025:9030 unknown command 0 [ 1813.862117][ T9030] binder: 9025:9030 ioctl c0306201 20000200 returned -22 00:40:17 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x4}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:17 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x10F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:17 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xda00}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:17 executing program 3: r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40086602, 0x40b301) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) getsockname$packet(r4, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14) sendmsg$nl_route_sched(r4, &(0x7f00000005c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000500)={0x0}, 0x1, 0x0, 0x0, 0x4000006}, 0x4044040) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r7, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) syz_kvm_setup_cpu$x86(r4, r0, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000080)="ba610066b80b00010066ef660f3a44c62a0f01d1dcf2c30f01cf6800a066b8003000000f23c80f21f86635000030000f23f80f20c06635080000000f22c066b80500000066b9007000000f01c1", 0x4d}], 0x1, 0x10, &(0x7f0000000140), 0x0) poll(&(0x7f0000000040)=[{r2, 0x100}, {r5, 0x2002}, {r8, 0x408}], 0x3, 0x9) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) [ 1813.881452][ T9030] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1813.891287][ T9031] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1813.907218][ T9033] binder: 9025:9033 unknown command 0 [ 1813.913356][ T9033] binder: 9025:9033 ioctl c0306201 20000200 returned -22 00:40:17 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3000002, 0x12, r0, 0x0) ioctl$F2FS_IOC_ABORT_VOLATILE_WRITE(r0, 0xf505, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1813.972908][ T9036] xt_ecn: cannot match TCP bits for non-tcp packets [ 1813.992735][ T9044] xt_ecn: cannot match TCP bits for non-tcp packets [ 1813.992992][ T9042] binder: 9038:9042 ioctl 40086602 40b301 returned -22 [ 1814.015853][ T9045] xt_cgroup: xt_cgroup: no path or classid specified 00:40:17 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xfa03}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:17 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x5}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1814.029079][ T9047] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1814.044840][ T9050] device wlan1 entered promiscuous mode [ 1814.067635][ T9042] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1814.086655][ T9050] device wlan1 left promiscuous mode [ 1814.119228][ T9054] binder: 9052:9054 unknown command 0 [ 1814.131281][ T9047] binder: BINDER_SET_CONTEXT_MGR already set [ 1814.146163][ T9058] xt_ecn: cannot match TCP bits for non-tcp packets [ 1814.146485][ T9059] xt_cgroup: xt_cgroup: no path or classid specified [ 1814.157537][ T9054] binder: 9052:9054 ioctl c0306201 20000200 returned -22 00:40:17 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x7}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1814.164569][ T9047] binder: 9038:9047 ioctl 40046207 0 returned -16 [ 1814.180726][ T9062] xt_ecn: cannot match TCP bits for non-tcp packets [ 1814.232650][ T9047] binder: 9038:9047 ioctl 40086602 40b301 returned -22 [ 1814.250303][ T9069] xt_cgroup: xt_cgroup: no path or classid specified 00:40:17 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x8}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1814.314805][ T9071] xt_ecn: cannot match TCP bits for non-tcp packets 00:40:17 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3000002, 0x12, r0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0x8000, 0x10080) mmap(&(0x7f0000315000/0x2000)=nil, 0x2000, 0x0, 0x810, r1, 0xc63c3000) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 1814.392888][ T9075] binder: BINDER_SET_CONTEXT_MGR already set [ 1814.409208][ T9075] binder: 9038:9075 ioctl 40046207 0 returned -16 00:40:17 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x9}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1814.448232][ T9078] xt_ecn: cannot match TCP bits for non-tcp packets [ 1814.467908][ T9079] binder: 9077:9079 unknown command 0 [ 1814.505622][ T9079] binder: 9077:9079 ioctl c0306201 20000200 returned -22 [ 1814.537476][ T9084] binder: 9077:9084 unknown command 0 00:40:17 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x1d}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1814.556467][ T9084] binder: 9077:9084 ioctl c0306201 20000200 returned -22 [ 1814.573264][ T9086] xt_ecn: cannot match TCP bits for non-tcp packets [ 1814.596025][ T9090] xt_ecn: cannot match TCP bits for non-tcp packets 00:40:17 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000000080)=0x1) mmap(&(0x7f00005da000/0x4000)=nil, 0x4000, 0x2000000, 0x11, r1, 0xdbc87000) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3000002, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:40:18 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12%F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:18 executing program 3: ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(0xffffffffffffffff, 0x8008f512, &(0x7f0000000000)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000080)={0x10001, 0x1, 0x9}) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000040)={0x6, 'vlan0\x00', {0x1}, 0xff39}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40086602, 0x40b301) 00:40:18 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xfc03}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:18 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x4a}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1814.782605][ T9094] binder: 9092:9094 unknown command 0 [ 1814.812805][ T9094] binder: 9092:9094 ioctl c0306201 20000200 returned -22 00:40:18 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x406}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1814.877564][ T9104] binder: 9101:9104 ioctl 40086602 40b301 returned -22 [ 1814.891247][ T9103] device wlan1 entered promiscuous mode [ 1814.927376][ T9110] xt_cgroup: xt_cgroup: no path or classid specified [ 1814.936732][ T9103] device wlan1 left promiscuous mode 00:40:18 executing program 3: clone(0xfa8b4ea8c937696a, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) 00:40:18 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3000002, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 00:40:18 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x40000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1815.054385][ T9123] binder: 9120:9123 ioctl 40086602 40b301 returned -22 00:40:18 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x446}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1815.118576][ T9129] binder: 9125:9129 unknown command 0 [ 1815.129196][ T9130] binder: 9120:9130 ioctl 40086602 40b301 returned -22 [ 1815.151208][ T9131] xt_cgroup: xt_cgroup: no path or classid specified [ 1815.158387][ T9129] binder: 9125:9129 ioctl c0306201 20000200 returned -22 00:40:18 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x4b6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:18 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x1000400, &(0x7f00000002c0)="7b60eb672b01b2a000d6ba98a51df0bca81bb5357ab1a8959f21f47c7770de020e2b0ef484055fe055285e50000ca9624a4402982e5e51bc74b7e43d049da0fbc2794764d0a42f664cdbd45f74e0574372624d84d932", &(0x7f0000000100), &(0x7f0000000340), &(0x7f0000000380)="e000008dd7657417f021884eddaa372196e7fcf89a3fe3052459f69194b145d398fcd9a5c75c218d") clone(0x84300080, &(0x7f0000000780)="790306cd78b437e39850a3746f17e05499a5304385b3cf3439dc8ff8ebb131cbf6698cc53502303490f905074aabb13f30577cc694f0538cdf1295d51b6b67c1550be720e208fc97b2fe7be9b3458f07429dd1391055042b572b73da7953565831ac08cccf6dc17c92884088df5bcf914e2fa6a85f76e1feb1b3bbd5840f6b158377646ad9422a8befd7416a1aa21addc559c0584892472dd63acd282961eba4536c13a414b2670bc608b1d60932d873e7a31d4bf434ab41567429a7e64dfaa469892baf6e99e3b407f632783936e12cf85f27e1efcab35738d042d071ce1a3f381c6a106f3a0226e093a8f4810081000000000000201276d1928bd2266467458ab902638be9df0e9139f568ea12ee5c17fad5c34c3c25f75582933dc0b787789ee6def67178c45ba934f84c650eb1061f322f92b1d914e9ab1047a1bb90257e78e1d632c6aabeb3d7d3b0664b636d3d1a7c87756a9e871a4a", &(0x7f0000000280), &(0x7f0000000500), &(0x7f0000000540)="40dfd587380295d38ab8a19286320f530d1e19ef4acff3a51c64ec85aa75f6e59ef8be762ea490c7e09f5d7ac78d67ba8c83ae9f732c6934f6d4eeabd024a4e99ed8d687208caceb70f417539ef1a055a30e9fdcd5305fbefd7f3337a2d45427d0a71cc707c7fca7795982ce2dbac56ca2b6e09d2b67acce2c8883ff6f8147c514ac6fe52b634cff93112f3ac94abee830d886802d36c3b9e6d7c23578beb2b6b9d48494131dbbd4e78584fff20b18e527b08c7c4ef246708a644bee0dd6ed150230c1675f791f3bcc398d0d01b3e72bd850") clone(0x20000000, &(0x7f0000000000)="663c9e66c435008a28368642d9a0315e152aa976211e654323af742aa7b2c7bc641cb13d63f611769b15632fa0f773ef7733efae559b045fba56f20d470bdddc90dddb003185610fe3bc43869a274643d4ba9876583168bf72c93f9b5860b7504eb2f41044186fa6cb031199bc39a0719365d29bf5b476c02a9c70d0632430e9bdeafb4edefa06335c333ce9c536346ceec6157ed5106b5d87b4a58721c4916ca1f4b3274e8956909ddf5ba45314b1e31caa66a49bf4df38ead382edf9aa4636e6f926e0d5724d1f0c7438c66f634b9c77fead13f65324a8979759da1d9841ab5239d9c8d3172fac807d391768fa42788648717b84738c29f1b6", &(0x7f0000000180), &(0x7f0000000140), &(0x7f00000003c0)="d663a6f3d52fc38745ac1ff8782bcf27be34529f1aaff6aca8c3cb9defce05aeae17e901f110f598f540638fcbf00941ac6e710d8417e1e1c137880f094f26eab1d717140708ec465be49a300ed8cfc30cfb2ed425994fde659b4425dc77b475aedecc3fa1d627818d8f5211881e5d695ea90789b97b9607498a5378fdafc0a9b99f1c48d7afeee1463ba43a105fc828049e2d70f3c929499995985a99d9069b2187fe7da9138ad819ce7a5b44edb08c0ca25eed8219f423af21ed8eca9d7246aeeb01007b3e5b0df41cfbce0ccd8686ea6550196de98310976164eef1b81dcfea747bdf9b2f1a4ff66ca2b0b960cda4207caba739de2e1ce90443d5aa21c36b4530fb50268c8281e9ca945d9822fd9f61ba84") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x1002) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) clone(0x100800, &(0x7f0000000640)="9c76e3369d9f2d48677003e38e81774e50f4159d3f68bccaa202c185343a285867c59262345660cf77f1fedaefceb6ce73a6cfe3e981c996255f7f47d7476388e0684e3ff66b87a73174738eb28297fe710550034c44997e4345", &(0x7f00000006c0), &(0x7f0000000700), &(0x7f0000000740)="fab81a1ac103774c99533d990c4ef9c415eb291e311ee01953192ffc62982a9aabe1fde545e8e58351") 00:40:18 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x1d}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:18 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12=F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:18 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x7, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv4_delroute={0x64, 0x19, 0x300, 0x70bd29, 0x25dfdbfe, {0x2, 0x10, 0x80, 0x9, 0x0, 0x0, 0xfe, 0x8, 0x300}, [@RTA_OIF={0x8}, @RTA_OIF={0x8}, @RTA_METRICS={0x26, 0x8, 0x0, 0x1, "6038a868df74906c766610f4cbd72d6ebb627f23a59c009a409a8884717fa8c52b04"}, @RTA_IIF={0x8}, @RTA_GATEWAY={0x8, 0x5, @multicast2}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x10200, 0x0) sendfile(r1, r2, &(0x7f0000000140)=0x1, 0x401) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r3 = openat$cgroup_ro(r1, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000340)={0x3c, 0x0, &(0x7f0000000280)=[@release={0x40046306, 0x3}, @enter_looper, @increfs_done, @acquire_done={0x40106309, 0x1}, @increfs={0x40046304, 0x1}], 0x7b, 0x0, &(0x7f00000002c0)="e8f6a5ea858e0934034d6ff45d25f4976052550c7894ff2525c27d7ab48ce8a4f48c225c68bbfff4402a13368c6a43f8dad46df43a36e5424929f155c519d3b9f6335b14493312065c25360cfc0ecb92bbd83f652267146c8f917320fdb8539f67c5317572e5711d25ddb08db2da2131f98619c6f00745557e0add"}) 00:40:18 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x7a00}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:18 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x55e}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:18 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x1000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:19 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x02F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:19 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x2000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:19 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) [ 1815.744257][ T9160] binder: 9157:9160 ioctl 40086602 40b301 returned -22 [ 1815.760603][ T9163] xt_cgroup: xt_cgroup: no path or classid specified [ 1815.767189][ T9161] xt_cgroup: xt_cgroup: no path or classid specified [ 1815.785878][ T9172] binder: 9162:9172 ioctl 40086602 40b301 returned -22 00:40:19 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x566}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1815.845871][ T9175] device wlan1 entered promiscuous mode [ 1815.879709][ T9175] device wlan1 left promiscuous mode 00:40:19 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x800) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x7, 0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000300), 0x311440, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000340)=[@enter_looper, @request_death={0x400c630e, 0x3}], 0x3e, 0x0, &(0x7f0000000380)="62774c4b43de72269051889019ffcc8c798b13ae7b00ea22ac96f499ffaf22933af26031cce05865f32bb73e8fee5bc67c0f406f8bbaf9f43bfb57ec4fdf"}) sendmsg$nl_route(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000240)=@ipv4_delroute={0x68, 0x19, 0x300, 0x70bd29, 0x25dffbfe, {0x2, 0x10, 0x80, 0x9, 0x0, 0x0, 0xfe, 0x8, 0x300}, [@RTA_DST={0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, @RTA_OIF={0x8}, @RTA_METRICS={0x29, 0x8, 0x0, 0x1, "6038a868df74906c7618a6c46610f4cbd72d6ebb62ff23a59c009a409a8884717fa8c52b04"}, @RTA_IIF={0x8}, @RTA_GATEWAY={0x8, 0x5, @multicast2}]}, 0x68}}, 0x20040004) r3 = signalfd(r0, &(0x7f00000000c0)={[0x7]}, 0x8) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x9, 0x0, &(0x7f0000000140)="f4c8db0cc0cb8ca384"}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40086602, 0x40b301) [ 1815.908447][ T9181] binder: 9177:9181 ioctl 40086602 40b301 returned -22 [ 1815.917276][ T9183] xt_cgroup: xt_cgroup: no path or classid specified [ 1815.937327][ T9186] binder: 9184:9186 ioctl 40086602 40b301 returned -22 [ 1815.999735][ T9197] xt_cgroup: xt_cgroup: no path or classid specified 00:40:19 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x786}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:19 executing program 3: r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000080)) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ptrace$setopts(0x4200, 0x0, 0x8, 0x26) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x800) 00:40:19 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9\x00 \xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:19 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) write$binfmt_misc(r1, &(0x7f00000000c0)={'syz0', "dc992c801c0fea25e0627a21ce81caff03b41a3f88d1a97a094320772df39dea1149200710e354a3342ae8c54f667b0a6d9595418387f990a335736e0255fff40bd30616b94b144b0a41b63252545381695fb54aec0ecdafed0e31402b276492248a6c9a9a2aa2b4466edb33e8990cc8db843e0204f54d55e8cf9b5e694c549adda376f0850cc6aeb273061597352ac58938a6150000"}, 0x9a) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x8c000, 0x0) splice(r2, &(0x7f0000000040)=0x2, r1, &(0x7f0000000080)=0x7, 0x9, 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) 00:40:19 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x7a6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1816.433606][ T9182] device wlan1 left promiscuous mode [ 1816.491022][ T9215] binder: 9214:9215 ioctl 40086602 40b301 returned -22 [ 1816.509059][ T9217] binder: 9217:9217 ioctl 40086602 40b301 returned -22 00:40:19 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x7ee}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:19 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x80200000, &(0x7f0000000240)="9f59afce9c5bd53e45d0ab57f17c8d5b8178d852765d8abc80c89f7283b57efadd26986842228328039c0644090c17e90f261836385d158177db8077855cd318ef70434b96e4f0dfe92eca8439ca2074fdc24b0e1e154af8be55db69d486362db238bdc06eebc35f055508b64093ee602d1124f110ffe0f1335e4171e9d3971bb5fbb0c20b74cb5b18735d5ae40a", &(0x7f0000000000), &(0x7f0000000140), &(0x7f0000000300)="8710b715af498118e6890fcba2afc6027c24f6876e6448f9172cf59b8dccf5e04034d9588c2ca6da88bc416354e528c98fc52100c48e4c514272724972c62546b9e7ed23e112b422bb79df00398249fb82d73fc9852ffebd33215756ca84f84153fa4ede22c3635e5750e30391a48cc1f2f2014b4cdd4ff4b178a57a2d3e7f6dbc874506b0700d6cd3f1537d3f9a87ca3459feb66581fbc3a0b9b92b8da63e0f4b10e369825185184ccbb9744f4969b1ba5a8ab71b174846410c3c4b6fe6b417dd25988ecf876a07da02b05136bc41f12bbbf014ede71f1ae73a6619514e8752") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x7, 0x0) clone(0x242c6000, &(0x7f0000000400)="909e1e0561b085ae7c1e238c3940f8d1e3c2d0c3abe741839e34e448b6bfafbfe46cca17e25d488da724f3154ae329d30c71157a93b90456af8bc4422c8c180e4adc976c8ee8faceeb5386f751ac2b1de0bbe4e02bac93517f23e6ae842d398c428a27be7ec3bdd3e04e01c89f8533fd5f6027350bd305b5f858578a63c01c0c3a8427378ecde21c8da962c48c45369c55008598df66ee88daf2ffd61b9f30af1988982862feeee84b7284968e1c1134184bc8a8f63fc5b6c085caebc89583b339fad6d4a032c2f8568f0cd3ae9493678945ad94b687929d9cb861f678e6f095d47a51c5c427187768", &(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)="4f7d47f4dfc24ddf3e9b21167f28ddde6edb0945d15ff9797ac675fe8b5cf6a6db1bffda97dc5b3c195a34b34c") sendmsg$nl_route(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="640000001900000329bd7000fedbdf25021080090000fe080003000008000400a722d618b49d81178d951159dbb1c0bec55efe7623cf32613e3fa911faa53448d7cd2e", @ANYRES32=0x0, @ANYBLOB="00040000", @ANYRES32=0x0, @ANYBLOB="260008806038a868df74906c766610f4cbd72d6ebb627f23a59c009a409a8884717fa8c52b04000008000300", @ANYRES32=0x0, @ANYBLOB="08000500e0000002"], 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) clone(0x900, &(0x7f0000000680)="deb7f535be54285014682a482925c4bf461ab1b2a4646e6d669a165465584b7a1543a3e7f16815f91e6024b5815d16772741cb1eb0a97a03f95d663aebb0885bfc8de2e50e88c70ddb1f85b4979d9a10df30bc84ce5df32bfdf7ab5c8cc1563ecc4e032923500e03356497a5f8ebf13d5c3ab2096a35510af840aa47e10c06b44cd4cfa6", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000740)="3fab2e907a274b56c8450835873100783efda34add73e331dc0545b9b9e7aa07fe0ff70a94204ad76d8565ddf5bc9373981458ca01537d77c735489de7d2970c13c87efc752453c04e049a5e18aaf7907ecf42aa87103c94586fa9299ec5901e0938bdc58ce8") [ 1816.772274][ T9230] binder: 9234:9230 ioctl 40086602 40b301 returned -22 [ 1816.929225][ T9191] device wlan1 entered promiscuous mode [ 1816.938028][ T9226] device wlan1 entered promiscuous mode [ 1816.959809][ T9225] device wlan1 left promiscuous mode 00:40:20 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x02F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:20 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0xffff}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:20 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x3000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:20 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0xc02) syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) 00:40:20 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1817.063812][ T9245] xt_cgroup: xt_cgroup: no path or classid specified 00:40:20 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x4224000, &(0x7f0000000000)="39c5be56b5739461cbee00f5cfa70636d04ae0cfa2584efb61a8f68e4a6db48b8cfaaa0c839ae3dc314f5bdcbaa87e058e12c10c22447d814ead7e72e2449369c3ff78f28fa877d6781b0c85fdcc869c032809291ac389b83a31293ff81d9df49f4211f18c1ce9248b9bf67e5ec1bf2aaacd8afeefd90a27771de2b334bb448acdecc0f0893bbc432314e319392f281c81e04731ddb26be7704f84f93762c9a8836e", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)="05bff27e246c") r0 = syz_open_dev$binderN(&(0x7f0000000180), 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) 00:40:20 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x2}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1817.151257][ T9257] binder: 9252:9257 ioctl 40086602 40b301 returned -22 [ 1817.158678][ T9261] xt_cgroup: xt_cgroup: no path or classid specified [ 1817.176306][ T9262] xt_cgroup: xt_cgroup: no path or classid specified [ 1817.188254][ T9268] xt_cgroup: xt_cgroup: no path or classid specified [ 1817.286336][ T9273] xt_cgroup: xt_cgroup: no path or classid specified [ 1817.300178][ T9272] binder: 9272:9272 ioctl 40086602 40b301 returned -22 [ 1817.312981][ T9278] xt_cgroup: xt_cgroup: no path or classid specified [ 1817.537623][ T9248] device wlan1 left promiscuous mode 00:40:20 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U%\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:20 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x3}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:20 executing program 3: clone(0x3a3dd4008a84af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) 00:40:20 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x4}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1817.644911][ T9285] xt_cgroup: xt_cgroup: no path or classid specified [ 1817.655865][ T9286] binder: 9283:9286 ioctl 40086602 40b301 returned -22 [ 1817.666488][ T9290] xt_cgroup: xt_cgroup: no path or classid specified 00:40:21 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x5}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1817.741035][ T9294] xt_cgroup: xt_cgroup: no path or classid specified [ 1817.759699][ T9297] xt_cgroup: xt_cgroup: no path or classid specified [ 1817.855903][ T9300] xt_cgroup: xt_cgroup: no path or classid specified [ 1817.865850][ T9303] xt_cgroup: xt_cgroup: no path or classid specified [ 1817.936863][ T9258] device wlan1 entered promiscuous mode [ 1817.944905][ T9298] device wlan1 entered promiscuous mode [ 1817.963905][ T9291] device wlan1 left promiscuous mode 00:40:21 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x02F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:21 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) clone(0x20000, &(0x7f00000000c0)="57174eaec31fef5b1a702a154f2cd47a9932f11ec3440b10a576b788ead72a50770a19429db6096020ef987d4702d3114f6ed35f13d5d77b06d829aaef4a7ba01cfb0ee713cac6a77f2aed6fccb488f2028b005e66f7a3b50d0e4e3a2daf86975c176f84238a4d76cd3131e90b9845feaa76a3fa2116e0c2a33377597ae8ad589d9125a1e4", &(0x7f0000000180), &(0x7f0000001200), &(0x7f0000001240)="a773d66e70760eb453c64e3e4622b5035b0575d3422204299aef2915fa717f0715c63e2e47bb7ca08695fe980bedfe9f962ca9236c648b66dc2acf0459eaca250986e1b395e364552aeb19fb398f46b5c4aff6f53ecfb405fd4ac65f8138f8af3a864d676af7542e9380252ecfcedb007725ae502d2325e956cd44e65abbdd500abab6f1ab92f3d950f70938b3f3aa5df147942633d50b2d1a58ddef72758a9179") clone(0x82000, &(0x7f0000000000)="a61b82abc2834c6ba13639924e", &(0x7f0000000040), &(0x7f0000000080), &(0x7f0000000200)="dc29f55da61eb69a88e838f82dd96989522a7a04b24e25bd6f858f70dda73055f8d56231be23220a94f5d61abd4e0076af80a07f75cda5c15450e79e481cb9d826d4bad1f623a80a46ddbd344efe8ed803893722d16ead61827766cb9a0a80186032655b08b432ed51f6f4b505947ae2ddb77fc1076b76429cb3874444766fd479a27e86fd63b963885a012af13d0e5f71d52efaaec59c9f3bc938947f89df60974debd7ca744f8183c52cc8685e62b3d41d7f2446e4baa0a94081a0b45578b5ae597d3e780a6bcbb2e97e4a6911cfa8a77325e18b5b69af3e23029a1649c3a7123a8d75a7d0465bf85d8c3db630055f24fc8ced33df3381fe2fee9e9311a45ae0997549c5d8fac2ae72a612eb269ef61738158772c50aa172127eb7fa2f16bf28b2d1df3cfdd73624cf28c8359bfde5c98c362d1fbf18f2b19b2ba6659e1ea2cefd7b02286b5cef2f08db7499f2293d730ab1eb20510062b2c4e34b47100bb01d800a86d050e18fa615e129ca13fc10c1d709de77153930b9d893f8de0ebd94a56770b9f230ab6f5f3aa826875668fbf063c60a22f3e218244884acf87b3cfd387bfca6179178d05a7f5406803f7a689b54910febad8e88b0ace2ada8b08f40664004f074cadef10273e9050fc8db9d84b55f3d30f62ed83c6a8570b6c63d7560ebfcdf6b456b5db767fa28854c7ea81f96dfaeeaf8a112d513dff70161ab35142e07503d9fadbb94192f7e145b3c052d5559bbd400c1ef1d125c43321149de8abe1dc92662037d42e23aad46db620f9a96706c7071400ba317f12140c7a956c46072a6fc4424a467528d53b40bb9a14e9181c76dc9a295827dca6db5e070056669675709d6eb884beabc1025b0995dda9785bdd5f60d50153586bed0fa68f4e52308c8019a20ce2590f35047de856d1446e6e68797f2ffbf47d9f043402f8ed0aa34bc2ecafd28f6e27dd3ab86534087709ecd15c5f3fa48c04bee100158da9b01b09ac31e9ae07fa561e74122926df8e5010b5beb0c7aa589b72e7c7f9d5540033b5ca0ea59b7323e9576aec426af4a8fe5aba408e4a627effb79b265ac16f60b6da9233a7924d801dc47566414805294524e35f73f57fb15b9e3d48d11ea5faa94d1c53fcb74d99b5cc65502b9f152b0a0a8248f1241a1447d51f70a837549280b183db7cc38693054a7514526ce52514da5852fc522d456f020645866993ac4db46a0688b50072890b59453d6883e7cf0d91d14785e9ac9a2b6403b6fc20fac77c1bbac2d31203dfdbc5acee031811c512887198cd269503758ee6680536a8f480e51e38721089bbb72e36d7ea3988296550e2e2db0edd92ec4e4b63771c092f66e1df655991029e915010c1219b2a5df27affd4e54b8129e3ff5ffb737d4699ff33c065a6cb54db03f84e47a8db8060d5d5083037e00b7eb8df1eac25f2a4635fc3c1dd93f267bf57cb92ccd486b881a5957b1c229d0baae84f8e5a47bc05784c61813e942cbe41bc9acb02b95a0bfe8c5c8f31708de5f0c128d93771adc4e8f0bee8fecc9a99b6c039d76b2a20b29d6f610dfcaa14c48285608fd7b3bfc5aa18b4433eb593b03d5047ca05e93ef937faf466258a963646cc3c6de3260475c45163c2091ba41d577e992a34b0a588019e833fbb8d149115f3e830325a591f3c24e6dabbef324f7a4eb63a707cee5ec57b6d8f478099fd20870525473e40c00da9f2bfab6799aaaea53747e131208464fcc652b476ace97e7ba106a01f73cbb6de0c1d0cb73e4ab62e51e7a6ccb7ebb4f268b2e0619b38e3ef47fb4734b38ecc23c284eabf9617d8b9614452a49cfc8144ac1301821ff7169067d110769491c22de77f29142cf32a1f0a78a529c61c263e0b1258e8ecc8213984849056b98dc1c88af22ab4a4673d5bad7b342c1aac1fa3413d23613b9a5151f684a8da9ad79d3fa308903a2a228907eba1d7dcecf4ea8d682848be76ff5e7aa928d8bbe3e836544ef12d63145c02ac1c580cf8410e70469a54f6233febe276ff3151895326499579fff3421019db9b084aad278f6df98487d33cd924a14180844ca404293c032f71e644580322f889dc428dcb161fcdaf7b3a45851423d612a8fe34023be80080b79925d68a8cc544289f19b82138ee4f4fa4ea235c41b03504b9eced75ac6c9a00a13500eb46e002161fd570bcece41d06a56fe99d28f416f4c4bb6ebdbc637324117c9294ae9876b128f2aba0e2943d2dbc54649546d7297ef5fc2270500b69fe70b9243dc7dc2977cc3d7bd71a63a6c0bb2a0ab023200c7a59a136c08e0be3651ed115c8faf21ce4b3692f931c8d22babf3b3d45c51ad89635e983e255414c1ea6cc756cc8bbe935abd222b7e26482d38061bb59151d2b7543c9babd3a0f3f2f992180cce6bc1c5e5a6b824bf095aaa3669a1816a29f3c2adffe5ced2986bdd7c698c08961f1994a9a35d2fd5126f7959760da8e59ef34e7bf789230da6131718455e9927ba27f4cddbee99a3d8683b073163a679070ad846ae962d75d6dc51a0b842c62d680767f8526db3c3b27da295831cefe1bddf5275d5e2630ca86d6dcb20cf9943bce3b5ed5f5dbf322b939c5d888198c032a497d5148767757b0905a2a7392bf5b65290125b2a40e2552741ceed2545d11a72424bf00f0faa34e262bab7ab02288dc8140dd0e3e3351c2b80666a0e11cef8b59fe0539fdc1554a64a1d3c358207fd415513b6fbfa008935c6e778fb93d9df2307dd6028bb089aaff74fe3516228660caa6b96fd466dcdd407c530a6d2b1e38a290f7350669d92038a343a0b43a9fba7aee02bcdb41d7a6fed620850fcfe7dc9ab2234629cb33b565f8c30a852680f5fb8cf4a7b9a0b1210b9667a785d584e291a0ae57020fd3d2f073a3b53644333b88f8218268d0d0e1f5a846e4b8cdb45714c3138950073f5a99b06da034e1f695ba47b52864460e6a02111237112d6a4e672992e831c3f3a360c2ebaf02a6414742d8971969bf55970045345dcfd47f9079e2fe0328507acf631541ffcdab4d23cd440a3fbdddeec054cb8b9517e9169fd1460c4bcbfaa6c4f6c97309359fa5564c82f0a0dad0558278110648689ef7a9530b4d5dd01fab6291cd279bbd7109b76a0cbb41d9a614207bbaaf08f5394292eb1447e0306262b0425f4d68d3581d2b2d660a26c812f70bdae7ee70f689456840b0d7869f309323b595a295f1c88bc1123694560e0c2fc688f66a7e539a43bc7b3f46bf64f3afe050a4b7f8747c919130fc1c209302957e76671dbbdbe8e37f6668e68e7f82578ec9cc31177e1abf5d91aef8f686a13e36f03121382e9ec12b8d69b047694ea73fdb86770bd99ccfd99b44d87c727f4a8753d3e92616a316fecbbdb1f9f0c72d2ab10bd950c09664e60fff19d94f537844e8bb5710edd979425b1a9220608854c5ad06d8752943a741feb74be83eeeb3d09adf518c8548b9eed39dcb77282280f5eca2949907c40420aa78bde16c05622f7f70af7bf8df282ddc290dac4c8cf43a4c27255f2b7e15c3e3b822861382351ab6b8f02e75b2e3772922aff7e81d6d5badbebb46a1665d6ab98c20973697d3ef823d255bc38fbacc4ee849200687b72f3b873b7090ea0b0e5334af2b1631d0e05ca3af151382a544323821129a7c22ce21ca07d1f66b936e6d6915c1d047395664ea4130e755f75a1fc4f512b1ca66a43fc34ba66eaf84ccb8721179f81a7fb2c6333dfce15e7f618a399bea7c46424afb07991f6a59ee9fe6fd302acac1b922c307e0822e74ed79a9238869e08ebe1205465b9bf2e46f238a003306766ee256e6cf4df9a293921e7b819f7dac32822493767e6432c6900cc76aa735268dc9813b20f0547d77547e03a87be641d6c4c544c1707d1735f2e561e658cb7a3b4d5905d7bc4d48421de719eff3ee80ba572be429b235be2b09200a29d37ac83dafd57ca3f713d5a90fb06606d9f0a6d20a65bcb9c8d2ccdd4714c8fa3a12c62ab832d9ea9020a9d37ce622ab24df9d78e2234faa1c727d30bdd2aa3c5ef92581880db6004afe5b4bd3e41f34ffb502636afeec078042f963270990a41b032ee180ff9a9a319f40a26c0ffc0f21867d97fac0577e2ba26972ffb05d965a3eed11b4c8a218b364f85dc944f8cd7bafbd225072eef41f6e9cddc28f28a21a0f0b1eb5be53268e7a2ac41fec9d3a579c551daecded5dcb2786626d2d5343fe01ecf6b9d6087c9c951749c55bba8964980c53a88a9d0481b0fad25d546d1d71cb49ba2bad709bd25e4690784e000416c943def0ea5fde5cd580ef840c9e65c832cd349ae1fb45b6477e7819ecbdd590fbad59239c88014cfee7e9d9ba2923e8360618f189e65c25b1a1e50b234dd69686afca54f45a0f49cbaebfa750ae45213851c293a8ec4fc8923550b7d6f54a34371692ed25bc6156ec64b8a69d603fcc265cd652fd2c015353c2a42f65f1d9c4119ae600cc76c60ad2794bb0cf349b3a47b84e88577406934f251eb721e88ea8f4bb1fdfe682b9eab9d09bbc36ae1e9f4be6f678c56d302506b48427d2441db4cbc971b2f5719edced29bf80d86ebea44fb6c4d064f11b4aac75f5c3f756ff3e7a583f31b4dda19c06eef5e9ac58faa42f69c5766b828d96a035e85c0677e5775249f7cc20f3dc27d542b5c3f24e430a8d383635d7a9adc7ff69230dff8e3de374654f693e6879a9e91e0e84d147651ac77976ea6ebd7865ba763c57dd62a51a2a1ccaee464b56c94cf7a4da7d09a6a210b1fd136adc164c820dcca6b140a233b1f2b8ee87c2ae8586bd3e70b200c8c4fc64c67859d9b3853c9574691c944a307308573c0fa6e4e4202119c8f8502bfc9a3c4318daa716e6b4b5f631d36a597ac7b0aa71d7f18089007fe2e1616e4787de86332d85f6cda835f5b48fdb6b9dc391bf51e564cced731e69db9dc8866f10e3ad5a614d8fb33e1d9f85bf8cd7903511e7b19527e32cbdb42f75b6218db13e2b8c1cf7d3cd91169464b84ae279c4aa6141ca38555fa1ec238e087774a891f482710fb61f47724642a962a2513ca5ef5f9ad6f4133574c55e61d65051438c3fd06b2f2561aaf50ec132d36a4f6aac0d171b21f177733f39509cd380c4fad46053e438786ed22db51fdd7fe2da71207ff5efa2d7734928ebdd7191c9352718d4f0f69d9ad9cd88e5f40ed72b2e9791b462459852f05b26b26d166f3e82308c80468c09d1126bdca696053c4d16def6a29c54914762d9e0d295745d56d0289b91dc8a54536e17ca12be6137b9d6ab927e9e616368e9f74dba1cfeac41f01b37c41068024f0176203145c299318f924a70bbc9ae16d8138a85a7594044f42801d7fd606009093e866be2c2d6a7aeb036b5e93b6bf38a8db84ae73010eef8f109108157ca8fa59584a890b7b5eacb926d5dcdf423f537be246f6ff22a3b111fd0e596147b4bf52e70214b5425ddb75081f6980f9cd40313470bedc71c7fb33a1edb66dc918d840509df7f48e8da08ba7236aa5ba0697c3afa02f7d59172311d7bada82c158a8111111854f07f9157630a8d4a405fcbf3437771f40293b86293a2693de93ff70068b0d138997e4c91274aa69d017a402c6935199e3adfa956cd71076489680c13791672d0521b1e97726c4d948568dc160c9d50dfecd1e9caaf709ee364d9bd429d7c7a4f9157b8e63a5baacc779401f5f65a40626f9b8191bb8ed4bcfed288bdef0a4f4bad9b23af5d92d998a7e2380a89b796ebc5b44805e648053c1c68f1ea5835fe40abbffc4a96c4aadfe34") 00:40:21 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:21 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x4000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:21 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x7}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1818.064768][ T9307] xt_cgroup: xt_cgroup: no path or classid specified [ 1818.079734][ T9309] binder: 9305:9309 ioctl 40086602 40b301 returned -22 [ 1818.093062][ T9314] xt_cgroup: xt_cgroup: no path or classid specified 00:40:21 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1818.151152][ T9318] xt_cgroup: xt_cgroup: no path or classid specified 00:40:21 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x8}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1818.261151][ T9325] xt_cgroup: xt_cgroup: no path or classid specified [ 1818.277506][ T9330] xt_cgroup: xt_cgroup: no path or classid specified [ 1818.345414][ T9329] binder: 9324:9329 ioctl 40086602 40b301 returned -22 [ 1818.373263][ T9334] nla_validate_range_unsigned: 4 callbacks suppressed [ 1818.373283][ T9334] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1818.426830][ T9338] xt_cgroup: xt_cgroup: no path or classid specified [ 1818.456374][ T9341] xt_cgroup: xt_cgroup: no path or classid specified [ 1818.721224][ T9316] device wlan1 left promiscuous mode 00:40:22 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U=\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:22 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0xf}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:22 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x5000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1818.865291][ T9346] xt_cgroup: xt_cgroup: no path or classid specified [ 1818.875571][ T9348] xt_cgroup: xt_cgroup: no path or classid specified [ 1818.894539][ T9351] xt_cgroup: xt_cgroup: no path or classid specified 00:40:22 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x12}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1818.978524][ T9356] xt_cgroup: xt_cgroup: no path or classid specified 00:40:22 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1819.039287][ T9358] xt_cgroup: xt_cgroup: no path or classid specified [ 1819.056761][ T9361] xt_cgroup: xt_cgroup: no path or classid specified [ 1819.157841][ T9322] device wlan1 entered promiscuous mode [ 1819.171056][ T9355] device wlan1 entered promiscuous mode [ 1819.182717][ T9363] xt_cgroup: xt_cgroup: no path or classid specified [ 1819.192867][ T9352] device wlan1 left promiscuous mode 00:40:22 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:22 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x6000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:22 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x4c}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:22 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) r5 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r8, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40086602, 0x40b301) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) 00:40:22 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:22 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x5a}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1819.381981][ T9375] xt_cgroup: xt_cgroup: no path or classid specified [ 1819.390119][ T9373] xt_cgroup: xt_cgroup: no path or classid specified [ 1819.404279][ T9381] xt_cgroup: xt_cgroup: no path or classid specified [ 1819.477173][ T9386] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1819.484737][ T9389] xt_cgroup: xt_cgroup: no path or classid specified [ 1819.500842][ T9387] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1819.557883][ T9394] binder: 9387:9394 ioctl 40086602 40b301 returned -22 [ 1819.580439][ T9395] xt_cgroup: xt_cgroup: no path or classid specified [ 1819.591925][ T9399] xt_cgroup: xt_cgroup: no path or classid specified 00:40:22 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x5c}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1819.637286][ T9391] binder: 9392:9391 ioctl 40086602 40b301 returned -22 [ 1819.648392][ T9392] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1819.727002][ T9401] xt_cgroup: xt_cgroup: no path or classid specified [ 1819.734800][ T9405] xt_cgroup: xt_cgroup: no path or classid specified 00:40:23 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc90\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') [ 1819.985290][ T9386] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1820.003441][ T9406] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:40:23 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:23 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x60}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:23 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x7000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:23 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) 00:40:23 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xf000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:23 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = syz_open_dev$vcsa(&(0x7f0000000040), 0x7, 0x0) r5 = bpf$ITER_CREATE(0x21, &(0x7f0000002e00)={r4}, 0x8) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r5) sendmsg$nl_route(r4, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv4_delroute={0x64, 0x19, 0x300, 0x70bd29, 0x25dfdbfe, {0x2, 0x10, 0x80, 0x9, 0x0, 0x0, 0xfe, 0x8, 0x300}, [@RTA_OIF={0x8}, @RTA_OIF={0x8}, @RTA_METRICS={0x26, 0x8, 0x0, 0x1, "6038a868df74906c766610f4cbd72d6ebb627f23a59c009a409a8884717fa8c52b04"}, @RTA_IIF={0x8}, @RTA_GATEWAY={0x8, 0x5, @multicast2}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) io_submit(r1, 0x2, &(0x7f0000002d80)=[&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x8, 0xfff9, r0, &(0x7f0000001c80)="3ee4658f44db8dfd4a22d3991656e47348cffc13d8317f307ac2a0d000d032b12b2a9a192e763f8a75f53f5b0a23f80b564ff8cffe6fbe8f08b45d9ea6da4ecc5fdf6e2450528e07b8f0b5554bd6baf7704e1624c73b083427b384af01a6aaafdf8e8053151d6734133af10087c30ca7db3c3e4ea4b65bbe6498405878f49bf11d60079f9ce28057730cbf82305a56c331ad25abe4c12eb4e28a33eaea8a98c03c7c4f3b4a2d76a69de7171f161289ab0f9c6aebdf622768d3f710acae09b82bf4f9c04a9cfb13058fdab1bb2866416bd6468125410b451b276e523a5cb654b8e79af5cfdc31a078598452984e5b1d3623f3cb4e1884c677034afa45a65dc0c7908c18cd9dbbd5cd4a72f7e8695e2c559099179768f0213b84b58e55f09cba006711059113b812947511368f822a4aa3f6c99bfff31a02c728e76089553b264da05f4e78ed86223993194cca44970b71da75c5526f8f89a81c88d78efb0ea127bdac002919f773f2138fa67d790e0984c2817a23444df0443371871c54297ad4f8a461b8dd11b43a26b58e54e794da1cdaaa59ee9cad97b12914d7b50a3fee51c3ebe01c4e4433572e393f3517ef1d328cef1abaf84650a8e2d903a97ee037c2ba86f3ed0808c237f416066802c6f7a22b885f79929cfe4220dc5ef4f7be56772a7611379337292bc1131d5fe0da4c97ad76d4c46acc25f6e38a38ac7ffb44537f8510d9a5ef88cd637a2d56837da2ecea81bb2f2a5040b18ee4e704d7030b5f7102b9d56b6cddf287de364736c4f4633cd6890c609032982c215c82ca9e9272ed9f46e61529f26850125b923349851381d7167d0472b3d809335e14e6d9f94a563f04092efc8cd4cbf021ede4df81e9f6bac0d95a9827eeb4b460a64eacc034af5d9aa99984d8653972cc92404d35d023f1745f289ba0bdef8453342e36613afc49cea9402bb54fa2df69238bc5365ea0da0fa75757795b0bb3e941dcc19efcc10c4330d8607b63e2d3da8a6d8b8712fef8d598a364c727cf356e7f5c9eb714023227fc5c13f3714fe05e8e4e4d8188244f21f5f9c2eb0cb5f5fe08e9789a8913fcb21ff2e173c3ddfbaa4ebe08a753efe970f03bcc575cc57326db603ba997e6abcc582b3d55d08b3f9f106b186ee1a6f228fbe1b0870460da1992fe8a7ddbfd32a5663e01088b1c7eb9abdde7d5b565b9ed5e6adca0f5b34b5701f0f41116a09aa4b338d93ffd4a001bc773132e89e36dd66cfa4f37118a5a45118a9edfe8fbfb4bd3916d2d9dffeb43e2d1984fb7fe4a5c8dc39b4b014d9afc22ce669ad530716a61e64ad434d63c4f97cb3aa83bafc19b3d39cad4d2d8796d64312cecf40ba103289ecb498cebb1306250e646617d3b30887dc8a5aed46aef2fb4e85f80b760b1b2a9589eeddc5d89561337bb92bf5c20c3aaf3c51d86269568ce3d9f4574056b70392d191a46f52a15f706aa27782eb7ab664289569de1a5282ff5cb61dae3d678f9fe034c73cbdc28a257ded41f46245ff4298075ace93496cec2909858b82abb320bdc49187e3af96c4a212a51d2f6103363f7ec16552a39a6213b553b7692934df3aa046fe0a2db7e92e1fb985bcace03798bcee23205f3ca7e73a08c9d4242d8d742bff0c0a17cd67e021bbf8508ab63c40659be5b6d0e81630a3c56443172b6b5049c13a82c306c54791cad46ef6ed39923dd6734513570c484fe7bb3cbc93ac59e9fc2f9675244b316e2aecb7b5ec1c6b9fe414b577f0f101bf5be17e4c90c562edf21a1fd2f7ce9b883722cbfda4e4a158e723091b88c7571b7db8d0561ef5f4367fcf04a202d049b3f2083adc3c7b28824ce2f3607d796026c34bc5e900be2a66c29786c13b3b708c95ab07b7adcc026d381e14a38c7596ce00646428172e79bcf550a7883e4504ab4e87aae247e1e17923e1786237107d3352704f2e9f1a627d5e7c0a3e9424d752a3eab66cd5fa5506f7895bc0217282ac8a665b4f50c5849160e8142700c39601a92b49824f360dca39a09529f065359004d64eb46ad6c4f23d878064bf5571970f544a29b4f57aab8e86ba91d247d6b1ab752fa284813976ede83fcc5499f4e686b5220c51971d728f9080bf1f0239b11defa9f0cccee63b8e9852d29175ec81a401ba5a86558577b791dc3cb9617bfe9f5dc8da525237eebcac1c75df234b1217976ca3e2bc3311be069547c4c19f9a6e123ac4c8f113f73d6ff9286ee1df880a86445dc59b1907bd719a721fb1337c0290b6225d27bae02300a375e7082ec2b3d270aec75380421f6eb7246c08396beba54ebe85198385d88692c7e291c2e4c64deaf582c7afcc5b78de8d3de0dae4f0e15245fcc62f1c33b54be5e5af5fc490ecbc4a81f8ccef500421811339cd2b9d2bc70cb2fd0a9f522d403bfea287dabd244751eaaa558657802b1ac6c30ac54e688d7f08ff95c1a998a4628af067903768120fda1d3e179a0e477c743bc3fda05ae94f89d5c31c8e99b84e16ff33f5b97e6a602d0d24821145793ae8d219b1e5e718d5c5d69f56b24a54d2f200f336d2fe44b613f4801e6201cf7382277322cd544400404ca63f31548bc982f63fca8725c826e12481080be2d7ea1970913b7988c2d51338790b21cd449240bb396aaece9e5b16fe70a2032c2c2c4d4e139c7b84289f94cb89f0111410b9f4b5cc2b6426718b39bdabc068dbe7004152c886309c36fbb3bd3e7263d24a09c8ae7d708ff8a8f001ff23672a5868d85b8c6d60390514c3790ba5c240078c5fc617d51ba3380e0eee94762e70ca9f874c7be5ea5afc42e66c5d17b40261cecf3fae15beb004c563795df69d4af558c5e50d9ce1f692a772d56ebeaf0fbe3558300a4d6d28e9dd287587a00ccd23c3b8a34c8f38dc0822d536f20f5209a1ba28906a6919163010ddcb30822ddd6cdc272ad8b29eabf290c9374d6b7df6a1de140d870df9d7ef50a5a76dcf35cfb2039acbccb75daa211694e5c7501fa05ec5695005f2354d23d3592aa8a0309d0e0a0df3bca9c8b86798f0bd4eed3d5e1fa20b5f88603b33e8381b4bc7dd4806b66bd58b94502a4daefb3a7c4da4d930520455e210ead31c74e9fc86ccb4ebe3fe5459bafc2a7001462af627ccdf5667ddde4fd07a4f2132b9a3ec16f95dc530f72bf867ff83c0b0f1e68328622a5ea5139282291f50ac2835f1d5ae0c19633cd0eefcb01a8316a0024ac229a86a3a5296eb3e6534d23ddeb2dd296b925e1ea3214f4881fd35da98efe680258027022a0d5fb25b3b274c6d135a0d7f9c7866e234cc70fbab2fb78193bf19cd61022bb671df67278268fa06ce027ae67564f57c4e1e425fc174ae44c13eea7b7a8a5dcf87f01a89ffb260cc149143a21a4971551999be3b69c7e82c65f9992fc9ff527ae1e10c1ee6f38cc70d2dbce53d5d4f4f1d833422c2bb2d8f77f88867f1f70eac827ffecbbb5ee75005c5dc5efd45b0cc083c1dd6835c545bdf4a0d24ffc7e6a938809504f466d93eafa131e4a86ee282940a1b9df416baa56b4948a7a0f96ee941b120ae242af7f7227d1030c432932a9c13d3e4e1a581485f31b582dc8e8d4576dab7ab2d8b130f49025cc14d0f8482bb6f36bad2a51b32e38656251164ae163f8105606718d91296fed5249bae97dcc994ac2e31157238b009b65a97408ac8a0f40c2f1169dfbc56f72867c40e4d210f47c474c4745f8cae30d7e9a52464b3b1965e5c9d3e9d9821e9b4722b7747718330a36719388e68eee9c835b16c43230f422a18a482de283d33c4d9b1e7dccf57190bd4c1859f7f67d6650a50bb53f11d2190bb20cc931ce02d9ff63727c6c0a01d4bcb7318f908669aaba3bf1ce61f81719c23c8c899782f3874a5d53054f4b3467441becd2f40d7905e70c1d5bcf2249f59a3fe2f4a92ed86950074f8f01545174cb50e5e7896f25ce96de5ad62e52ef205f4cfc4b206225bb87247c8627b99d095b3d5ad9c593a3f3a19a0a36762610b4fb109f3d7c4e6df9d5f72d695a54227e904e437c9caf92a27374efa53ab6f4bbdcb8eed3db83a85b7c2740a7d5bb7ada416a22809e1f71920c0c1fe50e40c4dbcf946f2431269c7ac7a47b3c795f2fa284b8267c78d8eb21f34992da154d1458bde9e5595a1b2fc6964be185e77ef804dc5385c0471d7570135dbdd9e4eaebe409e3dbb8c6d81e2bcda7f5637920f5f81623fdf11545bcaa91a7094f74ec0caa74b7de3d50da9aa4cb5fd20620fa94fbd05ebb0e50f71c8584ea537ab46d5bf556b353b843c6e94859bce1114da8568b22c5f2bbec28b65fe87078395829543d2f813e5ae7e5cdebbe6b396697b214cc89951141091502f70b84a3e71ab0c2ed58a2aaeec3c0a6c23d28883260b6c7c9933d7b4a9431e2f774e48e1bfe75662d60d3fec3efc48196aeb79d224ffcf43209f6110259ce9e0189440f14ff4367f48c191c53742f443da7dc056810c5343088fae62352698bffcbddee5d9f717085a8f646b8a6e8c53d6bae330fa6ae98d73ccf4109e45ab7956f0a538e0ff7bebaf5f3f18085b78ffcec53428fead96632305029d383aae59dc61fed409e9285dac1e90cd67434e104cc481c8168a8f7431b0740c4cb3f761effe2240437151d3586188c9d9223346921a367206f26fd18426f0d4bafc02c39ed6472202320c1613e2f8f248aee02b5c35bede54459fd10f56010cfe151908726af399b5fafcbd709151fa9c4fc9c4d545e8af2324e18070944749efc3dc58ecf5b835755a9ab6209763125786c9a33ffc4748f704fe9327d46ba873215931774088dcc743f1d547e064231657e8a262605cb37ce9c4cc332e7f3e2e61822e5d7b1137b8e20792f4028386271bf6361f7f84748b1c2ef01d4ec72e267398b39b25a546ec69a6a748f2aa31d8d8db533bdafb2294a8ad1002517738f9ff7499c090c3850d0aeb436c7a0745af92024ad41415c679fcd340a93e86685ae5f55d44d5f2232ce7c01b42c01609be0fb050c69e0670c833019fa890bd9d3bb079447c7de7d4c0a5b0a07fb1d28d324ceecfae0e3c7eb411818d7843b21a4694798935dccaa62d1510471c8d39e61a97bf65ce6f9b65a95f3ab9b35c5236fa1e0822138a7d83e5f8d446fbb5cfdb764e5861e4bb06cd000ab35ce28fb321e4e2fcb83a478fdccb8c48d19b3bba0a26dff005182ae6f257f890ca7e990474c46687595aac9ece5e89189a565dcd5b7a28dda600e5fe4733156ea0d6dbb72cc9354b7d746851445be18f050d5d2af61a7e8d03af04f7ca46bbbcd746ba12dfcec2b8e3e78cdc4b16cb27e5e1a416be8bfe435f0780e74481504de3d31adc4c7c3851ff08b309ffcd81053dd00d9a00d6e739dc183816fc8e166533d846e0a44f697907417bc6f770341ea0fed7a8c5f8a4a04809a096e6726718e3b5724f1ab7e0a6bb219ce23657ec6f3d9c1911195d84a4b65dc7a4d120ac894207809986aa02099f53f0afeee70b22931b4c162b692d64aa3c4a0c748645da686dfc9a8ad78901e7383bdd190f0c10c73feb720bc0c50e58ede915d4226b6d5827ac48a81f4fe872701bc49ced44b6015bc083a0c48e3b6caf334bc1e34009992eada7ad1f4671ca9bb91b7391dddb8f3839fe1eb382e87b79bba158494a74b6d968f5ae1773a0044427e1cf1e389104c7aaed2927b7651b4444304924eb975b1450d235100e2ca0da28b8a03698f341e656910368727e617e8d27950bfc81128c973bc0846f9ac4f1bd7ef36634bdbe368278b98d1abcb4d24cae5ba01d4421027600a2c56", 0x1000, 0x308a, 0x0, 0x1}, &(0x7f0000002d40)={0x0, 0x0, 0x0, 0x7, 0x300, r3, &(0x7f0000002c80)="c4fead1b8f0b7dc121d9a47865a62d03d6a616811e89acb23d8e951dbe261e118241edd2a36f64a1a4079dcd7b648bfe574aa912a9089991ae1f5b8a03a5e4425b89f32f932a279d56182633fdeb5a6e20b816dfc27fe796dae077dceccb04ee72cc731cac797054efe792dfb67a86675a2862b8e552ace0efb6bd2f1a04b12b2f9986ce4922c1ff293732c8e1778c82f3b2a39b7bef30f9dc", 0x99, 0x3, 0x0, 0x0, r4}]) r6 = perf_event_open(&(0x7f0000000240)={0x5, 0x80, 0x1, 0x20, 0x6, 0xff, 0x0, 0x0, 0x10, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x391, 0x4, @perf_bp={&(0x7f0000000200), 0xb}, 0x8002, 0x20, 0x7, 0x3, 0x3, 0xd3ee, 0x1926}, 0xffffffffffffffff, 0xe, 0xffffffffffffffff, 0x3) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000480), 0x80000, 0x0) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000002dc0)=0x9) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000540)=@abs, 0x6e, &(0x7f00000009c0)=[{&(0x7f00000005c0)=""/40, 0x28}, {&(0x7f0000000600)=""/144, 0x90}, {&(0x7f00000006c0)=""/207, 0xcf}, {&(0x7f00000007c0)=""/255, 0xff}, {&(0x7f00000008c0)=""/234, 0xea}], 0x5, &(0x7f0000000a40)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x160}, 0x40000120) r9 = syz_open_dev$vcsa(&(0x7f0000000040), 0x7, 0x0) sendmsg$nl_route(r9, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x81040c00}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv4_delroute={0x64, 0x19, 0x300, 0x70bd29, 0x25dfdbfe, {0x2, 0x10, 0x80, 0x9, 0x0, 0x0, 0xfe, 0x8, 0x300}, [@RTA_OIF={0x8}, @RTA_OIF={0x8}, @RTA_METRICS={0x26, 0x8, 0x0, 0x1, "6038a868df74906c766610f4cbd72d6ebb627f23a59c009a409a8884717fa8c52b04"}, @RTA_IIF={0x8}, @RTA_GATEWAY={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x29}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) io_submit(r1, 0x5, &(0x7f0000001c40)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x8, 0xd, r0, &(0x7f0000000040)="fbced320f382dc43158066e831c2edb3e194287b2d9487e5969f2a1d55c2c6e26eaa29e41392e3e7b42340ed14721f866dcc08c3f2a0d0505d52e5eae76eb08dbe2690fb95c4c7c773b0929def61472cb588b718c0503df9762a33ce867c91ef87ba0e8bd5670de438dff55e8818f8e219655964491859292eb22aa3a1727fbbc89c38e36c90bae75d07260318fefc780581215a02b2411291aa5a4b3e828c88c120e3298158220455dcb56093dd7780d973ee3ead74a3b52e4b4d289fc741c6b8f8ec85fdc3d1a040323105ce39d144a65c733bfc06d2bdef8acbeb47ab8c7c63ba1094b7677b5ac67c3bc26d23fd4f32764b4e", 0xf4, 0x100000001, 0x0, 0x0, r2}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x3f3, r6, &(0x7f00000002c0)="4d13c7da18b2b408828438622139f14e9ec90cb7a7e67ca7b7da9d3a91b398aec21c5558c3adafed1aa206ab0fe6a9a44d7da2ebab2236d0f4a371390c5c18c37692e0758e0d5638b94d82c372ff31ff7e78272ba22ebd365be7a09632b21f40466755281d97b58f6d8c7e41740db1fea5d0bd3ea26ac2", 0x77, 0x8, 0x0, 0x1}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x3, 0x25, r0, &(0x7f0000000380)="36234b30638fe1a10a2129cb069e7abb99136e4f562a03192a000d12cb293ad07fa527ae8e3a2829654baf7e2090dbda6a0adacb230410d056237f3c705929d498c5f0c67aac9bb2fcaa0e708bad2b847afed5f3ee27baf763b5d5894baf16843222da976e9dcff0ab998b7bbd5f553e8174334c83acd24b4bb698e84482b63f7980d6887915d04bf7238434f09c504b80abe7347201520c4d60bb46bf72169c21b79d7eb19aef113df1a3ca05", 0xad, 0x0, 0x0, 0x2}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x7, 0x2, r7, &(0x7f00000004c0), 0x0, 0x3, 0x0, 0x3, r0}, &(0x7f0000001c00)={0x0, 0x0, 0x0, 0x2, 0x5, r8, &(0x7f0000000c00)="7b58caf6f80b341dcec23c3fb39e18cd93555d1abe37a63b66cbc8a72429cb665629fe5030d3775909917e269ed1abbb281c3d33b946cb2fa9bde71011d48e66fc4c66577575fa248e63117ada48d28817ae1ffbaa8e570886c4c8c39fbda7f04e0d366a6000e92ac829ed359f1d1980ab595125db2488fb263065b2cfd9595a30774f3de499a32fdc928c9b7139da7b91572267d591fd09e9e37ce90a100f7010a6c2290012b447738f5e3d271f136bf76ad785cf2a192bc336aa22dafb386ac3c25b0d7576ec1cc30eb17d46704eac1bf1743519359776e1e57c533fee00ea8477c1de8cf00303ccbdf5738da352d2faff05da4c6f7b8487522c272805a3987627dd24ef19c83d312fcb6472409eecbfc09f6a831e6d6b3a67ad4f566ff410d16dd96d6be2b030e99cee14d788b9ac07604b281c3671f115a3a5ed75f5fcafd4531c4a45856f05ff28630ebfa00eb790619716d59505d5fff96deb45fe4de3596dd19f381ae780dd1f89b88a196943a34bb844dbecae14af4227c3298e44d4780e0e26ae26d49e7f58533f4a3d76294bdb11dbb9a1f8f96d5e07c0e7f4e6adc6dc0dba501914b349626453718325e0bb07ca465ef0af0593f33b46719a20667745cb92cb8f9c30c8e5ed47a08b95277b00b3ffd77b8c40d04a2ae47d49b49207a8af537d1b9cf6ba68cd53726061dda0f7d0ed162cacb8c4cf5262ee4ad7a154270b82458b181028fe1d41b5ee7be85299f230da3be8327d7569df9a5be5fd807f4bc8abc2460465cb349c1e4176f3aa84579bb238538685c5f7df46693c515cb99023ee115038a0fb579ddf10c653cebba0cb501fe7aa51d1c4e24309b38a0f5b588f210ab3d3983b3921895ecbe038b78890d6de564d4ca5c6ade25580c06ca29ce8185346b7a62d69c695d5496df0b642c86d79567d5c67686413d9a47375b2338650b3c6865d7fd8e108b97dfd5be6d8b848a7229b7711260310197474eef2722a47471a772f8129da638b1bcbbfc96aa6b7548ac3612e97bd21fae6c59fcb3e98987baa69d35de59b1d58c545ea291084e57a2586da3752d86382d171846220d000cb741f47220d7a8101b5cf0b2baddaad5fb7dc47d221f73ced583eabada668a7c758ac412ff3af50e90800eef4b465fe423927e9e21f748b1f2bfa6a6b62e48bb63c1f437b398482993b37516194dd926a96d78acd227fa282a93d7bacdf90e5195d19da1d353623e1f6734aafc6dcae8e75ed3b458b8f917e6f9c4d1224f372870f3fea3ab99e369c028821b8cab81e8a455b5a4b1adfbc91841ec00c00884ddd7f56a6bf762804229034d50cc8091c5689c680ca6a1ddf569cd66a2d8510d23028ffbb01cab01d795c18bfa6374e16f55ccaba57445269a75f94daceef19cd8bf30a1bb56de2fa982331a1b0a7f739907418c7da1dcc9003058b21f8e4609efa2e6ee83e8ac35c89628d794ea97fc1b0d1081382687e14a1672c14d6bd78694a907fc1341ac283d115d43f5fad7ee4330828f66b1371f9057b0fa99d4831819a39f390b73691d5edfdccf13b597911386e00ef96de27ce5a3b8f5f5ce4d968ab7bbed5a80ed86e1e6bfcd76dddbaccce4cdb8e43fdd09209de76f29677719ef493dbb970e2aad007711921a5add72cc50e9504e119000772ed5e41b1dcb9c96fc2e557b2e8f9ef83e553d961d851a83487d0286aa1b931b8ac9f902d9ce913cf2a2201b9ecf47cab36d58ef2bd5cef287e74a482aead069d3ac9ba5c8f4fa15dad02f8231eda28b315504a1c965d9224084f71841981bb9f0b98e4d436f8abff17d2979fbc25860e006171fab02d07c195a6800f429addd0fd517fec79f0c6dc27008a3c5dcc0a2f6d27f67e7d75cdf40df1ae59f23bbc6997b4a07df745fa8e9ddb85db0731c9bf4a6639b9222daca621142ae28f9a13a65f812e120b5a458658b522fc105f28832946ba0c3791391f87c291f79f4ac6c65c16aa7ed58481247a8d0a82f34db99a0acc6ba6fb75b3d71c7dbed8e46ec9fc02dc85838a398d68e451103e669b9a43aa3fbfd68f6e2460464db27a328b7c99c160ffb9f2be6a054e62ee5ea0c59a272cf74e56094a7889bd65688d497d73eb4884e7b2e630e3fe6868ae5d20e44908265b828514add9e7b9074d1302da6bacd1d55d4aa4e33a127aae0fe8ac1ea34cd3e0a5acdd534e34c5989c02bd9b7c22e56b8ff70b835d2fc051a74abf601439e9bdf7b63b90e622a6e257ce8fc6746ac347f5e6974a00c0fe29a61b3cedd3df9b3864477430d56fa764b6a2a89834cf4b6c5e1d1ac128db150953b4a6eb237633d8cfd891cc0a168f6b388b7b250190b03e1d7885a1dbc99f49f7acb9221cdc9b9b7557fcb9b7894d71f81ef3ed5235aab36ab3d87c10edcaad34f46aba5cc7c9f417defc9b72fc68d4e8ef6535f6d5d2099ca4b0f71a9f1f1cf5c153a0a9e89598cedc73bf8cb6e1dca6eb2f33ce789e1e8dc6c7a73f0b6476d54a381a85e4056929958912f5f1936d4ac85e28573766670d5e3fde1c9ccc10ba360cf25e5100ab37369b4c18c2e2a319b1a1ded750eb640e4196f0227857c75288f73947b2f8735e4d53faacdca465d356f8c5fe4e03a4198706dded93249e0576a9b77989ba0d648b432a6f091070adc09cf88cdf787f0c9b3f202fed413e0472c82ea63531bd660f4a2282be819518964f83bc20c7b3c548c958a8311719a8955785556eb7a7bc9aed5295e9ba4da3e9e8758cb3903b196c9cf7485465d34d004fbdac9d9be46d8de185233102f58fc48e7e61bb48f70722384222cab28bd0f84e8eb91f1b8c16d435e917a261b013950b196706ff4016a361f5e40743eb5f9938e8ced84509c5893b7b7e5c88234fbab9021787c08aedb3ce177bda43a4abb064f86b0276263e9ccc643f63e97f8aecc1898c1fb1006429f405526624d001ba763c0503473aba178c0e79e0ddbf559b066a258f36e025447d37f9144453c3f43b41ce24aa852a2e34e0c4a69b72b1075015644b5f1858096f7d3ce9b81f595adf404460c01d2be9ee8e55f585dd40c10e44518ba1c1b47292a852430f28e0d8f663bda6debf6a00d8af7a4f136ee7375bccf019b6ad8d54e5ee1294126169dfd6bb5527ebf5838e9d7266efb91b76f598848df709fa02884e0960383b55aa35b0b2f4949317d098ef4258b136ea174c1e4f1e6a5d38059b7511b2b7eb585dcdb827f502a27497135d187e32783c0a53878b1e798cb0bd9d064c694909bd17ba7415c9e07cd869ea4f4113e4ae2b9310e55acd3e0c13caee94e6035e7fdf40dd8c6b7221b880dcd8e881bc3343cabb31ed44b5a422d50081becb1ade56b20a8db58b4e2af96075af5772298d818e1b211d9379358cb7e3690d517c90b655a8befaaf6664f7964ef356873f1f8dd1d0fb39b79130c4ce5fc2da1106acbdd76638fb55f749feff0e076d3e84f6a8e37ed89ef4b1c04af84670ddc5429fed19e491efd555aa271b38d07f54f72205c02206d8629bcea6f890c3aecd5fa72ebd8e3f233eb9beb470094daad1c7e1cd54ebf9b96dd2bc48586099f098746fcade7f6fd173bed6111ad2f3ed0bfa6d048f42454344db863ebbe1330aa66de305c53c59103329b95dfa3d9e23297e6b3e9882a638d5d011d883fba22c710bc66f7e24e29e9e7ae8ca22e700d7ab89650f93744cf7f4727161ce233ecdcc88ff1fa264f419bb1dfbaee75f3cfd3d27a301a66dc48fcc120fb4e61444c6d34c6d322c3f80198995f05bca54b0cd4cb4661041416a4886ce18645bbf42f9a8ee64f08f8b47373fbad96a7ee5ebd154f1e36c12726ca220e52e2a24438b3f6653c9496cd7b91a6c195b4574267b51a16cdd129e2035a65320b4c27f24a84dbc3eb0425f1a02471cc25bebd2e27f5103c2e4856f7f9d8475c95a7f68e29bf5fc14d709ae2ce25c7613b17cb25939486be788deb215db3bc28d75839e6fb8e100a00ccf6e6e1801986bc67bc24a7ea5709527ff7cbad4dd9d2b32b45f828ca88362b9c1e9ce33582d6a6429a81beae5842342b087ca4332bd08d721d0be5d11896274be6c602c74edf714e6f9e281574bfe003b29f6eb803734a9ab6b856689668730601961e1da58ad8ee71ed06385dab7fb98c63d24dae7c7a20326b8e897d1aa3445511eced5baa886984134a8c3b5dc312facc0798bece3ddae6b00a4b6eb324896769f28f8f14ade8e9fd39bfe68f4d558658df44c94a1a51329de34cccd312233ba5d1be40cb8174a11737a308ddccb81125a53b9d84c872a4a94bc9157b07fbbeca77af37cbec85a8e704fda7af2bcba8887cbd70e375ea9c22336ff8b0bd4a1c34305b1916db490bb6eef0cd923a6ccf174467b9c6711be0c85f84c0518c4e58ebcde13975cdfa3bdac2c5d70642f0dace288a12beab2bd89410c8359f4ed2030f69cb7f1931af2f4c3ac680bf6670300b1a3714f7335d0c72cec27c42f04c67883061fa9f192a3e90aa88f07d2c6c9e3c099b6ab698512e2c0fcd591a0277abda8dbc354d092c4eb268f932037b9c7ba9d16c2472b0a55bc7f01754bb5fcd493a0da35a9e891c50ea8fee2de8e34ee033b2ff50a00ffc5a2e49a6e4bd5260197e5a77de284fd6f67daac80813442647524a5a1b3251d730a536d231ef2cc5b0d59919374b1b6050f366510823b1c922e58499ad8aae8ec9e1ab0b62e433c289142a138f0697cd3cf3d74d76b691d73c2f9e958d2453034b464bcab4a896505e7f4bb633ef852e4a08bd6fc0ee99d33642b4053ddf2db488659a22871476ede3a8f3ffeb5dc666416c38a786ae2d3a0360c315e446616b862aca5ac0818c5d57219b33cdc16eef71a46d25dbdec2f81804d61a44adca6f12676b32bf1c093af981618c7210f922d2ecda681f8d351ae4501da98cc2cf26283483819f695f52627e71203b95c1103373dd64d734cf126ca7e21126a5394fc4a743164690fef4d50e51587a299e81d95066a7426466eec3fbcbf8f45848824284f717e2bb579938243fa5f493abd5fa8b21723005021781b87e57e7651602206b4ec5143cbd2933256503be4b73988c0391818aa039ba1b6868e36da957da6b2040a42098e9cd8d0dddef611ea9041a72f944a87160b785f3bad93afc5229d785d1c2ead8ea589dbde1ebc12a64c6ab9d6331c1b2e01f66506664d36138528884cc215833f8396e33bbec2ccf9f7d22651b97ecfaee4b74ab9944fa3eed5fa7d1392d77581d1bd3d5f61f8002a7f639e52d3239021ce3f9120b744b1d3cd1c6f3a50ff76e6f482a4e1b8cb2be61fe6262fb1430f5e99f6d7ca586176ef2dd93024649b7d781269a9d19dca04fcf67d07f30438362fd9d30de99cc0f127accbde91dcfb154dc02c951b7f145fd749734bb7e392b5e57c34309906428b538f7adfa92863d8fc24b419f5bc8f6607166eca0496cbe077bad6ce614c5b3ce47cdc6c5aa864eed10533865e0471bad705e4805e858c764bf211fd757e911c2e5e9b941553b23c547119d1f1ce224566ca32d3de6d9f6ac920d3e22578f667fb92ea84698c626057579338073e57b7b2e65566fc242d7ea1b34590cd949008fc2dab36e2fd040835b4ccab061cd248f5d276865310a1c113b535e87db33eebdc7206bc407b456afe0009cfd11f6c211838e4dff9b3bbe249862a8fd640fd32429e8193cbdbba5cd5330b108a06347865e7482002822188acf993b70a76e8a7aaed1df3ba1ff6f9cade71ea26b1bdd08455da998413d4cf66fc052d70b34c415139ccbc", 0x1000, 0x10000, 0x0, 0x0, r9}]) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) socket$nl_rdma(0x10, 0x3, 0x14) [ 1820.151298][ T9416] xt_cgroup: xt_cgroup: no path or classid specified [ 1820.161014][ T9415] xt_cgroup: xt_cgroup: no path or classid specified [ 1820.207278][ T9424] xt_cgroup: xt_cgroup: no path or classid specified [ 1820.277373][ T9430] binder: 9428:9430 ioctl 40086602 40b301 returned -22 [ 1820.296103][ T9431] binder: 9431:9431 ioctl 40086602 40b301 returned -22 [ 1820.313751][ T9429] netlink: 'syz-executor.0': attribute type 11 has an invalid length. 00:40:23 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x68}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:23 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) clone(0x9052400, &(0x7f0000000000)="3541efc73d46391fd2ef7d6aad0d87f20d594d7fa36ed3ebbc1b69a472298160079471b9f2b3cf2d1a64d7a0256dd7dbecee009dcd1d63dd0aaad139dbfa9e", &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="1284346520f53588584acaef66c027ed4f3a9830752421be4c88dac3464c555396254be7ef35df311610f12c27ddfe6e6674bc1838d9dbc0075e18af371598d25188a406d78876ca5a73867677a187f7e4473ff1758f7dd2bcafa9c84594b2768072d7f4c0b87d4a7e5c79da40c98299b60a8c274bfd119726e697") [ 1820.379809][ T9430] binder: 9428:9430 ioctl 40086602 40b301 returned -22 [ 1820.417244][ T9441] xt_cgroup: xt_cgroup: no path or classid specified [ 1820.504861][ T9443] xt_cgroup: xt_cgroup: no path or classid specified [ 1820.532082][ T9449] xt_cgroup: xt_cgroup: no path or classid specified [ 1820.541704][ T9446] binder: 9444:9446 ioctl 40086602 40b301 returned -22 00:40:23 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x6c}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:23 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) gettid() clone(0x800, &(0x7f0000000000)="d8e349f3fdb8545d0444db4656e1c5fe6fa0d48216a208a285e15fba1386b7dcd1b42c", &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="52453a8cd1fd24824623961f914db86932050d610ec7afddf7d328eaa8aed9bcc5699e256b3ce9b020d5d68c144a28ad382d9a147ba8fd5ca4a57779d613ab137e79bf802848202809c1cc44f5c2339f421813b1ceae159cf23bafc219e1cf33286b5f78e132a85fca9d105bb5f1e31e8cae00f83bd5c397482c26eac3f150b6a976") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) [ 1820.563996][ T9452] binder: 9450:9452 ioctl 40086602 40b301 returned -22 00:40:23 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x74}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1820.640105][ T9454] xt_cgroup: xt_cgroup: no path or classid specified [ 1820.655887][ T9457] xt_cgroup: xt_cgroup: no path or classid specified [ 1820.714921][ T9459] binder: 9458:9459 ioctl 40086602 40b301 returned -22 [ 1820.736909][ T9462] xt_cgroup: xt_cgroup: no path or classid specified [ 1820.753885][ T9465] binder: 9458:9465 ioctl 40086602 40b301 returned -22 [ 1820.759572][ T9467] xt_cgroup: xt_cgroup: no path or classid specified 00:40:24 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9=\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:24 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x7a}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:24 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x802) exit_group(0x9) 00:40:24 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) 00:40:24 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x12000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:24 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x1c030000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1821.169839][ T9474] xt_cgroup: xt_cgroup: no path or classid specified [ 1821.180647][ T9477] xt_cgroup: xt_cgroup: no path or classid specified [ 1821.185528][ T9483] xt_cgroup: xt_cgroup: no path or classid specified [ 1821.200496][ T9478] binder: 9471:9478 ioctl 40086602 40b301 returned -22 00:40:24 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x8e}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1821.220612][ T9475] binder: 9475:9475 ioctl 40086602 40b301 returned -22 [ 1821.235885][ T9473] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1821.246037][ T9486] device wlan1 entered promiscuous mode 00:40:24 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) [ 1821.269516][ T9490] binder: 9471:9490 ioctl 40086602 40b301 returned -22 [ 1821.308975][ T9486] device wlan1 left promiscuous mode 00:40:24 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0xda}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1821.336280][ T9496] xt_cgroup: xt_cgroup: no path or classid specified [ 1821.346418][ T9497] xt_cgroup: xt_cgroup: no path or classid specified [ 1821.364709][ T9501] xt_cgroup: xt_cgroup: no path or classid specified 00:40:24 executing program 3: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0xac, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x13, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000040)={@fd={0x66642a85, 0x0, r0}, @fda={0x66646185, 0x6, 0x1, 0x32}, @ptr={0x70742a85, 0x0, &(0x7f0000000000)=""/37, 0x25, 0x0, 0x3b}}, &(0x7f00000000c0)={0x0, 0x18, 0x38}}}, @register_looper, @acquire={0x40046305, 0x3}, @increfs={0x40046304, 0x2}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x7, 0x2}, @fd={0x66642a85, 0x0, r1}, @ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/239, 0xef, 0x0, 0x2e}}, &(0x7f0000000180)={0x0, 0x20, 0x38}}}, @clear_death={0x400c630f, 0x3}], 0xe9, 0x0, &(0x7f00000003c0)="5e279295647bbcfd68c28a58f48444b5068045004a46e83be2c68356ae3111f45528bebedcffd938af9c560b5b3a75e7c3ad5be561d8bec15e28717268304b6097a60306f1156cac91bd94421ab2da3efe4ea1d6b4d0f9c5840b3d5aeebacbd614f540fec3eff697641c6a4c48ce7a002d87ec59fea1d443f225b23ddae01f6db6d020d9a38f5b1452c9b8092a59320f99dae96baaaece6e060a8da9a72db1b6bf992a12900f5c8eb2cda23893d0614d21868f1d2d128cbac0830a4a604351cd5bea3b2d3dbc63661b45d6d503b74f1003e4ac3fafd58652c905cd8fb94915d87fe66bebd968ca28e8"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) syz_open_dev$binderN(&(0x7f0000000500), 0x0, 0x2) 00:40:24 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:24 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1821.488439][ T9512] xt_cgroup: xt_cgroup: no path or classid specified [ 1821.503588][ T9516] xt_cgroup: xt_cgroup: no path or classid specified [ 1821.504164][ T9511] binder: 9509:9511 ioctl 40086602 40b301 returned -22 [ 1821.547687][ T9520] binder: 9514:9520 ioctl 40086602 40b301 returned -22 [ 1821.570255][ T9518] binder: 9518:9518 ioctl 40086602 40b301 returned -22 [ 1821.575504][ T9517] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1821.641326][ T9523] xt_cgroup: xt_cgroup: no path or classid specified [ 1821.656507][ T9527] xt_cgroup: xt_cgroup: no path or classid specified 00:40:25 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x2}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:25 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\x00 \x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:25 executing program 4: sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x5c, 0x0, 0x100, 0x70bd2a, 0x25dfdbff, {}, [@SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x3}, @SEG6_ATTR_DST={0x14, 0x1, @private0}, @SEG6_ATTR_DST={0x14, 0x1, @private1}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x5}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x1}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x7}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000000) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) 00:40:25 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x1f000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:25 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) r5 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r8, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40086602, 0x40b301) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) 00:40:25 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:25 executing program 4: fsetxattr(0xffffffffffffffff, &(0x7f0000000000)=@random={'system.', '.,\x00'}, &(0x7f0000000040)='/dev/binder#\x00', 0xd, 0x1) clone(0x1a806000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x7, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv4_delroute={0x64, 0x19, 0x300, 0x70bd29, 0x25dfdbfe, {0x2, 0x10, 0x80, 0x9, 0x0, 0x0, 0xfe, 0x8, 0x300}, [@RTA_OIF={0x8}, @RTA_OIF={0x8}, @RTA_METRICS={0x26, 0x8, 0x0, 0x1, "6038a868df74906c766610f4cbd72d6ebb627f23a59c009a409a8884717fa8c52b04"}, @RTA_IIF={0x8}, @RTA_GATEWAY={0x8, 0x5, @multicast2}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000080)=[@increfs={0x40046304, 0x2}], 0x14, 0x0, &(0x7f00000000c0)="1fb4785eae0ef44472a0929339ad8e445b7c18f6"}) 00:40:25 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x20000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1821.878884][ T9532] binder: 9530:9532 ioctl 40086602 400500 returned -22 [ 1821.911952][ T9540] xt_cgroup: xt_cgroup: no path or classid specified 00:40:25 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) r5 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r8, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40086602, 0x40b301) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) [ 1821.956499][ T9543] xt_cgroup: xt_cgroup: no path or classid specified [ 1821.963206][ T9542] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1821.991981][ T9552] xt_cgroup: xt_cgroup: no path or classid specified [ 1821.998698][ T9550] device wlan1 entered promiscuous mode 00:40:25 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x3}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:25 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x48000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1822.019719][ T9549] binder: 9541:9549 ioctl 40086602 40b301 returned -22 [ 1822.057249][ T9558] xt_cgroup: xt_cgroup: no path or classid specified [ 1822.064617][ T9550] device wlan1 left promiscuous mode [ 1822.087149][ T9561] binder: 9556:9561 ioctl 40086602 400500 returned -22 [ 1822.142427][ T9573] xt_cgroup: xt_cgroup: no path or classid specified [ 1822.145115][ T9561] binder: 9556:9561 ioctl 40086602 400500 returned -22 00:40:25 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x4}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1822.183347][ T9580] xt_cgroup: xt_cgroup: no path or classid specified [ 1822.203151][ T9584] xt_cgroup: xt_cgroup: no path or classid specified [ 1822.207132][ T9585] xt_cgroup: xt_cgroup: no path or classid specified 00:40:25 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) [ 1822.250273][ T9586] binder: 9581:9586 ioctl 40086602 40b301 returned -22 00:40:25 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x5}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1822.302232][ T9588] xt_cgroup: xt_cgroup: no path or classid specified [ 1822.345906][ T9592] binder: 9590:9592 ioctl 40086602 400500 returned -22 [ 1822.388330][ T9597] xt_cgroup: xt_cgroup: no path or classid specified 00:40:25 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee%\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:25 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x7, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv4_delroute={0x64, 0x19, 0x300, 0x70bd29, 0x25dfdbfe, {0x2, 0x10, 0x80, 0x9, 0x0, 0x0, 0xfe, 0x8, 0x300}, [@RTA_OIF={0x8}, @RTA_OIF={0x8}, @RTA_METRICS={0x26, 0x8, 0x0, 0x1, "6038a868df74906c766610f4cbd72d6ebb627f23a59c009a409a8884717fa8c52b04"}, @RTA_IIF={0x8}, @RTA_GATEWAY={0x8, 0x5, @multicast2}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000000380), r1) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000006c0)=ANY=[@ANYRES32=r3, @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008001694e0aa3a090cf72ac12502e0d10830b18e50dffd54b45a0300e5b572139dea66505a34eefe1b405b1ceb4e040000000ccc77ebcdf8990189004811734487e476464b9566d768047ea5a7824f654b35a7b9a6b5020000000000007607b4c59b8d8b3fe74b2a1f1b2c56835eb6230b012a496fafaeae46", @ANYRES16=r4, @ANYRESOCT=r0, @ANYRESOCT], 0x58}}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000340)={0xc8, 0x0, &(0x7f0000000200)=[@increfs={0x40046304, 0x3}, @enter_looper, @enter_looper, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000040)={@ptr={0x70742a85, 0x1, &(0x7f0000000000)=""/17, 0x11, 0x1, 0x23}, @flat=@weak_handle={0x77682a85, 0x715870ee29fe9891}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000000c0)={0x0, 0x28, 0x40}}}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f00000005c0)=ANY=[@ANYBLOB="852a62730100000003000000000000000000000000000000852a6466000000000f60a73399ee57ec6265eae609e3877b5be051b369c6d7a6c7f5bf66d73c8017cdf5b73fbab890d8a591e4f62e8fd67446b4d01dec036d165969c7e262cb16e79d0e295cf132905ba2cf15232a77f2adc666483379941a8c9180be01e6f9d234fc5970841681425e4e5b4c71d8f53997b555ae97fe8867748c8e31d241816d3779f8b34f0724", @ANYRES32=r2, @ANYBLOB="000000000000000000000000852a6877000000000100"/36], &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0xea945c2ebaef988}, @acquire_done, @acquire_done={0x40106309, 0x3}], 0x35, 0x0, &(0x7f0000000300)="32dd2d0fd3f75c0bfd28a03f99902041b71631369fd5318dc900f48d025de0bb4c7d70725fa41666375827f1fb2d46771b3750052d"}) 00:40:25 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:25 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x48110000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:25 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:25 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) r5 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r8, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40086602, 0x40b301) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) [ 1822.614426][ T9602] binder: 9601:9602 ioctl 40086602 400500 returned -22 00:40:25 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x4a030000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:25 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x7}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1822.655750][ T9606] xt_cgroup: xt_cgroup: no path or classid specified [ 1822.663286][ T9608] binder: 9601:9608 ioctl 40086602 400500 returned -22 [ 1822.678860][ T9612] xt_cgroup: xt_cgroup: no path or classid specified [ 1822.686572][ T9610] xt_cgroup: xt_cgroup: no path or classid specified [ 1822.744488][ T9621] device wlan1 entered promiscuous mode [ 1822.765335][ T9620] binder: 9620:9620 ioctl 40086602 40b301 returned -22 00:40:26 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() clone(0x4080c00, &(0x7f0000000000)="18f976d8bf64c367d6277a6e1af30770cbc571368bc702efd950dc827091371755adbccb7818713a5b09466f47e649c8f2ff309bbc08ad41ed6c6ab36243fac6d52a7ee76899a24692c225236e6cec91f94901fc1add5fa701a8b4f81faa1bdf8ad0feb077d7d28e7ddb90", &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000200)="086052f85ab169038e2f096acb880840cef0fe36a1ddeedfff85bd47b14ec0a6003ca3b60a73e8a453a1409d774e72c5e27775721c40b1a57808dd1255953a3d8ea1a0351ede0dd2ce48f31a784a264b0d4bcafed2febf2ec26a7076d9ed8ff03a1879586d3701e1b3be1f818bd91d521fe238acbb85d69c653cd3cb0482c28e497d06f315ecdd0f7b405fa11177a840e0d1d603d9f4196b569d52fea6ef419619de5fbe0c38f9ddf368a8397000eddaa4c71fe2bba149454d28ab29f4488670af0a026b6376a0d8aee89877418967b6ff6cf8e3ebc42d0a468d9517cdb9b44d79325031d4aed0f3558deaa1a35502614b2ffe4a29b2f4f388acd96686672a4c643e2befa0866cb843efef2d3b2e793f5558bb86e658cca95eaa1a57489b46804c9b68ea89b3503366e3fb039347b5980f05bb495e8cc24df08949fa4470225b941c8864939347656b139668523ce0655da9ce42ca2a1031de10733d8927f9d5912dbb704ddccbb72109273135230d104773b17be16d743ce9f80e7cf823761dac5bae73302dcf59a2df137b97a3f4f9a88be9dec0b8fb5eefdd3479065524e4aa37703ad5b0ca2176e39136aa0faefd3020992df91645f008b58eaa194108011d9a43ea00c62ee0873335ff5cac1dbdc3d202024604da86ce8817ad546c839b7edae8fbcac6bf288e2f105ae07124cd47f00b10969816a71bd0fb0494abc6ce26bd6589112ba1ce43642e49f7bd7e7ffa210aa30811c0c8c18a5e371484f76c3f86f4788f949ab916c95d7d9b42611baaca83d1832cf9e2f58c07696f7fd9afe21102d527bd34c4f6a48168a4604fad2c92ccff3c6521c541fb134f95a82ce9c5afa228f4342d9e60e77b3ec69267c7c590635d4d3bbbca3dde50d980f5c90d4ceb2abceec912c8dd2a9686cb6be9589422cdcab3e2d348627ff26811d1e0829b48c108bcce8bc9a7e2f7acc42ca0322f7436423994de8c8be6596b243900e815aa790664faf7f8af28361a84369328e35646fe6fd663941c5afe3a811f3b673ac9c617ee231455c72d292924fdad636c54dec2f0e43215c6e12db74921083daca6ae18498f760910c3096b0481856b95469f212b5a70eff6ef8d23927d2e2e8afc8d6d19a8ea6fb05901a0c07b3bf7d83869df3cbc9ee147abe02b36508fda4efbfb5780541f4f70df2daabf72e024dee15b2b871bb0bc70cf0b08d0ceacb4ec57826d86a81d65b530294e7d0ee7824181368981c1dd8c497a3fc3da0c12b4632d7aed109d6f22ad39e2e321368ed91307348849b11703512725dbf6edc77d751c86605efb483e5bf8e845a5f1373d2c698b8b32ccff69da1a2081d3bd013260ebe4831f044c0096b3188e8e3149475cc7255a74d936e1f1bda52f3dfa53408392c9772c3f3005742fd596dd7519e4f324a787d0e9820333fba7307f49e2579bdd8fb373ba06a8f85718d7c7f71f395e45d4a82f8e807ebe9e6e23ad0d83a205d830a0e8593bf7232cefead0b03bf1008cffd372f42fb8f7c807560d4317b9d1c13434a6fce52d105805c09d5b1ed7cb590b92ef96fb3b1f6ce4c255864007e1446b6d5729e9f4219f1902c54e4ea6d6f7fa8b7e4771dff014673dd3757a270836f9c61d1c7af355a7f7db053b27bd7ee6fefd1a0a8064afb5a35263fae571eb15dd5b457d750ea8d290c93b469bf310421cc3c680c18a396f487dedd1dbfcedce927fc0606b5f515559e6133b85c7c2c44931bfdace89dfe68c9884583f96328683142487a1140c8843709b2653e862515d7d5aff8793846698e767bdf8b42db42c64555bb329e62aa76c5d1f7c11ccd120c8485247918f52c33c11c7e035e3d74c38a226862fa7f5b8f35a413667f84cd7a0764bed5852226670090c1875bac7a4edf7864af7e520f22b54baa7840eaf832419d811ab0e3d104fe2a599ca7d79725522659f0bfe29d7e844daf1d64e816596c8c819e0e4afc3ab80f47dd8a36465143368b62238f2b428b90e6c535f72163682bcfdc29f35d22e2b951675b87a3e7e513a59f144dc5f62c4441ec45247416577f63ae6deb3da6098e8fa874a93afa26ce3e677bb63bec58bd5541d7d235714409decb5da901933f226efe9f43cb25acf2efd7cc3c1caadce1332529e670ecdc53c8af23b31633a5e62a4c804e9b2bb79a33de38c6cac3dd89efb241eb8405f3154c58e4406ac7b2a5f52ddfdb1553fcd9452dd45a7e1516e5a0f3cfd0932c012d90878ed4c25f6eeae81b9f9c2c404dfa750618728b843e623f00c9a624e74d77a8a7df28c517175361243619e63f6df1f810a032615d74601dff7105222a1e3a2e45eaa6d4c85f6c77df6af7e214df003c03c0dd399945cbbe67e64a238d7086320adeb3f49c16cd0c83d1493a7bc3268e90d1aa5f67089496ce1cfc40c2d144d75795d289fb5e8054c0008bdb5998e60ea5b86f7b5a0afe68ed17e451e2eeaddc3d68b23a1913a06fc5c5377e97430bb91415cd26b1e6f19e36ed0f33acc645093ac3166132ea8b4841d687bc3544a3b4a32c5ccfa9f80f955b40a20ac783c3b2d7753d4ea990fb49be8f2b13700c09cb416e49decbfb7b02615a146e3141a9b1e32c4d14065a9adf142c2811d5648b3ee140030bdc01c4196e40b56401e03663bd5c8200f2001ded71dc1c6c6a3d08ba370a89af8af91f248de158267ab4826b1105dc662269f2737c2cf5c8ac4c86ad28b536360a7c62c2e7542871f9899de5b125e7343a3a07430a1450990305e525a06cedd6b9d7c1455d7ed98b8c0954413f74b2af4d8152314ea5b42192e93b45974a23511e38fdadc9a826e547d61a841ce0a49a335952cbf3235e3595296a0fffcc9404b5aa0a65a5ccf6aad6c312e7e31772f0097b4858f9ce80e718c06be41d88990c9d872c678d664a9e03a4a852228e5a02c93877b80a048b9c3185c23b2e8db119a756f63d1190b49c5789ead518ea6fdd1dfe5a7991b5153a0b3431717e2f38f7f0e78dc008faad14ee393d2a62946646a1b22c0099acebd12bac1414ac842755de8bffc03f6d60126f8f89519e8765415230ee3cf45906ac134409b04f6b73e18d081ae6334cc011d9d9ed1e2bfd878594e5548e62838068bfe40e93fe33b17b729c69181ca03937e68aae8cf4d93204fe1d48e57b675518f97df164f171d60023adaf51a243c7de3fdd1771303e1efba08aa0cd08b19a4bc448122e44ea1a4defff07baa23d56ebb61b6b74eeb3c1202b82b68e46ef07626dfd41a3b98d66d9f8ae120675f61f53c86da7b379f012846b2debec781931a436f9b35e0a8209b40db7a164cffe566e7adf620fa3d0b7ca2d57c6bc02490f5bef63430efae60121c40f9c915690e8c200503d6c3494807bd27c3fdf9680a6d26981fdd056cf54103eb14787514bb7a364ef5efb99d9d2c0e6d9c5ae5f6a70e02e694acabfe866313ccd335f9708c737fdbcf5fcdc9c8f7a4c27e72f126b5e95865518ce5e3f095397590eb2cf17f78258e657cbf08044a37b9089daf4291ca374ef34d5978e78ccfe0d41c6d6c39dcfdd8be9026acdd7f86a16212b7ea80c742ac68a303666641968034d9821212383d5522dd3443c2e5477e74211cef2d659e19b310be1dc8a8af7ecc8040d207a836bc24e81287c3ca46b5adf50bc2a17b24d03a33efd9d4130cd58cbb584aefe797a417dc03ebf2c3d0d607394882e23eb97e4ef61cc37d57d7437cd6c88f8e3e61ef25b26166dd60a9d0c68865fe787f1926c345ae4dda11e02fee3cd35e12eba7701d4106eb0c22d48a669419bdcd7e939371a7d794ae38a27dd16d74f1406d86a193e63a52fb5742f9736c504ac42d26c2f3e741c15847061d9e7e029bf804cdeb38f7b62c475bb05c369986faaf9132e7d0af44017d6232f6b60c948544b8c22fe40d36d0ccfcafddc4a362fdd7fb113e74c387deebf5500850c54684ec9e64e17d4b63dbdfc090ecc81b02ba199e367e3e62c06f5a7a0e0d10f5ec2083abce4802835d513d1889830d2437b523974016d273ff2fe7c60521aac819473f8578f5484d37d0c98e1bb7e25c4771eeab2c18c6fc2ba58fd0c3c151b25d1ef09da06f369ce158d57f1003ab6145b905b51d360a614b37d47ceb8af12de7c7f3b406f3a2fae5af7620c4bfeeb6bd6778555a43a6feea26874dfd4ea1b393fe24b52b8ab46be5e311510d1ee9919204e6fe64bad182959b6518983bc289d65ed7e4322999b7308ac9156fca1a97e70d081e9cecc93e63ac6d4a46c4d4acad4175e6e027d7894de22e8ccfcf519b023b93469f57db900bbc33e0c98212bd14ee7056d7e09d418c4fd58fb7ce7a41ecfc6d4403b56d632e5370193620d8f50c81323f2c9cfafd6bc4ba923317abbf387eeabafac1965cfc44dd0cf95da07b917192206ffea7f91fdcaf6e67673362b29a0f8231e0994bb49e125f0e5090656f5aaa2c004ef5fb3fee8ad74f38e26da28a838eb75480f4baaa0085fedd84eb334d613c71411e1ce80e011a319980fcef88421785402691d4b9c382f5507a4600ad4f10fa7220a9eaddea57230588ea35763dde347980d02f633be9948af5b221204347ee896d32e972fc0fe85ec428874fdef00bf66f48040a9ca9455e06eef6faf8b08fba2dcf2a6fce41d5ad59ee6a7bbf097a52cfae1efb1ad00aa03cc58c42a81ae8333e16e3071376da3def6308d91b9719cac8df02e596dcad554d7cdce4003a303cad248f75af21756dba5ef0bc126527fc4c3fffe927ed88e9233f457c36ade9dfcfcc2cc9418ceabe010278686ca35ee3c12ed70ad20076b72d7ae69e387463af2bfd27945ea34cd76b931f89f8e1aa3fb0b66b9a6899e5602ecf8e253552d6bad8de45f7c28a090b01bca157e4a15244b51d4bcfd5073cdb6199442f0ebb0dcd8e5e629e47de39d8adc2b8ef597b28c16e4b4f79aead1874b8e5082514dd4d6a16622804e34bec40eb3b6b26d6607df8eab86abdefe79ad98bacf07b04e4e4adf054f87a2a60693315c4556e5053f335b918f6b1bccc907660eded8e31eb932ebdb4922f4d28eff432ceca72400cd5b9b6d3b24820abb19dc6c6c1e0bd4ec0b282f96acbfb06a6c7ed348ae4039d27fa7b10d0fcc0f5e54a1968a066a2f38dfe8699212d75f6bcda85257bd9c2d504c56fdb885fa90a0efd7c15f1e9bf4384fc254e7dad9a8acef1f9197654e33c2ad1135a5097ad94c424cd781452c8247da53d1b7b252d9cb1911f664d78df30146d17d4232304bce8a986922d337854a0f93dd4fafb3d3c6e6f3d143453b13f9ca71843fc75fe562eca3d1c1c621c59ca1ebdae3ad951fde6fbe25a6f8bb4cc31ce5fd00d2989e128712c1f88cd6348a29c14d2c76cd820801ad67b34329289250b3fc50dbbfc20b0e47a1672a47f4ac513dfa3f5e009e0d1186095632a6d656414feed18cd19e1b2e4a653ef0dba2f9642ec9f46ae57080a76c64d159fd1c94430fa860306754065adb6e32e8295935855caa5809f3e95a23f3883e4606f1d455cada4953bfe8097f8a0116823f4aa0842dc52e39bd58447fd6085ee0d80d80d4cdc2833148947df1c6ed5fe778f1479d7f5a2d000b823017e83bd3427b8f021c9e43c04a212b585d4d065e28325c80fe339439d64afef7ae9abfffb99d7d737612715dfccfbb4f49ce924b36dc715efc8a43fd85b194a2e9a5d5da61443c7987ad52849a273365d14ca707fa5de8b860aaca4c7d0b392ed2a2dcd766c6fb58c58ba60a29c7314fce2b41aab43eea056b369a263559936f95da63306cb") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) [ 1822.794586][ T9621] device wlan1 left promiscuous mode [ 1822.835404][ T9631] xt_cgroup: xt_cgroup: no path or classid specified [ 1822.836893][ T9630] xt_cgroup: xt_cgroup: no path or classid specified [ 1822.860554][ T9630] xt_cgroup: xt_cgroup: no path or classid specified 00:40:26 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x8}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1822.886059][ T9634] binder: 9632:9634 ioctl 40086602 400500 returned -22 [ 1822.913306][ T9642] xt_cgroup: xt_cgroup: no path or classid specified [ 1822.913908][ T9641] binder: 9638:9641 ioctl 40086602 400500 returned -22 00:40:26 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) 00:40:26 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0xf}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1823.068214][ T9650] binder: 9649:9650 ioctl 40086602 400500 returned -22 00:40:26 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee=\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:26 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) clone(0x64008000, &(0x7f0000000000)="3585f2012e66de747a710b527ed688c9126dc0563d6bce0c032c2512154b034b03113fd4e263ed75c9c76a84a930c964be168e9b034787210ec32265ac5b418b8f4646f42e1a300fcd51f8ba0214b60ef4e8c69f90f59e6d1be72323d71a45eea863066a7a99cf900afa4c3fa5592a8e7ebfc1a3476f", &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)="e9badc5cd35cafa5c27956caa5eeb6607897a9f2e60222f5d786efdd6efb1372af6f39c16cd596514e763e24c77d7a17e95ed6f2f89edecfc7cc8c9c3c74bd5b01efc00fafca2cb45ce0d8e2843af7e96e5d828a476ff7651762acc800367ac2962224eac6c9e39a086ea1741d37e46df470443a882f4b84507bdc42774ebda8dfdd0e11d43c54c1c23556170cb91157e85ba3a8c0b5fb93adfe4f17c3") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) 00:40:26 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x12}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:26 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:26 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x4c000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:26 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) r5 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r8, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40086602, 0x40b301) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) [ 1823.372943][ T9668] binder: 9668:9668 ioctl 40086602 40b301 returned -22 [ 1823.389072][ T9667] nla_validate_range_unsigned: 6 callbacks suppressed [ 1823.389091][ T9667] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1823.399071][ T9669] binder: 9661:9669 ioctl 40086602 400500 returned -22 00:40:26 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x50120000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1823.416973][ T9672] xt_cgroup: xt_cgroup: no path or classid specified 00:40:26 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:26 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1823.474043][ T9681] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1823.509465][ T9687] device wlan1 entered promiscuous mode 00:40:26 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x5a000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:26 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x4c}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:26 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1823.594499][ T9687] device wlan1 left promiscuous mode [ 1823.614469][ T9702] binder: 9704:9702 ioctl 40086602 40b301 returned -22 [ 1823.625617][ T9704] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1823.699273][ T9710] xt_cgroup: xt_cgroup: no path or classid specified [ 1823.786820][ T9722] xt_cgroup: xt_cgroup: no path or classid specified 00:40:27 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x00 \xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') [ 1824.061050][ T9750] device wlan1 entered promiscuous mode [ 1824.078835][ T9750] device wlan1 left promiscuous mode 00:40:29 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000200)="3de76d9890507f7bb0184af0290dedc416d21c1db7783fd8c70c505e5c3df20c51fde75cd9c13676a0728516494c696f80ddc5b1807a4f956d0bd8996965de2698dda59fcb8493f45fa29b4cf84268fb30c7301c62703350616d6bd1a25d79cbb7bb4d7beeaa6a92eaa8b085e3b94bc136e713c3b4d707ab23c9dba5f3f590a9f15cf1b8489a675f5b8b51129bf3612cc4f998e35c9b0f27e5d531e17b3377bb0686e773b8f4d9c6f870d7df0c815794cd7e6d5eaa5636727252ebaecfc130acda635d9321d6d9e9bd659bf22c3d7ba5fe88e8a86313d2fbcb4434d41254040ec96ca51c34154f939b698f9df65d364a53f9c1d3bd9ad7fcf95c29585fe947344875692296afd179d6d0fcd7d3062f8173c7e5d65408583a4b2a8f71e12527f3e7b4f22e977de777ff4806a7bb92d3e4efe71f9d25f245ececd5f7781878b348e4fa4fd104fe50d85e7f7898f0a7d0ac339b0acbb1e1cf964062b3db20dba65570f98f9ba10ba1fdb42083f96ca5a400edc57f6fe19b06ac1d7aeef77911d47bd104380b7eb7ebbdb917b2a14583eb2e160c4315dc1fb4ad4d03ee577c168c30bccff3e42202f43ab66494f385c3a335a8fd85855d72d1359a55207ca286d82239bb34cdd7410028587475e08655b10e1bd676d043900f9b5693fcec41a37ca06c7c03ff92c2e9c5f46922049bdfe0a14a3d2a001d23d65e43659643f9d63619ce8ef0aa411a1c614368538f6fc1950f357ff02bb8b9d3bb409fb396df42a7a39faaab52cbc44c93c37b7514c25d01696b35729a0e758bf84c3c9cc86af0e8ebf1a8f976868096edaca2d08b2617c8ca0bd38b3282d5c8ec750734db3950c50e94a0349a1b315c7faf8a53dde80ea0bc278c164613e0e46809057ee0375fb1f6fed52158311811a61ea3913844e381545997b5b886ce4d58c891b11b0723aa830cbcab0e996f14144fe94fe799e412bdf8edec5654555256a721353750fe8f5af1f679742fc705bcde4ada0336ed480f094c7fe9a4deec23f1341a68d516ffa26a0c8fbe6aabef6a26a7a697e0a3cf4099045f5f9ba1eace9a254a9e38139ae72732b1e2f5f7e9cecf1a45a3c5516b04983bed9b00778d8fb42f172350a06d70729313110292a39121dc92e0d35be7a62c87530f659ec017d7f84f8869c76bcbd61051a7b05d082762dbd99326a13a3ce5b27bb6105e7d8f4ad6fa30746d4c113f74f522e1534f9ebc71df08e269d238d5797788a2746ca8aa3ffc3402100187711abbaec3fa58e4b10fad3a730b44a0de1e73464b7604fe7b161caab1f72c664fa868b9b7d7a6acd7412aa2c2d7d0dd1f16875def6906557702c470c23f3982b788888d62f55306772b1ba2dcf4ff7c2070665a1035732337cd4154150a6919134258fea0909ba63ba3d65fecc04415afad226bdd1f583d6e14ff22ae6dd48c108ce982618fdba0332f18cf62db4843e5adb70e54c72c8324f097e7299d73a4c0cc09c4dd009fe6032a0f9d7902af8846e86356a1112df9251dc9d4834ffb53232f87e5d14f63b480fafceb674968b60900116fcb86bc4b8cf91fd26a5dba09cad55cbdd12dbfc0f89e666af1097d81902fa0aedcb50f903e7007be4a890d71e281cb424def072f232053bf9204796cbce3b4c9234ff3a4204ed8172a5bf63649d795fac7e164b1a04ca142c179c23739dbdbea8f7fc31bb30c1d64f387e6647e54b0a38f4ce9b6dfcae0ad7e62fc610fcdce9b6e465e5c0cf50c52028eebfe5241c9977221db92c6c8058537975fc3b0c9fadecceee96437ecbfdd83974451d25bbcbcdbf233a726befb9807c02acc79fce23dd8b4e683c2686768cdf135393a5e21e6d659840acefff3cdd572ad7df13fb6aea2c924911a1e93e5b378a41995d5a7cd02917c53a0cbb5a97753909458838f2286bb1dfed9cb9834fe023190e8bae20667b5558b66d29de523d5615244b7715d355ebc74ef0fc1b70b5e79f014a340a2407f47306cd150db1a323039f9369031e10d06de2773a9bc86fed0507d0e8b65272c765680fae1ffb86598dbe8c58ea5584471ae889b7c16b00d8b01ac2ffebc3edf1e808d9215ffcdc5c0bbddf6dc5317fbf494f5dcffe3bd80e96d7bca7c9196c62a0f6cb9307f5e472fc91cc588150e772057a9e372b77d63fdaf6b1982b1b5739ac1a6618f81b55375646759b8ac26e248abaaeb2ebed84143e154018a44332bbb5daedd0b445dcd6e55aaa0b8311c4a7dbbd7105308d83f8bc1bf493d573e3e6f5f35f17e7fa6f88e54c7b84184ed5aceeb689fed63174be0a0214105f1b2625c502ef29afb0f4746163da0c937ce93387a7bfdb9c683977a221f4e7b4e5dd544c09effac3bb9bae7c0d978fae2b46d786c4d35a5d42b15865369811b618044c187d8235e1106efb4d9518e7e56ebe377034fa0cc4c5c736e62b145825fd31805694dee056e1f2e8e1b314dddda724d6f5df195516089da37a33da9392a421e2a18b5489b91e737eca65130949fe1896b4b5e44d15bdb547d79a1b1bf50f77328c0a44a2633313f9b368a46041231798e4dcdc3c682099bb8f4b817fd47f90f9827768a98ad20d5a252af239df88b9187c753bb300ed249cbc09774382b53f7dd4383dd968aa037023c8ab9280a4528a3a74cf4ce0116eb4960af84741c772101f5a96438f52442185a9d037fdda599e51fb9955b68ec458080755f87a091529e07796fcb8f3930156b61d5fc1e1881675fdf32e560b35ed37c958046fd7331c1193703df1c27bbaaded7f9a4a21d9e439b5271575c14387f9d943495e50b416fded5ec85f021bec5b31a23a2b8bd908cf5790ea610cc991ea3bf72ef1d59ba7ddb2e41706b92b91431d9cddb1a3749fc518b5e052190b88869b4dd95bbcb57dfec453f438ac07330663e2f5717956922b15c2160d641bc414865880342f150fa1ce0e3c39448c95796ea956b1443eda48d04756e552d0a431e1c2bb533bfb5a1f381833a8e560212e785208947a3734f8627f69513ee9de66d560c6bde7ddfe94a09db7684548b50b0ba68309bfebfccace0d722113667236d5b2848b30960f694fcc5d9b9365a9b2b212e91a3ea0e0d7617cc78a3cec4f1d4b59f2d3b5c88e19c505db18c5841b29b34d7053357421c29b82566f767085ccb20dcea56047aef718dec6c67a45a4fbc3d5e6b637944bbeadb8fb308889ce0e4019571008e02512bf526495fcab459f81bba55a38bd226cb11d3159b81180d7eb2f42f5c5ef8d0d574e96f0c114491d9f83333819e435a2f8c118ca0fd2fd6e2acc08e2a2f9ad26f9f628f8004d0d872954263768f60adebb132434c6e7f6d943f23bfad326d0659d69f07568d1ab0954eb0cb96bd2a01ff3853de15e3d37bb399447081bacc34f4d04d2ac65289d371b45a1f9d570c2db70dcf5e801f0d7f08c8b7b029aa97e74237788543e6d8b9d390f921d44490284a4f2dd4ac02011b339f5959e49bc7529153ae5718dbd1017b8edda97364002f2d911f5ec877a2a1611fa9f37d545938c58df11a8b397f62facf9fba90f0ea99a906e95559ac24dbc41bc4fefdb5174c355aa71fec399d0742bafeb38982f561305dda86fdbd9e31ef7861b7c8d54ceb5ecef1f03d572cf6e47756964cfaa2932247cc46834490e1250d8d183fc30d21301c1202ad5ec3e3f0054f794cbbbc8f4c7e46735c1a237498e58560bd300c3cdc2d229ed50683b046611a3df6f62fbf92b7dcc1970e15846572e46c97ee9c16463f7cde9f89143ab9e3f05c05eadc7d911531236b8394d239f9b79d10ed52280d9ad163a64977a36a9e33cbf3174f24ebb8a5ceb24d2af7d6ff452ce08ae684aace8abb2aae14e9a05328a0fd58ea4e7988e9c145b5c13f5788fabc27524d4a390807a3b354c7525bca4f44f23c2105189db00250f25dedbd221852c3f1e77f966fdfa28bb4474ffcf2ac67e90cc38d6401d24aedb12a72bde2e73a10116391b28d0f66df3e703966c67e950f0bf176a48434e85845b3f817c162ad9bc7ea13210fb433eade934d1e8379f092837ff8fdc0d01a8a493ea8e5867650074f0ce88572c8a53e10731b8f523a29eb8f56d74eb043bd1fed1301633b90769cefc704347b27e8d2dc9fee7c99a5660ada49cca358cb1cdccf5ff6e77a721b8ca0bd4b1df3a5b2283c5c06677c5d2d2c719b3ed93fdd1dd225b70be28d5ee1fe611ea8fa8bbffb5bcdfebf4687cadce90b8be6bdfdaca09ffe2ac882e5c4aa5bc98ddf1fc7b2b014cf8933f3b2a79714337f0458096687c2c0d4d01b137a79ef8924633c9122f3e929ab307db744ec97541a31cfc3438ca58dcf7bef564c9102b15e55e11259ea26bfb3a6009b8b5a9e10419122d1ebd8de81e0d2580fbafbe96843b603959ebf21d8a7adc7b77bf29d8660941a0b650de00fb95869e38277a6a9cfb452a5dfbd5328518062e33900d2fcb13c455ff8c563dc426394f10a03fe377bb4a53fa080154ce4f879b9d2dd713e83e94c00c2ab2d63bec5fc09b2e52a18fc79e9b55a797a9fb24ffc36f3bfd6483009c9636601cc4cb0f4eceddc1a5d39ae776bfcddb32356d6fd6dfdcb55d82d20b060d64c5709715264312af362ca8622d12539dc4c29b338e4ac7242ca9437461ef450ea1e33a8a1c32daa4fb885665b8d9f296c0dd13a633e6f4fde6e913eae101ce260d54013208230c3e325767ed9c4ff597f6e3bb97670ce17f749eaedffd8ddcad49fa0e8fe0b2efb57b3adeb5a7a9a2a759e2ca6d43b9ca854ad380b6e5c53b498efb27ec565d0e00a3fe48405f703faadf0c2285fb64b154a6c836a3733b624f0cd6f7e9a0f634a1e4a11368e63c955c6d703d416a8291287190fefad2038da27f8c6c844fcb9db666da55c52a5f90034ad89c0b0dd4975fa4469a910fa3ab9cfe5c3b94797d57286fb0ee230b57b9109a412406740462716c8aab310fc28aeb9fda037583938fe746744a032542c87bf1f34a95fcefdd791fe3d1353c529f155b81b89aa1f5f1e8ece6a518263129a03135a8faf093f8ad77c2a20a535cd7d463f32884546cccd31ddcfafe7a99cdbddbca23fd36609fb9fcd30026496c2acf91e6c6582f85592c2521277cd1e9f907ae96f2a1bf1bdd6926be62df0b28300b1375e0176f04e172243375c6eabed76a782195eaf421c14cca294feb6d5ba4786527d91a34e0c97a74d1de2bf18460f0f168c22249aabeea5bc5a52c7b135b52da559e3a66fb7e40e708252a6b1b6d79a48d06e750bb335cd04f405f06cb05e0e15bd431919c0cceca0ed385d639f1977230d153aaa7b0f7259f7bf1e761574576c8154a3fc32502b15002668b63bc82fce4a852fd1f30adce6a6c88a7e55ef32ec82f26f5bd8afbcbb16398d3c7b846bcf58cdd8a65652dd64179a5a4cc7799ccf5f0b849cf61ca535b5d8981131ab306a960986b34397220a0aef60477fe933e72df4a30491fd5d6a5453d389d09ef923d2a54a2e6b985c56895996c16f8aafae9110ed489b0d8f17d242bb90dbf00d8372c240e53f2d85b482e56d8b8d4d4be8963ae0df06003943206dc2b62e39b5c10cf402726604e1913b1dba9de31aafb0fe8a2d539502a253a8b5cc61dbaa535a4b2d1f43180c91467bf0aefa654fc74cc795d346ebbd74b188fafcf4665d4fd03e1cf9642f0b386f0b256c13888fe6e6a2a7249df49959848f8522e8cbdb4b5b4198fdcd0fb96a3a04ae46a19162c1f6978e81e9ac59788142f86d837f8a9cbcad33cfb8d1d3f325642734c7f64b6a2e899f65ae19", &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)="50d6ded01eae0fc74bcac30de54fe9c6d5c1c0eba9d1a2ee43beb2b8ff66aa3d438ccf3f0867918cc3a1dc23fb9a7da719fd7b255714ac7cc5a94df967c7a70cbda95c729e0a3e41") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) 00:40:29 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) r5 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r8, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40086602, 0x40b301) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) 00:40:29 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:29 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x5a}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:29 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x5c000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:29 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16%\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') [ 1826.632504][ T9775] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1826.650050][ T9777] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1826.667613][ T9780] xt_cgroup: xt_cgroup: no path or classid specified 00:40:29 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x5c}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:29 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) r5 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r8, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40086602, 0x40b301) socket$nl_generic(0x10, 0x3, 0x10) 00:40:29 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x60000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1826.683995][ T9782] device wlan1 entered promiscuous mode [ 1826.740237][ T9792] binder: 9792:9792 ioctl 40086602 40b301 returned -22 [ 1826.751871][ T9782] device wlan1 left promiscuous mode [ 1826.765427][ T9794] binder: 9794:9794 ioctl 40086602 400500 returned -22 [ 1826.769844][ T9783] netlink: 'syz-executor.0': attribute type 11 has an invalid length. 00:40:30 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x60}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:30 executing program 4: clone(0x3a3dd40086892e41, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) [ 1826.888567][ T9813] xt_cgroup: xt_cgroup: no path or classid specified [ 1826.913335][ T9814] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1826.934593][ T9815] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1826.960109][ T9821] binder: 9820:9821 ioctl 40086602 400500 returned -22 [ 1826.989357][ T9822] binder: 9820:9822 ioctl 40086602 400500 returned -22 [ 1826.992376][ T9824] xt_cgroup: xt_cgroup: no path or classid specified [ 1827.005041][ T9823] binder: 9815:9823 ioctl 40086602 40b301 returned -22 00:40:30 executing program 4: clone(0x3a3dd400c580af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) 00:40:30 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x68}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:30 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x6c}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1827.217810][ T9838] binder: 9829:9838 ioctl 40086602 400500 returned -22 00:40:30 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:30 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x74}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:30 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x68000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:30 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16=\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:30 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) r5 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r8, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40086602, 0x40b301) 00:40:30 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x6c000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1827.478934][ T9864] xt_cgroup: xt_cgroup: no path or classid specified 00:40:30 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x7a}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1827.580479][ T9880] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1827.597909][ T9886] device wlan1 entered promiscuous mode [ 1827.604063][ T9887] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:40:30 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x74000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:30 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x8e}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1827.629784][ T9874] binder: 9866:9874 ioctl 40086602 40b301 returned -22 [ 1827.648148][ T9875] xt_cgroup: xt_cgroup: no path or classid specified [ 1827.655771][ T9886] device wlan1 left promiscuous mode [ 1827.747158][ T9903] xt_cgroup: xt_cgroup: no path or classid specified [ 1827.808597][ T9912] xt_cgroup: xt_cgroup: no path or classid specified 00:40:31 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="8de2b25bc21d6e5a3a50c8a3ea9c9c700dd1e0ab76d8f05ab85f08b03fcfb73cecb0cd62e16b05fcd6585552cb3eb32297a67308c642cf8c9a55b4d75737579df880a53fe707b4b11d29ec8cab5ffc792cab92640d9a351e7a5e6d8733641de28e9f", &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000200)="84bd74e15ec18ad4e16d6e7743c34ae0be8c3545aa65bf654a353d9f03b3c47d1bee22e576527d1089efbaf357d2c036c98e9ea62e34bc987b022b8b5a00e89c5098df11d40be49482e6f5afe285221bfc2a5e7e6202598422f842fd15c2dd114a77a83f92d188a9343d8dc64a916b4ca4d57b1543c4b10ef29a5337e3cb6e33e7380f22bd190ed4245b4b2ac771be58f0617ee04ea0caabe5dd0d952fc76218f9b94041ca3c284340701054749ba85d9ce0efd2ad11752ae9bcf5681a8b56def194fc807672f5fef0f2adbdc16453d109dd6894730d6922cdd147a4fe3619d8d22eedfd6aa4b91202f153cbd25e2b1fc14264a5dd3ba6c54c40797227375386f3932ce7678328ca7b315fdd76f82b7c9bbc2d7f06cbd51364c853101f68603f791810c5cbcd4e8b4196907e370180d33685282793bcf30e734be55282d9bb6d90420fe19e9bb83c2318bfd8be29b8b96f43be433908d3dadfec157e4f47333cf74a15a5c7b2d8375540a751c5618da11f2fc7920667924895de0e2fb58d501d04a43c25538750814dfb02e4c4a66c4a56e2d28dcad6178afa7b70f7a68c1a0b52572826ed0b49261e83e84cd649f5348b837278b942c5366670b11b0c7da85bcea734533c3c1add96f3aa1dd2bc753184bfff42047af758264914d44caebd58f960d2719daf679780d1f022be7a21430141b66e96d1f41c9fe4a3ae8ef0cd855a110b079079d717d31d2124e90028ae3f539bdc26373b65b62bffc1bfe1fe2752f3127f4a457ef8aa0a3b5cd76238ecd9cfcde81d0225eb84c13bcf663fb531f16071b5d3f3b96d3b1edd4a5f1c0edae8eeaf961503b99acac273be9f0bb93d77e3251c05c4ddb4484e6458419928f2c82d90c00b8618236c92dfab0489dfa98f41143de483781c384fd1660175c419aba24a6a5a0f20cc8379865ce5ac43bce335f4a699ae6b9970f02a527dc9a71735b0d68b2946906b1f6081fd0fb45b3fac34c3044a42ecf973f337fcad77c94d3049bd7817ee4a0d77ea2a8de940ef5c6993e2bd5b134f1bb47273db460a07adb978402012685a4d758e661fea20921bfc418281aabf15358daf38184a364d6a6549e3b91806a4c1d3c8863caf3fde19433bd3114f1c352c5764e8c12612b30805bb88858cb3674bcaf2af3992f13b0b1ac7cd378cd61427dcd78d0d2e915f777455064ff079b805adb4910581b3a2016d15d5171a3dcd34cc29a0e9b7ca8754f9a5622ce8dad7417d9c5e84c1a1d9a20ad9f35b8d591259b9fd1017ac855c162eb869a7fad892eb671ea1533fbce3545cbb84e906124b43e5425245859d66b200a1792daf6c894a86856e7a9ab0059f614b559e3d027de5abc6b1465f9c557a6f74c6c96cdc8a81d78223ec89fd95cef16c6f10006870980979cfee34558a463f3b21ac94729d4997246a1a6861155905e29f2e2b5b8f78d05dda3d69df551e9e6fba3cc470f57ca53ecb4596f2911c119a9c20f533e33bb47ee658f8257163d9427dd88c47745c756c393570e36bac69d72c2635f44be71dba156db3b4353c4cd035630980f3b40c80851bfefc16b988805d97c9c8918c23cfd87b05aa61e25408f1fc4e55a3845fcbeb5fcbb6f2da480c24ad7166d3824bb8f836e6f98db271d8c1105eb345961bf4cd765662b64d76a06e3c9ab445cd0a446801704d97cb430b5199ecc0ac16065801f1503fdbdd9626be7ff18c21d298eadeb014c2a3cecdf10c61255625ea778b71b6cf3e45e5bc83b1ab4de4f8c3d1a9e824624e1741703cd7c91f2035f4118fd6b49b78126e7b33e2ba5bff0c0d39c277e7e410784b0adb6ec974bbc6aed9525be9f1c41f02526174047eb0696970dd3a78bd5f3fc266ce12b40f40415b25df0ccf98e882daf6bbffd9ebdb6328cfe8487f4077912525aaf73e8e8f41c07583d9ff8e46d0317ecf52e0221fb680634499cf524b667c036c39769d6d896454a90b88bbe4c3a41d281a41188481fbe9488c12727ebff795d092b160d8b29d74faf28b272205a87a3e0f4de773db226da802fc07b5d92ba37def5eb653baf3819c4aeab4124f04e119226bd7baf4783fa642b9bcd793d583f952a65ac8cd9f6ef76e9f52ed65aea7c04d99ba37afdee887a31d3b2c54749e252bac83dfcf5fe273fd27e146a373fcf525dedc6b641a3763d45c52012a130ff5609227e5499293a83c1198eaafd9976079abcbf2a072748a98ba86473f8e76192be0e0093241eb93c9c476522d312fd5de121c80d84ad5f4ce4125232ec1161868934c8825fa4d3902b0e056d09608c5d8239a1d08121e50c042dee4646ea1380b1650189b5bbe2f8a2fc2e4687816a08c2faa81a83ee33b0104ae2c479de79b00a7888ce1f667227dfdf6dd2b28cfc2f7c7a5acc0cf578968a5405c5e5278b0a218ceda27e7a2f2c400f91e6f61ab0014b92747dfddc25a174f9416f4a40dd31571c17a3e54442a050e6faeb1dbe1a7a6c30c2d4a1957672d5599e0a0d68668d1ab4d00cdcad2b5fefa7ff27acb150c61c660c8addaa44a746d757812e67f4d8e119e88816a733955259b2ddfc139cd74511e49b7e17c715851d43bb87dcaa3c19e02f1dc18fee54168f9cc2dfb1128c478c5d9cc03ebd4b82c138e949e6d069ffe335174e9daaba86ab93891aaf4f9d3c49258965ebcc421e7c058a1db72768e4cdf60cce264793ab207fee6b7d0163c8ac7ba810b39f9a8478e02a6ce4629549c70ebdcce1df00b9aec30073e58e674eb82ecb5b0dfb0a2be74870251d2c7018557e76d36533089f7ec108edd21cb90c437845a8b2c3bc2174c5f9b73cde576b227b0ac3487cee3d23458ba12cc28142ef64275279cd13d778c2fa646ac7359079bbecabf1449f255789e881a1595b5b81e28223a73d4b206b0581d1d48056b17191abb2f76ee352980c47df300a2b965cb9301c110b5f211fd2e0262ba8b73ce1aece826d9eb11ab3f39ea5f3e173d7cd5b1d0c4a0a1037d944d41cb203dd447579439af77e8fc9972b601909392e57b6a986cab4daf07fa6ce44ba19f558bfbaadcea2907f9d6b9d17032383beb225a3e80d3406dfd34c0fa478c5cd1fbf61d93f9fc6c9f02be1e9abc33d5a3253c711c4836b2c2ec3130bd1af21d57c17ac174a7e602eae1608314451e0a16abea9ba360fa8b86137368db507f30152de2e1dcd3e019bab66a85fbb4d7b1135a152133d0ee8f7088d291fe7cf5a2aecdcf9dbbd739dd4a1ace3355b8577509a43bfeb35b8e21497cef33b1d7f001cab7ae8392450fc52d38d5ab241fbac91e5cbe925ef9f87e898d3eca3f75698ac615137be00ae745eb16c362c0ae0ae30a604f80fb6406408d0641ab8bdf1070c70fc38a7ca27ca37a9e9b836f0e1856d882033510056fdef9eb557112849c81de22a48404ec02dfe4a2d5a3284ca5856e13a6aa4562be679b604baaf589eefddbfc8a244b1b98d126ae652d8d27429e849573bcf760fde741572fd1ac2e5ba1dc43246fc39032115d6b56ea694fc4e6162a860d190b06a3c70cc821dbb5209081a5f8c9fc6f425f05c0c67b66c108504652b7a99b5ddf191262fdf987a1821edb68f6850c109e0c807b23bfc205ba4e8822b952897088188decd942ba57092a3c0a2992e62091e152d274db4440b412cc5b7ce608edd13b01ef4f210abf9387ae950fe5420a2e7f4c6d5f7322fa8736b2da430abd56328416288d509167f5b7576367ea3fc6241a8a805bba4a14fa25067dc8e1b29fddef772ca44bdb8d2c615b449a1d50cc34e5cd2f15d5368f779c2398886f1705ad1395d7b4d2d22aaf5f11e2e2c1972e889753ad0b8ae4e0e82c15187860d51bdf38722a2bf97bcef363db59ddcb50300f74d03df1a187aebeee34c1bf8f082f3c80c16565c3cfb5f0643ba22630e903340d9d9dc59a920eee5b7ca3ff374acfafaf5c3a81c0c2f21ed94b3d704ba398ca7e1cd08197b5bb76264417da13ce43c260f8b1ace0dab423111002e32df9707373faee6fed88d96220d627a5ccf2e0ac18f5c63a4f2cc370ca40ae3c59b9e8068cf16b744ad5e271a6e1c4b643b5319a9e081ffe5eef189c35038178fee1f7337c9fe55ce209e9ddfe5b92621b46cde76d9779b40d913b15c5ddb5015a27c2640a274dd7c96b96564abe1ad6f916484abe720bf9544a9f1a3db237136879ff4b992959397481dd0ebabf6062de269d6e169d95589769f450b03cd8a3f40251be59d70ead9b089424cbe6de8eedd0bf0e096026af0425242f9d11d845c37b0a0f212296088d0f743a5e78e24c6b92a76bd06de847bb23800bca5706c74b52e2a1d65dc2680ee80590a36ebff967aba0800bd64ba22ec6115c526969879da4015520cc4f9c15309e9a393c9610fd3900143a7fc30f4ba3a869e4c5cef1a13c353fb2d8bc42a1113413b71cf858d8b7980118efef65fceb58014c0fd849c353543d1a1a2bdfc064a9672458bcd3026f6a0fc1697828173a12141a098525493cd7af3a400b55f84e454de220599b0947f8fd65fa776ee189fe1d05dfcdff190345c8972bd27e1c4ed2d5cc18f641d1beab8462c2b7aacbdc7694651d274aa2a44ab8f997f94fa2ab641a572e04ba5594e04136867b59892834f5800f80fbdeb905a5db3875fbe6949dc1533699475dc8291ea4f8d668dab8bed34b415aa3e3991b3fbe7d79722c9b0cad21e3d0669d66321a130089bce3dddb696cfd4c8b4a97ba145049c8ec29dc8400911428f88fcce081168631126bca2002d6db62c6f9016e0eb1d7455da25a9104e587c5053b71ebe49ced5a7c0493300e5ff48d43fb7082171de970871bb7627e4564e9ec170616b436ccc60cb97487bb77273ceacd72e2dd09afd965b0f09d33ea41ae521829e9efa4007a5b82bbbf0f8e905cb355f14d85efd16ec144c4faa5ffc99610b54b9ee4d0b72a306e34eb08d94e91f523c8f22823471e9ab3b4b975f0f8804391708cb850724b07e0dec029f70d2f5ee118f8ea69835d45c51f7f7fb39ae679122704c317e731ca4686aedb738a4902c15d14c247fe314be9b8c67893aca439ca810831dd53d610dc20ecbce9f986c569ef258cf222ad25c47702a64f4a8b3a5c0aa5c37576f9cc124e0c2211695aec749adb02a3ac8fbf22df057f7ab928ce58a16c3e7b9a1f008023665c5ceb4f10581d12c2425e5569640a24d37c1eeef4ee9bf08eed688b9e4d2c14b5e8afec8690185b37818568dc3c580fc1f70d383923ce871c5ccdbf2509585981f9b932508e4d699bc860421c6db7cf762c86e9356aeef26674de366bad9cc547b4d81359640988b9fefc96ea95179c1060962293658dd7b3919c6f35d5c6c8d37e761ec980681fc6f85cc84355262ca24951a939a6da155de4e0f23fcec33c855e819a007d57ef9befea654e19195c7bf46acc1ac06ce17684ffa8fc27604d2c96bbf746de143901c8d7a379bb403a44ebedb3dc5949305c126d7c364df96d83b6cf466af461af81fcea72df60b00f5f58aab0b8b49db880fa7a156978e1b351c0d55d0c6874e02bbcf50d4b9c8cd0873f2c52ed778b3826c3cb1a39463f7390d1c9aa388ca9b041d7b555b57bd22ca5ca11a77c53719972bdb398d4a65c5be69d5ad3323b91dc38f4a12a617f9b5d3f08bebe6ec27a31058923dd47af9dc52e6bb9cae4a5ec051050e5665122101b0bac9ec42a5f7bbebe85c509505f1cd313389d80f006476be1626b021f2572f9b3152dc836f36958c4c773b74bfe1535ba33a604fe2af45f052e53a13603c9683c4e") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) preadv(r0, &(0x7f0000001500)=[{&(0x7f0000000100)=""/133, 0x85}, {&(0x7f0000001200)=""/226, 0xe2}, {&(0x7f0000001300)=""/5, 0x5}, {&(0x7f0000001340)=""/153, 0x99}, {&(0x7f0000001400)=""/225, 0xe1}], 0x5, 0x8, 0x5) 00:40:31 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0xda}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:31 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) r5 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r8, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40086602, 0x40b301) 00:40:31 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2=\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:31 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x74030000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:31 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:31 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:31 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x7a000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:31 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) r5 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r8, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r6, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40086602, 0x40b301) [ 1828.195459][ T9942] device wlan1 entered promiscuous mode [ 1828.204455][ T9947] binder: 9947:9947 ioctl 40086602 40b301 returned -22 [ 1828.226046][ T9953] xt_cgroup: xt_cgroup: no path or classid specified 00:40:31 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1828.259387][ T9942] device wlan1 left promiscuous mode [ 1828.288331][ T9955] binder: 9941:9955 ioctl 40086602 400500 returned -22 00:40:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000002b00000008000300", @ANYRES32=r3, @ANYBLOB="0a00340001010101010100000a0006"], 0x34}}, 0x0) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40086602, 0x400500) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r7, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) getsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f0000000080), &(0x7f00000000c0)=0x4) [ 1828.331093][ T9962] binder: 9941:9962 ioctl 40086602 400500 returned -22 00:40:31 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x2}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1828.429379][ T9971] xt_cgroup: xt_cgroup: no path or classid specified [ 1828.429403][ T9978] xt_cgroup: xt_cgroup: no path or classid specified [ 1828.444633][ T9975] xt_cgroup: xt_cgroup: no path or classid specified 00:40:31 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:31 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x3}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1828.508750][ T9987] xt_cgroup: xt_cgroup: no path or classid specified [ 1828.517195][ T9982] nla_validate_range_unsigned: 4 callbacks suppressed [ 1828.517215][ T9982] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1828.540219][ T9990] xt_cgroup: xt_cgroup: no path or classid specified [ 1828.547614][ T9992] xt_cgroup: xt_cgroup: no path or classid specified [ 1828.570515][ T9993] binder: 9983:9993 ioctl 40086602 400500 returned -22 [ 1828.589713][ T9996] netlink: 'syz-executor.4': attribute type 11 has an invalid length. [ 1828.600618][ T9995] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1828.627350][ T9998] binder: 9994:9998 ioctl 40086602 40b301 returned -22 [ 1828.647295][T10003] binder: 9969:10003 ioctl 40086602 40b301 returned -22 [ 1828.656815][T10004] xt_cgroup: xt_cgroup: no path or classid specified 00:40:31 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x4}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1828.677646][ T9998] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1828.942963][ T9993] binder: 9983:9993 ioctl 40086602 400500 returned -22 [ 1828.973424][ T9985] netlink: 'syz-executor.4': attribute type 11 has an invalid length. 00:40:32 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda=C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:32 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x5}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:32 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x8e000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:32 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:32 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r7, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r5, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) 00:40:32 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40086602, 0x400500) ptrace$cont(0x20, r0, 0x7f0, 0x8) 00:40:32 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:32 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x96030000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1829.092793][T10020] binder: 10020:10020 ioctl 40086602 40b301 returned -22 [ 1829.102214][T10022] xt_cgroup: xt_cgroup: no path or classid specified [ 1829.114553][T10023] xt_cgroup: xt_cgroup: no path or classid specified [ 1829.114619][T10018] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1829.163787][T10030] device wlan1 entered promiscuous mode [ 1829.200412][T10035] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1829.204311][T10036] binder: 10034:10036 ioctl 40086602 400500 returned -22 [ 1829.227608][T10038] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1829.239039][T10030] device wlan1 left promiscuous mode [ 1829.243140][T10045] xt_cgroup: xt_cgroup: no path or classid specified 00:40:32 executing program 4: ioctl$F2FS_IOC_RESIZE_FS(0xffffffffffffffff, 0x4008f510, &(0x7f0000000180)=0x80000000) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000000)=[@acquire, @dead_binder_done], 0xc2, 0x0, &(0x7f0000000040)="5636416c5c030f6b5977ae954ca62bc5008f3d90b770bcfa00b48865e177d2a1358857ee86ea7ea4be0531cdabec54b5ee9535c5e576855afa95e8801705a5a0b13203f72b796d188bf6af884029a26e5e771abce06676cb0f26c670ebdccbaae5f86ad5ea0094234005831efc87de90ff17c3ce721e457a3dbe7bce7d38e6ca9c8cae758e263b1aafe44f6e053349e6b2a298bb91c7a0cfd73c1003c1b2e1d758ff012387102424b58a2cba0d5f6c33822032aceebe0bec835e339c7d67627b742a"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) r4 = syz_open_dev$vcsa(&(0x7f0000000040), 0x7, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv4_delroute={0x64, 0x19, 0x300, 0x70bd29, 0x25dfdbfe, {0x2, 0x10, 0x80, 0x9, 0x0, 0x0, 0xfe, 0x8, 0x300}, [@RTA_OIF={0x8}, @RTA_OIF={0x8}, @RTA_METRICS={0x26, 0x8, 0x0, 0x1, "6038a868df74906c766610f4cbd72d6ebb627f23a59c009a409a8884717fa8c52b04"}, @RTA_IIF={0x8}, @RTA_GATEWAY={0x8, 0x5, @multicast2}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000240)=[@acquire={0x40046305, 0x3}], 0xa2, 0x0, &(0x7f0000000440)="3de6697f65af336ff16257cf5d39294d071a96f56a468e54a89a5fb5ac568af04c53c05bff75ef7fda004e711b0b1a149d50153e7296fbe33a45be4557c871007bc49cc453eace3f108b631f6df6dd2052689ddf75aa99821edb8e054f9e44dee5a021ab629fe96ee0917da5584f55f4c468c6b6e73803ad07583633a2f17f35409a70aee29239db3e0b68244517d0d73c948b0bcf8ce715c7b5b7cac7d96a128093"}) r5 = open_tree(r4, &(0x7f00000002c0)='./file0\x00', 0x9000) sendmsg$nl_generic(r5, &(0x7f00000008c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f00000005c0)={0x2f8, 0x1e, 0x100, 0x70bd2c, 0x25dfdbfe, {0x9}, [@nested={0x1ff, 0x70, 0x0, 0x1, [@typed={0x8, 0x25, 0x0, 0x0, @uid=0xffffffffffffffff}, @typed={0xba, 0x90, 0x0, 0x0, @binary="3ec1358af582913b220fb93db2445231cfdeaf801f94bcd522a6ba40a0056086abc488ad383428c4184dbd9ee09913bbc424128cfb398cd11243f5d634b24fd3c35fb59ca4ff8da8240554db6913d3ea2ed1a6e18ba40292115357b8b077408be2cde9b6f2aab3975edf500229bdf4e3698d667f02ad0c2ba9b6d6af7fa3c48a9a5efbceb05a464f1aa0b57363d1867aeccdd493bb853738105d0164b56928e9494705fd2af5019242dc06399a2f1b91e1f6d4f5e2dd"}, @generic="5af5a11e7dc9637b4709651735d2135c5bc2ff691b4a0458e23c83bc4ed39f73662fa1c4a64203aa04dfa4272870c7cd89ec497a0f68dc30ad8a8c6cdb0b7014288ba7a2d126c59d397aae4d958d60942ec4daee989569e60ff87b97dd31b59f5dc90f8351f224c8074fcbe586ddf36943f12354d8c1221a272261d05d585d9d3ebfd280716d00b5cae2a30c36c276", @typed={0xa8, 0x0, 0x0, 0x0, @binary="be9583136b93a88403728996845b972dde645d918643d692b1c6b2a7eee8fd5443c0f109f4da333c6f7c3a3a31ff67fac64ad07f948416c00a06e3f7903b1c2019f825c4c53937923f5f8cca8b12b2785ba6e39ab047704447e6cd41999cfac293bcb77a7ae0b341f3654e33d2750a357c4e77752fcf04cd655dc66495993bb7dc9570e7c1ba28231179ca31f4b416d876494540b82471bd8e2f9c93d4c1b8a3b7f75ca4"}]}, @typed={0x8, 0x22, 0x0, 0x0, @uid=0xffffffffffffffff}, @generic="3c6afa42820d9c3dae932455bcfe916e12685fbd99139a675a608ef2bc28da556b344c4a9b8527bb433bc84e71fbe1ad8c7ccf2dd520346942dd21a0fd42bd166b31732e4d49e166877e8536fab892cca846edd635416746047b2ceab486034bc6e4dbf33772762f9c21327d07d83fc692bbcd502a405e4cbefba187985d14756ab9c910deca42ac2ddf1caec21c2b19a1a34a66298e5d716c9d56", @typed={0x8, 0x21, 0x0, 0x0, @uid=0xee01}, @generic="d6cedc9a5278b841a8f72d4cdf4ea892f0f8245f634a96fe2baf119c351df9a98b66970587709b10ae5aa3421dd9dbe57779e399d1eb"]}, 0x2f8}, 0x1, 0x0, 0x0, 0x4004}, 0xc5) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendfile(r0, r1, &(0x7f0000000200)=0x9, 0x8343) [ 1829.263234][T10048] xt_cgroup: xt_cgroup: no path or classid specified 00:40:32 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x7}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1829.364852][T10052] xt_cgroup: xt_cgroup: no path or classid specified [ 1829.393816][T10053] binder: 10051:10053 ioctl 40086602 400500 returned -22 [ 1829.401646][T10054] binder: BINDER_SET_CONTEXT_MGR already set [ 1829.423774][T10054] binder: 10051:10054 ioctl 40046207 0 returned -16 [ 1829.423869][T10053] netlink: 'syz-executor.4': attribute type 11 has an invalid length. [ 1829.462464][T10055] binder: 10051:10055 ioctl 40086602 400500 returned -22 00:40:32 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x8}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1829.471651][T10054] binder: BINDER_SET_CONTEXT_MGR already set [ 1829.477068][T10058] xt_cgroup: xt_cgroup: no path or classid specified [ 1829.481272][T10054] binder: 10051:10054 ioctl 40046207 0 returned -16 [ 1829.497263][T10060] netlink: 'syz-executor.4': attribute type 11 has an invalid length. 00:40:32 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r4}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1829.602152][T10064] xt_cgroup: xt_cgroup: no path or classid specified [ 1829.629884][T10067] xt_cgroup: xt_cgroup: no path or classid specified [ 1829.662865][T10052] xt_cgroup: xt_cgroup: no path or classid specified 00:40:32 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,\t\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:32 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x7, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x4b) sendmsg$nl_route(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="60d75f001900f8fd0800030000ff010400"/32, @ANYRES32=0x0, @ANYBLOB="08000400", @ANYRES32=0x0, @ANYBLOB="260008806038a868df74906c766610f4cbd72d6ebb627f23a59c009a409a8884717fa8c52b04000008000300", @ANYRES32=0x0, @ANYBLOB="08000500e0000002"], 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) clone(0x40100, &(0x7f0000000240)="551d48b9d10d008fbdce31eb0f349e388c9781b7c8b2b32a3a61e2c7d039d2911ee628d395b7e1c9995cec1830489eb69797120589faf0a2fb4937678e408a0b8f3be2fac5bcc0483f53ce8b56bd5d4151eeb1dd891e92be1dc7c4974552e32ff38e533ba37dcb8004aa7dacea9ad0931c0c883f158a20cee57e1e5f44b564112ce4857ff14f96fef58ad029bde6844ed77bfcad002793862ca157c0b54ca7e90c8696645e9c49ec1455fdc646934718984b1553e6c9dc3f8bb58ede2435ee16a1a82aa53ced9b67b675f38142ba5193d55b9af6b597981b00", &(0x7f0000000140), &(0x7f00000001c0), &(0x7f0000000340)="08b6986d14a466f24d5bba345f670f05d1236a8a6c6f0e28f81dcdc074486e9f88154b9fb6d9f3701374ca55ea1b71fdaf4ce1f10c3abf7e763eb3df11172ec72b33444e35ad144817e2ca701a94c318cc85ec14bd677a9d47f55fdbcb314e6479ccc78ee1fe2dea325b839df6be20a4f8e2bad1851e0ed1ddd18141b08676e9d1198e865930b103154888cf5709aaab732ad0240c9721b9aa3131feac96e61e315c009a8d3002d5eb7a3409482089a8e7dbd42fc8ea8a2bb762b6b73501650b1b58668cd4afe76500264af9f99c05144b8b7ab2e83296afba7a0f2aa192a88da68f750c6e") ptrace$setopts(0x4200, 0x0, 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) 00:40:32 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r7, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r5, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) 00:40:32 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0xf}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1829.719912][T10071] binder: 10071:10071 ioctl 40086602 40b301 returned -22 00:40:33 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x9a020000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:33 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r4}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1829.825532][T10076] binder: 10074:10076 ioctl 40086602 400500 returned -22 00:40:33 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xa2020000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1829.880307][T10087] xt_cgroup: xt_cgroup: no path or classid specified [ 1829.899311][T10091] device wlan1 entered promiscuous mode [ 1829.904046][T10090] xt_cgroup: xt_cgroup: no path or classid specified [ 1829.918782][T10093] binder: 10083:10093 ioctl 40086602 40b301 returned -22 00:40:33 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r4}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:33 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r7, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) sendmsg$NL80211_CMD_VENDOR(r5, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0xfffffffffffffea1, r3, 0x400, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x100}, @NL80211_ATTR_VENDOR_DATA={0xb8, 0xc5, "775ac1998ac707951afa1101b45544cd7ce95c8d6548e97664f88da1db37a83c89c820a48cc34362d48789496535b087952f0adefdd950c723e48a827f3343f72f1dab90b3cd2ab4b23a41a2ac8ff018c5c84924592003c1aabe6fde92d0f6b66bc9acd14d1c05d3a1271f13a36dca14db4f9bcc92a05fa5e0c539af7518e7ae871467d8abae3e799be950d8ac0624ad855a2bc2c47e3090214d0ad1d1816557883f99b4b812ee65d3cecaa4ce3ec22396b67459"}, @NL80211_ATTR_VENDOR_DATA={0xb0, 0xc5, "0cddf59efd255e2f5b55a6d731c2a474aa6a5583872b79eb874217f1f1d30ccca1ebe796fc22b1c8e1f6d29ba5aac052efaff008a3f9e4f3d0d5d35b6a804cb25afb73f0d5ae98bca39efc3c28beefff5bb93d63302f43f597f82f93ec94a77a66707522fcb4655127b242b46f9ea40343682facfcf0868a3a67a3d7528b16d4b0a30f05a17596637cfcd0c29972768fa672dbea26530fe37615b5e80e34f5574e1bb75d3c5a4e09f9d134a1"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x6}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) [ 1829.949915][T10098] xt_cgroup: xt_cgroup: no path or classid specified 00:40:33 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x12}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:33 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40086602, 0x400500) r0 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x7) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000004c0)={0xa0, 0x0, &(0x7f00000005c0)=[@free_buffer={0x40086303, r0}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000140)=ANY=[@ANYBLOB="852a68770010000002000000000000000000000000000000852a646600000000", @ANYRES32=r1, @ANYBLOB="010000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB='\x00'/12], &(0x7f00000001c0)={0x0, 0x18, 0x30}}}, @dead_binder_done, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000280)={@flat=@weak_binder={0x77622a85, 0x210b}, @flat=@weak_handle={0x77682a85, 0xb, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000200)=""/84, 0x54, 0x1, 0x18}}, &(0x7f0000000300)={0x0, 0x18, 0x30}}}], 0x81, 0x0, &(0x7f0000000400)="fccbb986716d8effc0cf3edcb0d136ab4ba037e6fe49b2c344b474e9b4a4431c5156dfe7359a906732d999adb9280cff7598b6f95012e2615613cc4a609d8d4ed312b9dcea354f75e1cc4978ff6e950ad3d5d93b64aa37687e62bf7da4bd4d68f58cef04114d008b83f792301f0ef2b58413e9e43316770c0afa89198e2f24c5a1"}) fcntl$setlease(r1, 0x400, 0x1) clone(0x820c0080, &(0x7f0000000000)="bee49bb311e525faf209eaa4ed6deb02062910951ffb0e7a8a54be25", &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)="31f655ab96f210fdf95600e9c5c9bf541539998f0fc80df8c591cd549655bcee8d777d4eff028a572c0f609a9fb22dc0bb15215db1103d22e3642d4fa96b9628437d3c9111f8f7a24e0383438e1e16ddde85") [ 1830.012803][T10091] device wlan1 left promiscuous mode [ 1830.085517][T10108] xt_cgroup: xt_cgroup: no path or classid specified [ 1830.114970][T10112] xt_cgroup: xt_cgroup: no path or classid specified [ 1830.143683][T10111] binder: 10111:10111 ioctl 40086602 40b301 returned -22 [ 1830.158424][T10120] xt_cgroup: xt_cgroup: no path or classid specified 00:40:33 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1830.190571][T10124] xt_cgroup: xt_cgroup: no path or classid specified [ 1830.357964][T10134] binder: 10134:10134 ioctl 40086602 40b301 returned -22 00:40:34 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|\nl\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:34 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:34 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000000)={@fda={0x66646185, 0x2, 0x1, 0x34}, @flat=@handle={0x73682a85, 0x100a, 0x1}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000080)={0x0, 0x20, 0x38}}}, @enter_looper], 0xa9, 0x0, &(0x7f0000000200)="73168dbe82a5082c0ce9fea7c55e42cf8d66a88a4b058c8a9e8ac1a9a4a7edc58b7b2b0ab48525b1c2a1c790d4cfedf01f90579527b8d4efa892e37c9c01a32f6d86f00e22385d48f129144783ef29bdc5863b048d921b043fb5c5d2f93302f418dbdb007be7ddb1c2024f460e8623fe595e63826da59875d8fba4029605a83a560f2aa2958108d523ccbfe3cfa88da364b509319e3187a254c30fb6d9801ae27b2f06ebf1b12a5d63"}) 00:40:34 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xb8010000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:34 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:34 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r7, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1830.963876][T10141] binder: 10137:10141 ioctl 40086602 400500 returned -22 [ 1830.972172][T10142] binder: BINDER_SET_CONTEXT_MGR already set [ 1830.981749][T10143] ecn_mt_check6: 23 callbacks suppressed [ 1830.981767][T10143] xt_ecn: cannot match TCP bits for non-tcp packets [ 1830.985552][T10145] xt_cgroup: xt_cgroup: no path or classid specified [ 1831.010165][T10152] xt_ecn: cannot match TCP bits for non-tcp packets 00:40:34 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x4c}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1831.035133][T10142] binder: 10137:10142 ioctl 40046207 0 returned -16 [ 1831.037595][T10155] binder: 10137:10155 ioctl 40086602 400500 returned -22 [ 1831.056023][T10146] binder: 10146:10146 ioctl 40086602 40b301 returned -22 [ 1831.064065][T10156] device wlan1 entered promiscuous mode [ 1831.074850][T10141] binder: BINDER_SET_CONTEXT_MGR already set 00:40:34 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xba030000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:34 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1831.084268][T10141] binder: 10137:10141 ioctl 40046207 0 returned -16 00:40:34 executing program 4: getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e23, 0xff, @private0}}, 0x2, 0xffff, 0xff, 0x0, 0x40, 0x41, 0x4}, &(0x7f0000000140)=0x9c) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000180), 0x101100, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, 0x1c) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f0000000200)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000100)={r3}, 0x8) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000280)={&(0x7f0000000240)=[0x9, 0x1c7d, 0x7, 0x8f0b], 0x4, 0x80800, 0x0, 0xffffffffffffffff}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, 0x1c) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xc, &(0x7f0000000200)=@assoc_value={0x0}, &(0x7f0000000180)=0x8) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) setsockopt$inet_sctp6_SCTP_CONTEXT(r5, 0x84, 0x11, &(0x7f0000000100)={r7}, 0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f00000002c0)=@assoc_value={r7, 0x80}, &(0x7f0000000040)=0x1e) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r8 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r8, 0x40086602, 0x400500) 00:40:34 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r7, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1831.145614][T10156] device wlan1 left promiscuous mode [ 1831.228461][T10164] xt_ecn: cannot match TCP bits for non-tcp packets [ 1831.238205][T10165] xt_cgroup: xt_cgroup: no path or classid specified [ 1831.254139][T10173] xt_ecn: cannot match TCP bits for non-tcp packets 00:40:34 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x5a}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1831.273385][T10171] binder: 10171:10171 ioctl 40086602 40b301 returned -22 [ 1831.360448][T10180] xt_cgroup: xt_cgroup: no path or classid specified [ 1831.400154][T10183] xt_ecn: cannot match TCP bits for non-tcp packets [ 1831.419144][T10188] xt_ecn: cannot match TCP bits for non-tcp packets [ 1831.496583][T10190] binder: 10166:10190 ioctl 40086602 400500 returned -22 00:40:35 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|#l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:35 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x5c}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:35 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) r1 = mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x70, 0x0, &(0x7f00000000c0)=[@increfs={0x40046304, 0x1}, @free_buffer={0x40086303, r1}, @clear_death, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000000)={@fda={0x66646185, 0xa, 0x0, 0x14}, @fda={0x66646185, 0x2, 0x1, 0x11}, @fda={0x66646185, 0x4, 0x0, 0x2a}}, &(0x7f0000000080)={0x0, 0x20, 0x40}}, 0x1000}], 0x2e, 0x0, &(0x7f0000000140)="a97cfbbebcf194f5d0bdf700bb2118c34c496b6de9d3f742c32298976a5b3ee2d3d6fafd89d9d77d238d48a8b24c"}) 00:40:35 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:35 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xc8010000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:35 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1832.201154][T10200] binder: 10195:10200 ioctl 40086602 400500 returned -22 [ 1832.211033][T10199] xt_cgroup: xt_cgroup: no path or classid specified [ 1832.224919][T10201] xt_ecn: cannot match TCP bits for non-tcp packets [ 1832.234780][T10209] binder: 10203:10209 ioctl 40086602 400500 returned -22 [ 1832.240679][T10212] xt_ecn: cannot match TCP bits for non-tcp packets 00:40:35 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xd4010000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:35 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x60}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:35 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:35 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) process_vm_writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)=""/126, 0x7e}], 0x1, &(0x7f0000001380)=[{&(0x7f00000000c0)=""/241, 0xf1}, {&(0x7f0000000200)=""/145, 0x91}, {&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/137, 0x89}], 0x4, 0x0) [ 1832.260845][T10202] binder: 10202:10202 ioctl 40086602 40b301 returned -22 [ 1832.282419][T10213] device wlan1 entered promiscuous mode [ 1832.374519][T10213] device wlan1 left promiscuous mode [ 1832.385238][T10224] xt_ecn: cannot match TCP bits for non-tcp packets [ 1832.410168][T10229] xt_cgroup: xt_cgroup: no path or classid specified 00:40:35 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x68}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1832.426375][T10231] xt_ecn: cannot match TCP bits for non-tcp packets [ 1832.464643][T10239] binder: 10236:10239 ioctl 40086602 400500 returned -22 [ 1832.493461][T10244] binder: 10240:10244 ioctl 40086602 400500 returned -22 [ 1832.515921][T10237] binder: 10225:10237 ioctl 40086602 40b301 returned -22 [ 1832.537290][T10248] xt_cgroup: xt_cgroup: no path or classid specified 00:40:35 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) clone(0x40020200, &(0x7f0000000000)='!\f\"p\a\b', &(0x7f0000000040), &(0x7f0000000080), &(0x7f0000000380)="adb2e77597c035127bf5b96c20e8356348370966d4904388545682290835e52215944198447d692f103911fb8d56996a169e8022299013d737d1bb90fa9ebe5ed7f3996489d612cf85a5bcb9502e129d6e15c3ce4fd8b88efb1dd9969a238c86ae55a84fbcc6b9915e5efb7a5587f46b6170a6146193cc76f85824c25ab056b5e4aab9d006e7e4b7657c39af9c1f0d791a0c097a02bc234cd655a00865fc8dcb74b0f4da703b26a7900469725dbf6f50174538ee7ae3812708d56a1b78e9848a9dfd26b178f15dcea16c6fad35362d4bd8413bd72f0b6bfd496aa4ac894a7918a734df5010869fce449aa2da966ce718cc5c215cf1199df0fcd0457d9f4a583f983db78db36146940504ef7e462eb53f0b9e75ba9af9c3f8b45f33ba3de7fa35d7486607dc9ce5dee01d7a") clone(0x0, &(0x7f0000000200)="6c8d2f6e12d176e7660b05b81482c56b07b1fff81d756ee9ce4de581d35fe82f8b9cf2660d8088e2bbf67fa7de3bd412a06169fd31a5f141c67a648f461cb37bfbcb7272245c5eaf284bf89324e21664b9786fca3622cb4324ce397501c90841d76215b0afffdb24c6b8e574d3e0267ff46bd3512275472cebe7e7be879155242301fc4a1b83fefc9258b7ff23d9c3b17cbfa6c69a55b297eda03eff324c485c8a8a9a514b7f0e644a4bfd1d5062fc2591ce55fd41bbf367f9a9ba8b1e2e3029d7f010d63cc3047b72debde6c12c16ced422584f771ed810dcdc6a6410b2d31696934e6aec4f4ba1bb218393fb", &(0x7f0000000180), &(0x7f0000000300), &(0x7f0000000340)="5f9d697f81ccb451f70aafa1df1031a9a4fa2b262171ffd58d821d2e396deff31d1e55fdc13aaebc8f38b8afd0faa23c9838ccdaa8b8824a03df") r1 = openat$incfs(0xffffffffffffff9c, &(0x7f00000000c0)='.pending_reads\x00', 0x400, 0x2) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000580)={0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000800)={0x98, 0x0, &(0x7f0000000680)=[@reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000100)={@flat=@weak_handle={0x77682a85, 0xa}, @fda={0x66646185, 0x1, 0x2, 0x35}, @flat=@weak_handle={0x77682a85, 0x100}}, &(0x7f00000004c0)={0x0, 0x18, 0x38}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f00000005c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000500)=""/81, 0x51, 0x0, 0x15}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000640)={0x0, 0x28, 0x40}}, 0x1000}, @release], 0xab, 0x0, &(0x7f0000000740)="d9126e48b4fffa8f8f1c56787bac6cd4b21edc13d3d127f32adc40fcfd75b8cecfcc036ce245fd59dd4f6433f41c9149f5300efc7ee74421626abc5f3a8bec4a247a7bbd15153fe3fda60fecbd232487c78edfdd7104aadada170b26001ff3a2dfcb05bb8c8647d9ceafc1014856e4ca407369f2eb407da4e775a601f9ab1e2dda4c85d1028794e37d888cd29358068af61136ab61ea1b8ba102e24f3d3269f9818d4533ae87b8d9b4c0a0"}) [ 1832.693645][T10255] binder: 10254:10255 ioctl 40086602 400500 returned -22 [ 1832.736209][T10259] binder: 10256:10259 ioctl 40086602 400500 returned -22 00:40:36 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|%l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:36 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x6c}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:36 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:36 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) mmap$binder(&(0x7f0000ff1000/0xc000)=nil, 0xc000, 0x1, 0x11, r0, 0x6) clone(0x4004080, &(0x7f0000000200)="9d94fae47255a3c14288cb18a29b3e10231edcddd03c7f591b8d4794dd16dd6945f5e2467d25dc5848ee2043f162baf490d25c667dce2677d697835bba52f00e07b0978a51bb9d67980b49777a5d688a2a23f5e8824395316ab3c35f9379c9f60f0ff5b1c4cdf838a77c8b543c0df6865d7f65b3764b01485c9693e9332830bfafcb08bf779ca3541da7a35a706335b12c5617a2f4f65c5e515b03731d03633d5b6d4531130b11d3a92998f710662e51278a49bc9b481340051285db92283b158b759190450992aeafc291af459e4c603bd710769439bce405fb64f9fdce326daef16c013e8377a36009588754f406cf1342db6ab119a4963a96181ddf76133074b60e2ce347f37984cecfd40c216a1c780988415d048ee4f319be4e0f9d93f8f806ce97cb09bfe0dca46fb984af02428bc2d3f62507bf5bdd440f5f9e23d4708e2fb6daf4ba82645e6c33c48dbf40b30e4ae754f646227d7b2e62e0d614d8fc52a9bf197ab895b05b270526c6542461ec7fa071b8b2fa6d6f67e251110bec50f0662e926c7e7463968a050c980658b14bce1e7af33a8725541c0a588e1b3c4720740a179d838579b4cad6afdff1b682196f4117590636ee14a5260dafdf36fa55936c8eb9f52563a53806a16ddc1d6c2487f479d5666cfc6a0ffd1c9c8fc3c7dcf8ed26b5773663f4f1b9881e8495c04c8b6271ac185e8eaf860a777af6d4d2d4cfcf61b18be753583bdf6f02a9b6869967a14fa9882e691f86c87bf23afcb6a1490c0fd540821771c5ad16559a94a42fa468b9b356aac1c22be2a2227d309088bf715baeffbc80fbd33f062b7b74756096bd8e76a04d34647eb08c95f77cdd47092f5aa9990864054647057b1525fb1b2e869056fa11b13ea3bce33da3bd6957cfc51e96940a435c8faad3b4ccff7c224dcdac6092f64bfa19e5c05f88146062e259703690a21f319d9385b6f7a6666a165d8d5a32b4f02c78296a28a9e8c5910f2006e4513fdd6b9ffa631ba565937aba46e3daba3e82fa38223ac99d9bcd372d476c1579bb8aa30e696d7fd141ef1ef49ae11c12d588bef764d68b81c1f12e92bd757dbdeb08b7477d1bdea847fb5c1d8b6ba9c4cbec65dd1671983ebf42fc2bf8e7583b37de2cb1350d193e9a378db2bfa04992258712d6bfaae5880742969ca5a63c2afa0bca1ab23696294c44d2632922755296f61613f11e7c3fabe92b6ec2a1d56a19d1033353bcaeff14f4e7cf4a8c5e377efc7ec49557a30f0d1e02e9c5529915daed56ad5c409240e6492c2ac5eb2656efe7876cef48f7893c8eabd927c167e3f754b72edd727f9f3b23aa49374fb7580d1d4d947e6a998ef4f810292fd745f0e31017319eefbe4d0bd4453280d9b8dfbfaf454df10c6e07f656f9a94cb3614e1ed40cff45ba40224ee79b56a73aa69c9e0fa6ad66f889bc186163290b3764a28b8a5295a744c84103da6070a9167cb3acffaede552dfa14a39c8fc9ac4460cf2870256c7f834db6aae3caf0a4cd4dc437a1ee29cdd29ddc05772f7bd875187ff51978cb5ede2e7b4954cef80d51bf9ab9a992d5922d2c6afb2113a2c4dbae5ca6ee32f583f3c833c64451cdbd6c2904d33957ccae45f6aab5b53df4df20cde14ef0c22bdbebf137b43dc36aa378a844d79d18384f7fbec3d06e099d8674eae2d6ebbbc7721bc46cfe9d2569689e61b5185bd367ba736afc7d832cdaa4e0e9c0bd12649499fa7fbf8a0f2697b985d257a221b3d314dc937cb662a30a51176ec3221c3fef21a6d86e8319a3c656ad46589a18eef2c0a4435583b0caf5c6decb49bcd0ac3a331df02f238277c1b6666a1992b8027cffcfedb00795ea81768e68bc91179fa84171d360a71d57d6ac87ff9f5122a947a64921e983e210115cba46084edbaf58974da3decb236bca5cf588ee08b410dda2e960f06d78e78b6e8b0faba370f10ff070d57466583f9e0d6e9f79490ccc49671b318775c27049b416a860e300ea8dd9c88491e14368fd9528b2f26861c682d5c074f87a4ad96911e0a3a34fa2b7cb6fe6a80a07a2d232c0fbc781d9edfface6ef5a6f552a0be70b3d097a861c8f262468727ef064537767031768bc3cd7faeb3d098dde8cf9ece9539bac45f8cf1013a71c79c6e38d69f6776d5dabaa882e38192f15fd2ff2cb88bd913dac5146cc6440437f782efa01447e37d86609642aa4ccabe42734aca799fc564d29a9eaa16cbe1cf8854cc86a5a2f6d286bd66591b5b078c9b7a1c7a3890ed51d745e22ee02e76c6fd01f39b84c0357e518f5891650200abb402f4c7702c19713785a4ab8216a2b64cacde891a2ea3ebcab514f473deb847911f521ece26e3dc8ea6e784ccdb5d2dc6b3fb2151701dae002d129b85f77a48a0911be4073ada8a80be12c2460043cbd4d4842e7bbd07a5c4ce17749f89c50a42c1a44970d6e586e700be3829faf2221b4a6f8c9543542dcb3dee83e6b1b1228342e59329834e466587e67b2e5dd74bdcaa1f69c659297724a5e311e8fd16aece8cf8013dee05a44496672fb49fc852eb222995b6ae972aa997fb9003fcf3cc102a4089ee12e3ef4ebcb9efd25248c36f34ecc662c6b54f86fdc7cfe7dff3bd35b29571a81c8f29044aac686378d1efbe35b681d51d0666f356250e292453cef209b140096174c13b5c52fbc3340502d3eb7f003dd6dda29cc7bd74a870f1b32fab54f5f1f0ba6d0d44af990b8114b2c9768ccce73e20d8fea93b61f95ee9f55bf7b510fcf5d0a29bbb22ac106035670ad75dc1a36fb9cb05d1cbecf0ec0f4a93634d3b073ca7c1ecd3ef167bace10b7fc6cb85205ade8a17a3c544a9ed13797e324f0acdffc9626dd9e6cc206f0adf46b9c2cee5a4b274dc71e013d735ad6ef08a40a087c0835e7140129a00438dc718fbb01400fa5623331481358eaa46cdb58be0aa4997364f9c628a5dd69b24e2d25551c6fa1f996fa30c2c58a3a2eb26ac2ed3ab5b9c81899f13eed90a6997901b6e8924d91ef269e3acdd9ffa066a21c2bd526f0dbe30d12c17c2fb523d6c4b51d1b9c597ecdf0b31d19f0d489df257862eb5f8a0034ba03d3b61c4309a407a17fc21faa8e8c3312a739dcae4130da03cd5e0c56dc49ff81ed0c81b907015d7074f8349e122743231e45c97be210bf979ffaecdfdccd0f140ba7d5e03a3925bf771ec5769bb287276f1c852f533f4722ad1d589bc04375d210f28922ff70ada2d7963907aebadd98f70756cb3aab7ab60629dd9f9b03f3332ff4436141af1823374b8cc6d8f76582c88c4b223c55dc098cd3520faf6713d23f14cbb3080cc5208250875ed9db5018d8ae6711f97cda825b7f87b4a4865fee799875ab68afec7d0cb98a9f48503a62f8225d7c62118662d037fb702eec337005acc923fb2695543ec43190da4d8da6927b7d6e845f97c75a25ba7e87bdc2dc7ebc1715f9151519c62e518bf5542d2ae04fb59a43447862cad6dca172811c78bc6dc0133c602cbe5e357c5d2643b935e43def14fe44f07e0b89f9cbb55e3af9e84e01fdbc323efd4f90feca4cb6f7db90e3f25cef556c1f74c77ee48141825b7268ad3e409e6bdf8a79ebcc7dcdd26066c6111f109fc66c1e29a50965b9e4984b22c85ccf901b282be344139a38b35150edc3512235594e570bfcff91551532c0baf406f14d0cd875442558bd97098d0f945f6a843fa4a94573fd675b6f012db644716d01a671461f876de2ffccd3260d7ad5e8053e9ef52117c207a87e374f6421c361b53e83151dd2770a16902065b81805b3c86701ee124969ca043e4753cf3859e621d38dbd1c76955b771db7f39f44475244ab80d80600e40b540dee1f68cee05b33bd462e4a5d236e91991f5746966c607ade7c57948526574133567ab113f312ebc3f90e99a7e27798a6125813d8228bdce1aaa0e9ae1afffe07baca91ac26fb01f7f7ebe194710c71b55329954e17ee6e1ba2393d97cfc8157c4fc06ce88018216d0f3b6553c7b730a9dc03de149daa6d8e28bb2218c221e1a94cbff925cefd8b47f5d16c1c8197b1187c844f46ea4745396fbaf6cde0e69b336a198098b65fdb32e27c3f7f7aab223808f9340d10ab197c5d7770fd2709e5f3ff021a50dc17981e61d640aedd9afe0d0000dcb04400b791470fe970e227722a625f7a84cc0dc08d88843f9aa842a554571f02374a5263fb56e83ca42a3ae2d60c318b14efaf0230288c9291a02c5c8f70e641c54b426cba1f166546ce515bc40925030fb968860f33bb1cc51500a5cedae8f52f827771828a5333532569355b8290142bed1ba0f2fa70cf3b3a10542c319b1a47466a3f795ac1c2be35e38e8e2d10975562534e9bd9006ebaf5f50bceb234fd5bfd7e5c11ec1ac45e1e7d166ba2c451df1259ddab8b774c21e20ed7d885dda2eb82bd53f8666998eb0103d93473eeedfc842ae6b018fa33e2995db36e93d1e092b7c6fea19f00a5e488e06507d1541bfc69df3b35a4885ab511c14199444ff0dda2fe4df26cb9e13cad6eef1440c1bbd0b6354dc46abc540fc89fbf7bb771f4d9ee504c6536cdf73c0204b2a7810e6473a54cf8d4427570a9872a06b6fd19ac61fdf5eda1254aa3549849aa94ded40805270081efcf3de9dd51e4e17b2ac23d09c381d088fe4604868f1a3fec21aa214f15a34bff40a7c9c9af9d87ec4e22d45c7d31c620cb0171b3468e1e424b9a69faa27a2785a8a51fe52dc77daee673a604b6dc32cbf36d859511362961486447f06de842561f86c2a6d6b62328c3b59d736aee3a874c75256720e01692a21789c9e683b44ae448fd09f773b82d5e093d05ebf34588e9569103abaeda032effb960abd8340ddc05536c9cb889410aaf68b8a7d76d63f0c7a11dd6f26b8e583e74bfdb2e4642c3d9d663d45f866c998f08a517fb6ebd7e608a34f564d229943809ab38ca832ee1754d72e8253cbba1b51c751ebec8564cb27397b26c1d05b8186a887896134f7766f880ef9657ab94ba844d05de91c8ffb8adcb05c30e44dba4460a16840f580d3de0acc8356e970c24e16ba1799fa1e87d4bf4039174931eda36c40b8062efad5e9212dfa21d8e298d60b43d0f34479c0eebed37888b86d3ea83606c3dec658610329b95b604034a3e93ca68df6acca953d9e80f0b12a6b9d8e08a8f0be135f81bb05f77740d482dbc5ed03426fd0e0ca60733ed8602e53ef55e9f593a8f1f88581086f8b67d8c372b5bb6df08ea2127a06371e9b2242c065b8f7b128482f9db3de8832caecbf06bfb29f77c2e26acac5cc4d766ad93fa5b878c8dd0feab87b7b2432492a9d266fb75cac172366b222f865ad5524d2c0e0fbdb286545af36cdea6678459f4056255a9f60c87c6887f0859a2a6eedfab976d508b3a8353a3fb8553c8766bc43fc6b5cf7d355b62e946260479e3b07bddf0a5719786b79a4de1165827d21e0a4771accb3b34b9f921883950b32a5b8936fc62329288b4beff048485ec3dd11904b64911f346e23cc6eaac8a96c2b5d4a326ae6b8da96db4deab74731d898596f860c88e345ebc562cad376acef6ed95b758e296b7014b5caba6b32b8c35fa6a34e959e5f9157c8b05828c0eed21bc2118c6f07f1cc99e215e0aa7e9473a280cdbe7e1a3cffa694c0cce6f00a4096442406d08f5c5107a31780af5aa65bc4b1edbf103988c7781158695dd49b5eed36cad0066b4d57599a643482883f2f68edc8e36be78765a5dc2bee43380c43d77c5825ea0ca68d13acd084c58debc7705754c452775f6a336f211215c0f87bd", &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)="bf7bb6ffde91cabb73766108ed367ea6c1e6b54580f099938af0da3f3c10008a1654b4cacd4898ee32d1a3c1b235cbb7e78098674586febd3251f200e05ddf5a8f1b09caf195d3278d375ff7236cb04a90d72f220d55c728c067211bf929173bff523fde1f45d90bca7dad990b24e1e5434af41080a348b59f18c3be86f108d3dd45655268f18b92bfa983d8c0256205834985a909ee075e80d256463bb394bfc22e5e064b8205ea1f601c7e718a6d2a66c6f936783f84b0fcdd52424e0419e66238e5b110350feeedcfada450f8e42cc16bb47d84c76be98cf5dba8b20895924ef388dfdfbc99211c03f0eb42b5ed5acac1e5ff617ab4a81db623249970") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) 00:40:36 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xda000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1833.238337][T10267] binder: 10267:10267 ioctl 40086602 40b301 returned -22 [ 1833.245847][T10268] xt_cgroup: xt_cgroup: no path or classid specified 00:40:36 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:36 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x74}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:36 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:36 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xfa030000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1833.298498][T10281] device wlan1 entered promiscuous mode [ 1833.324827][T10280] binder: 10265:10280 ioctl 40086602 400500 returned -22 00:40:36 executing program 4: clone(0x5ab76080, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x1000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) [ 1833.392973][T10286] binder: 10280:10286 ioctl 40086602 400500 returned -22 00:40:36 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1833.433798][T10281] device wlan1 left promiscuous mode [ 1833.448195][T10292] binder: 10292:10292 ioctl 40086602 40b301 returned -22 [ 1833.496523][T10301] xt_cgroup: xt_cgroup: no path or classid specified [ 1833.568664][T10307] binder: 10303:10307 ioctl 40086602 400500 returned -22 [ 1833.597537][T10312] binder: 10303:10312 ioctl 40086602 400500 returned -22 [ 1833.605377][T10313] xt_cgroup: xt_cgroup: no path or classid specified 00:40:36 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1833.611075][T10308] nla_validate_range_unsigned: 14 callbacks suppressed [ 1833.611090][T10308] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1833.632474][T10314] binder: 10314:10314 ioctl 40086602 40b301 returned -22 00:40:37 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:37 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|+l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:37 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:37 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000980)={0x10, 0x0, &(0x7f0000000880)=[@register_looper, @free_buffer={0x40086303, r2}], 0x1, 0x0, &(0x7f00000008c0)='4'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x70, 0x0, &(0x7f0000000000)=[@clear_death={0x400c630f, 0x1}, @free_buffer, @clear_death={0x400c630f, 0x2}, @release={0x40046306, 0x2}, @acquire={0x40046305, 0x3}, @acquire={0x40046305, 0x2}, @exit_looper, @decrefs, @acquire_done, @free_buffer={0x40086303, r2}], 0x1000, 0x0, &(0x7f0000000200)="3b9fce40d67812c93de787807d97d3da0f51ad6ea8562e2b269f000090e39dc8d1ab5bc326cc74c26a7508cec8855715bde17d88ac484405b1501cc3c8331597c0f81bc6bc2bd6158d5f8ba1ea334301ddc747bf165ae0e2aa7516ecb07536a51275bda14d577de80c7b1d7439c711d8610c496c1c9b13df6279a209603b33df1bd3e652796dfa06cc79c58b02980a3a4f43905aee3a5ab3af7427033af0634cdecccaa7f4d41b63ae1e97a43e99fec032b15604e817bf5a88495ea6e34ade7429b343f0f2f73d7d4c40ccd247cc7344065e02323929bf668ed9b35178396419e09d4d4f10ceaccd3a967f43978060090a24542d366a25a40f66b40d56f49cfb8df1160a964e55a05a21ff6866463962089adffd15d6b6a64e58d5ec1b4d8b30a4483471d2b1dd74b5227cf3ae271fc703245de77641d7a0942203da351ea89976e6c3650f5c049eac87184e5340f43b0d037b1d3546abc8ed359a1d1addec5d447fdbe2f95f701c7adfceb06164e6aa97df7b8f982981d6063bb46daf6dc001f1ea431b4d86c0ae8f7112d59dd5ad2f05d77ca6aae1fb98ea7caf6e96c7d7a3fc2bc00cae5ddb4851b103cbc6f3d05e8b15e76aa411e560faa8d46f0cf7e2d5474721a22b7d262082e9736436453a478eed52bd1f73c5664dc0ca366c9348a34851a66c16088a444904f33086c6cfbd9f49e8cce574d76806659c712a3c04ca26945898e9a0f6e6dc7e8787e75c99c65915023cf36255e209459e78d375780eda6e3f1a1ba8b0512026385940979855e7f057f823431eceaf7270c69081c508b3f04d49aef85756db10903d0154b1a2602e839250a166a1880ad0e0ea171c2fdbdb4451964710e9b074b618b5edb8fcaef1ed8339288a96bc7ae05e93ff2db755f2a3a15c0cebeb4c0e097cf307837ee26e72f064918c72ffab34db09b36c6d28209d38d280f789f8761e99a1dac8b56a43ebd6678e4086bd679eb340fc98e3d448b635c122f9f1dc181c0d361dd044e191b43d3e3e5c899a24f3d4a06a25551a753fcb2a1a7991df124bcccf77cd97e7d8ac94a771bc39b870082e21e912ae8969f0dca101d885879e09db0b28fc367b7d9840b0a9fb7e303a246ad2c6d0c37a9c06f43431dfa223d517e64447b97f6cdca17843db0e3e2ad378b193a5b079f2353f68c7cf1159652eb60746f18ad02d071e83b3d39d67bc8f1de7329e503e94773919e1a541c0c287723727247a25c9bbd959284cee5e418660d266401e5d44e363bf35179d40b9386d8e86b3c731dcb3da1ae334ad800e4fe93e9b9ca0fa65a6d4814d683038f918fa881bfeef7970a33ed37f7d49e4bf939338768e380c344525e436d7abba658c17ff1827a730c24fd84f5f43f8002c9085cb7af61ec12e25ac01c4ffececfaadfa91a94d992a2d971ce9ad26b2640e8e81e294a71ac9c3a8e45af283b90debbc3cce21f1489dc371d495ee8662d22d5b0d15d3eefd437e9c1fc3bed6ca7d68a39f5bb00c0d5fb1cc5a2567fa972c62ed0b84798deb02d11249b780ce1f57431e04fe77626250c2da0125dc9e3817be01a0e0444bbbb16585a00724aaba79e543170443cc64a95497b42d7b36884a0561ff46aca032549309d5f402d89e0f857adfa169ff95054d9cdb860354e54cb229fefe104cbc7a2129fc88123a8a88909e8dea934c3f0129e8382423b30ab942caf8e49f382eca55b5f5d41b8f66fa5875ac49262f8ae6fe21c95e0dc16d683546ebabfe45defd2266f1345b4a2e440e360d79d2fe750130a11611925071eb972f89044416bac14bcbcfee6aa4b0abdb2c2822bd5c5c840cae7e4ce93309777489707ccbb9d41ce67aa796b7e8783eea49684332a332dfd532da5e011b6064a25c783fc5d56128d4f098843fe18b773faebadbfb4624d3da7da7f0283c08d8c84b4c25e78a11ebbab3b7a226b523bfb5c7ddab094082362efdc650b11f28eab40aaee9ca1390de455b8be85e5bd8ab1f1d48448e66209f31358119d01016c9e2fd2b72461a78883b8c04a35614ae4a7a683045f09a1cea8140adb05cafa14618ae85c088e38bd37862011aca6474cc40b4012008195df8852e0e1d210aeea880b9481289448dcfca61e1fe75aa0126a0a3d5715fc576bab0fd80d46809cb3c94f875a81573f8daa704236379c3886b0392b7a40233902b658a9e4f6cb4886f3e6f659eb1f56990ca3293b52394ed6e038c8888a373e9976cbfc906d9b0e8a5cf7015e33a5165600582349e5dee075b129ced218c5f008ebff0da46abf2469a06c0904e821610e77bbfd79a73e24af394041a6d163028d45d8e48a5298887511bc2ddb099078400d34ec185277b9c918e53655ff5d87241ab9f81f3e2f6873b982ba2c1d17969f2b17aec02e7ef6859e7e6fba2d5a86a3b633db2e1418e2c6c4c1a487591ab4b816f2148d15a1729868a2fb3c88ded8cdf6a2d8f7d5152af792e40faaec13b6ef1015b2310f5bf197422605bb1111f4ada6ba6e8e5535bf6b3509fa2e5bd1c3f98e4ad85930ff2915bdb22e208f5547421c2e0294617837ccb35fc7757dd30fee5e05a5fbadfd2afe1e4eab88bce3bdc67b29390a07691fc23b5ee3887cd82700cfd5df3255008f4f7dbdce9e8e1af5295011b93c7efcfda9f8a9ba0313847214b5a8fdf45ea5b9d21c72ee34daade9a1c96fa0bc0cd7d59be7c0481e527eb4c0e4e0425008da1c6719b83060f54cbe65933aeacc3a187e03eed06932b34570047314424c1d56e6dc7e953069d07f64d446f596b153fefc730a5330ce32de79425ee1adfd896654ee1342ac652b513e27a7f3672f9f18302de9139187edc1dcbd23af615edd82afecf9776858815e2da9f278374f3210c89fb714dd3a2cc8aa7856770493efa01a6711b81e5927fda06c1d8915de243b039a90a60e36aec8028ed84c4faf4ab8b50bd7f371d80713b288414ef7880c4cd7b2f9b2dfd41cf5b0aa6c99491064b77b79dc68a60984d433d210a7e325c2e1c4589ef5185ff5cda8af99a257e0c8a773ade324240a365c87386d6f8de4bfa73cbdc902ccd9442136f644e29af2f55bbec5d4b058c24591182b9ce180afeb0754695e2b1674160b92cebdc674c0ab2a9e2f2dbdb281f8b34e6c0380c8ad0b31b09748779a189b418dec80347f3dff789e25c35bfa1231355bbf2b337c008601db769a411da5f593a14b6c841bb99748d159032f6980e564e5e7772bceaf8e3606597fa393856027ed48c1a13865be2896670e26df0a84b36c50bc219518bcd266df38c64f6763ecb5c76e32063b8f96d37c4d9bd2971577860931a13414b465b047ffd7ae6dfbbdf2d2adf37ff6e40dd419e8ff6de0f611a36764cb179e462422b083d686f1db48ddb21ce8f11414fbf7820acd15a7a54d1fc4cdac36b9590064370dbaa9a1ed463ad54e135b2bd1ea955afc748b89cd01f7b21f7dfca25c052dea14b848d5aa7c91e8017c13d5b07a56c2272cc9949f1b34f2d076f2e3bd98d486d8e7c0d6067ac80404f1752752c513dd0a36bc74c684e3474c20f08c15c51485f60b6a5c90e60640af6d9374eaa278f52ecaa212f2a3f94476475055c2155cc0397c522cd65579690bb977dc06751274eea01d7404d4fc244e58529c64baaba0ba4ee511d8fe05cb425a2f1e8f01b08a21d52b6ac8a2146dcac5519543cfb4bc8fdf23b058e234b9b8a30011a76452a9bf68303fbc2967f54ad532a217acad9b3eb6299aa9909a09de695f074e508b3478922fbeef8ba4eb4b32c7255f288698281903b46fb7cbf8010d4b81720e0c3c3a8f92a0b59fce8c1435ab6778b99d9f0ddc48a88f8dac544b689e6159d78efa42bac1cda9de4ea28fe4a1e6c774c2f5c73f7cbf6237bade953857cb9b3136c7bb0cf1f7228da3356392d634ce8f72dcefd71ff0a60d7b3839e713e5d7c48ae9464eddbfedb911a322201d8e7c4f0bd720354ec82e8562b70afb17fb7050448a7debfe5ad014c17cf9d456730dc70c6aec88c8b8b582b18c68bd964214f2e06efca461264734bd20febe6ab5206a884acb4f8b210e69ed70f1d68ef8ee2518c7dbf96009254ed9abd577429e57adbdd25d52eda067a9622996833af0daae03abc20dc0be4e15f1462b73820bd9a53fc40ab7f9939ba553032d416e46bc2294d4240aa0193be5c0fd9945220ff722560c13d8ed9e6ea8726c7f843c8f755cc3769e7bbd4eca22e5111f6306e4857c8802d0d9acad0677905b9b8108b6d2cf06cdb2dce711fc71fc887adbe1b0cbff78448254aedf3d6d62e158cebeb81f63ea7f517b50dd029dbf9ab636896ffaf5aeafa18f24782c7fa1131f4605ddf8c31132f3e9d9ddd35388432dfdeed59454e72d623eb204c5a828c66e7efba9382194169198fd8f3da8d9fdad6939ac172988d67a66f1020c5d755c9e92234557996fa7157d527dd4f7be63c8422c510e4ae542343e16366e9eb7e5654d4359036a129c727ac6e27563dda081e91f9fbb765ebdfab72fa9bc43d133905a92111d8a3f51993622b235b0031dd88ee6b20670ef24a347bb090b609f8990a956c96449cc15644418a9b7d69dcd41b236443c12e8023cb80666ef542cc37a7e6a454510b0f094f0889c28bb62eb8e52b667ef69572ee6c69146d9c86a0d95c65d63ced83ba2c41505547f0be97726f4263761bd02f84b9a13e05aaee20af35497e33779fff15a634cce566b222107b12ccd52bbb8d87260993c158e221d7b85c97a16cb1ca22a5435e48278ed8c5944a3ca38bafe73eda199a38cb8e113d4c15f0160a212cf255816debb1df0978cac10af9463608fec5445810337bec95ee04dacb152c5633e3288f65b200ba1b9bbc051101fc4ff254b238c6526e0466e183b24929be55b526bdd66de6974dff20b0fb27ba5d50aa12457312c1330f4e45777d4d72f38bb1e1350e057d51c7500e337ae67221c196841f4705319f024408cb300f23fceba100d76548cd09a58370c8a33fa74d4cbb88e9424317bce803cfc99628a843d8b2996dfcd3c9ac60342b7c6448624d44f8ba1b3740ce178690b5383ab843533916408e8ee133fb0016e0a492d5fcf7cc0cb07005345f6c6bdb210780f8c59897ba5598295be1206ace96d3685698f1f9f06d9337351e56a365b17fcc32e232a5fef4e8eac314c53a74a6e314a070f41c45e49c0435e6c311fed828a0972a5965469b63218d48b8adcc74db5d1f198703791f0375eae73f67a10b5650872a426669812ca61254f249daf97c4425e2b626fb2536dd9c443c603621550575bdb4cea7803a22c28da76f94710a8861fbc716ce93449bf8f0fba71b2443c4b1879ce9e943f3469e420ca721d601c6e8740fdb9613fa732a86e143aa2c91da7ce29d66df1eb40c9d44489970f13aeafe369a8e0c2e49fdb3ddc2466aca9813a8e523a3893944b6b4a9abeca2b41a7bfbe7c3770597a7fc8323ff33a7fc84f8e3e10b001c15393391ea8d2550068785778e388603236a05c6e181f9c6336c1055da521d3b41c2da28f4b6c813a814f6e70211b75fa033ee94b234746fbe24178b406f09c37ab0826be709d48c11a5fecb53b7e08c502f2479706a9065280b7ccad1e4a9a9bd7e4b9c78c005fbeb47fadb37128141831b6571a0653095efea934f470fa97b7d92228f7c4eb52bf82c4e4bacc6b394ebd84a563e793d5d984bd59d8e51faf9f723aa4ef8aa1743d72a54c5aed78e3d9b7bb9980c467289a4894befa6cac50153ea675ac1d3e0635b28b894d93247792491c6ced05497df"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) 00:40:37 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xfc030000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:37 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x7a}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1834.271889][T10325] xt_cgroup: xt_cgroup: no path or classid specified [ 1834.285509][T10329] binder: BINDER_SET_CONTEXT_MGR already set [ 1834.302620][T10331] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1834.303746][T10336] binder: 10323:10336 ioctl 40086602 400500 returned -22 00:40:37 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x4000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:37 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:37 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1834.332927][T10330] binder: 10330:10330 ioctl 40086602 40b301 returned -22 [ 1834.350331][T10326] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1834.359313][T10329] binder: 10323:10329 ioctl 40046207 0 returned -16 [ 1834.373419][T10340] device wlan1 entered promiscuous mode 00:40:37 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x8e}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:37 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pipe(&(0x7f0000000400)={0xffffffffffffffff}) pipe(&(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xa8, 0x0, &(0x7f0000000300)=[@increfs_done={0x40106308, 0x1}, @release, @acquire={0x40046305, 0x3}, @register_looper, @clear_death, @decrefs={0x40046307, 0x2}, @decrefs={0x40046307, 0x2}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000040)=""/71, 0x47, 0x1, 0x7}, @fda={0x66646185, 0x7, 0x2, 0x1d}, @flat=@handle={0x73682a85, 0x100, 0x2}}, &(0x7f0000000140)={0x0, 0x28, 0x48}}}, @acquire_done={0x40106309, 0x2}], 0x0, 0x0, &(0x7f0000000180)}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000005c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000500)={0x0}, 0x1, 0x0, 0x0, 0x4000006}, 0x4044040) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f0000000180)=[@release={0x40046306, 0x1}], 0x72, 0x0, &(0x7f0000000200)="6274ef4788e96919ed695cba3b46bff16a923caf3ae9ff9bc9e03b7774688e6a2620d71577382f009c51d29027153d13e0b06e60ce68f6dfe851c30bdd31f83ddb5214dafe28633daeedc4ee93592ee2d4962769acad095bb9d342f1576a126d771c486c9a66f99ae94ac005c014129cde51"}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40086602, 0x400500) [ 1834.402799][T10329] binder: BINDER_SET_CONTEXT_MGR already set [ 1834.425718][T10340] device wlan1 left promiscuous mode [ 1834.435086][T10329] binder: 10323:10329 ioctl 40046207 0 returned -16 [ 1834.492919][T10350] xt_cgroup: xt_cgroup: no path or classid specified [ 1834.528147][T10352] binder: 10352:10352 ioctl 40086602 40b301 returned -22 00:40:37 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f630c400200000000000000000000000063104400000000000000000000000000000000046304400300010008631040030000000000000000000000000076800b630000fa24075af25b41f1bba9b9e2f6eb19d52d05f46c7df8c49cb66c82b9a5d21c7c8ff0ed1fb08afe07c3d921006225223884f2b8fbda6bef24854447af1ddc42e82fc59bf6377cdc7b57c68be39951e32ee0d70d4d0c"], 0x88, 0x0, &(0x7f0000000080)="c0de9857372e291bef573fb5eee0f1d3495097aa478d4bfeab5854d2614cd63ef5ac5f0343843f3872b657d903746d67c55238789c89ed40b5e39d7062db746480ae80aed26b478c45527ab09512ab7d52b390a16057def9b3a499852646481e85ffc2110e86208f7e3bdda936f4b026d1ceb068f7d7a397c7c35f5ef68e2ba24b01ee62931eb2ad"}) [ 1834.544934][T10351] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1834.592903][T10370] xt_cgroup: xt_cgroup: no path or classid specified [ 1834.606778][T10363] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:40:37 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0xda}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:37 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0) clone(0x0, &(0x7f0000000040)="626ae04602ad5ffabf6f671ac0697dcdba3f8ac3835a45e6aea111eb92b3de4ccb67d15017d06e891b782f5b974b1ad6de98c8d5232fbd2f0adb08117757c6fb35dc265c1cee50e6fbc4fd9b104c085990f276718fd37693aee7", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)="6efbce41051f640102edcfad801c0ca1975b32b6d8f5f38756d175496465328b505b45bc3a6ed427895e34fbaf7d29d926b71c49df079380678f9861caa7bf50f7f361043b41a0136eaa9b456979c6e14901da94a9a70db67b5ace32c27a576baa22bd1096d028940ded4e687917ed938c79628ddc2a0d8c18ff73df1e685eca366e0fcac8b6151bb4fcb2cfd69a032fd8c97a666be01c910057f6713fdc5c109ac3a96cc62ee027bb308c235e1984b1f947a220c4e472") ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) [ 1834.684877][T10373] binder: 10372:10373 ioctl 40086602 400500 returned -22 [ 1834.720124][T10376] binder: 10374:10376 ioctl 40086602 400500 returned -22 [ 1834.826365][T10383] binder: 10382:10383 ioctl 40086602 400500 returned -22 00:40:38 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|-l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:38 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x30, r1, 0x1, 0x0, 0x0, {0x7}, [@L2TP_ATTR_IFNAME={0x14}, @L2TP_ATTR_SEND_SEQ={0x5}]}, 0x30}}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x4, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x11}, 0x11) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40086602, 0x400500) 00:40:38 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x100000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:38 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:38 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1835.126500][T10394] xt_cgroup: xt_cgroup: no path or classid specified [ 1835.147779][T10404] xt_cgroup: xt_cgroup: no path or classid specified [ 1835.155399][T10402] binder: 10391:10402 ioctl 40086602 400500 returned -22 [ 1835.156676][T10400] device wlan1 entered promiscuous mode 00:40:38 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x1000000, &(0x7f0000000000)="e12abc6e5843620bea8089edde40ec7c8b57db54b8cfa89da532ad58cabd033eaee0202b34ced9c35d4b237271d3aa26fb35f460f8fb99474c0e972f73cde126f0450f815b6c5a1f7638c0de63a10352aaa5bff747c6d309709f", &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)="d9c955225eb4b58ecf4a22d996c08485c3be1c7b98b766391ea4d0f9e0c68c96242f553039e943e846c194b3ee56cfe936f6ff86932d3d") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) 00:40:38 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x2, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:38 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x200000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1835.172221][T10409] xt_cgroup: xt_cgroup: no path or classid specified [ 1835.173840][T10399] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1835.203564][T10412] binder: 10412:10412 ioctl 40086602 40b301 returned -22 [ 1835.238814][T10400] device wlan1 left promiscuous mode [ 1835.238860][T10411] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1835.307523][T10422] xt_cgroup: xt_cgroup: no path or classid specified [ 1835.338291][T10427] binder: 10427:10427 ioctl 40086602 400500 returned -22 [ 1835.346630][T10428] xt_cgroup: xt_cgroup: no path or classid specified 00:40:38 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x3, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1835.375912][T10434] xt_cgroup: xt_cgroup: no path or classid specified [ 1835.386355][T10436] xt_cgroup: xt_cgroup: no path or classid specified 00:40:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="090000f0bf00070030b308000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050a897ae047b33301"], 0x58}}, 0x0) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r0, 0x8008f512, &(0x7f0000000080)) clone(0x90148180, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x800) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40086602, 0x400500) r4 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) getsockname$packet(r5, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14) sendmsg$nl_route_sched(r5, &(0x7f00000005c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000500)={0x0}, 0x1, 0x0, 0x0, 0x4000006}, 0x4044040) r6 = syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x2) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000dc0)={0x1c4, 0x0, &(0x7f0000000ac0)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000100)={@fd={0x66642a85, 0x0, r4}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000340)={@ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/240, 0xf0, 0x2, 0x13}, @flat=@weak_handle={0x77682a85, 0x100a, 0x2}, @flat=@weak_handle={0x77682a85, 0x1000, 0x1}}, &(0x7f00000002c0)={0x0, 0x28, 0x40}}, 0x40}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000440)={@flat=@binder={0x73622a85, 0x10e, 0x1}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/243, 0xf3, 0x2, 0x17}, @fda={0x66646185, 0x3, 0x2}}, &(0x7f00000004c0)={0x0, 0x18, 0x40}}, 0x1000}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f00000006c0)={@fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x100, 0x3}, @flat=@weak_handle={0x77682a85, 0x0, 0x1}}, &(0x7f0000000740)={0x0, 0x18, 0x30}}}, @dead_binder_done, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000840)={@fda={0x66646185, 0x0, 0x1, 0x15}, @fda={0x66646185, 0x0, 0x1, 0x23}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/161, 0xa1, 0x0, 0x36}}, &(0x7f00000008c0)={0x0, 0x20, 0x40}}, 0x1000}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000a00)={@ptr={0x70742a85, 0x1, &(0x7f0000000900)=""/206, 0xce, 0x1, 0xe}, @flat=@binder={0x73622a85, 0x1, 0x1}, @fda={0x66646185, 0x3}}, &(0x7f0000000a80)={0x0, 0x28, 0x40}}, 0x1000}], 0xd0, 0x0, &(0x7f0000000cc0)="b3d9d118dcfa5aa07e5cbd4cfa3858d7f30e9055a4ef51ff7100e747c7d6949073e20db98e85290d2c37794573a7f60df83a1dc1b6747be727fbb4cccb3c73c7e1bcba536c23116691a01163755ac06f0c73e854728235c0fa13b4dd08bdc6a509d3d4328ce486574831a5e1313353a04e6794dc295771db0d0dd597b1594791560cc3fa4495f931866f0b94da120aa32934659ba223c53c03073c1c0a2e2f14aecfcf6c79e4133cb43d773b9ca81deec221afe1ab6a2dee651fe3bef5d8b8a8a818d26d86e09421542c2350962c606b"}) syz_open_dev$binderN(&(0x7f0000000e00), 0x0, 0x6492c0a48b0c8ba7) r7 = openat$mice(0xffffffffffffff9c, &(0x7f0000000e40), 0x40000) ioctl$KVM_GET_XSAVE(r7, 0x9000aea4, &(0x7f0000000e80)) 00:40:38 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x4, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1835.496124][T10440] xt_cgroup: xt_cgroup: no path or classid specified [ 1835.543707][T10445] xt_cgroup: xt_cgroup: no path or classid specified [ 1835.585095][T10451] netlink: 68 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1835.645594][T10452] binder: 10447:10452 ioctl 40086602 400500 returned -22 00:40:39 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:39 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|0l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:39 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x5, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:39 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:39 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x300000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1835.816960][T10451] netlink: 68 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1835.838778][T10454] binder: 10447:10454 ioctl 40086602 400500 returned -22 [ 1835.920192][T10459] xt_cgroup: xt_cgroup: no path or classid specified [ 1835.925445][T10460] xt_cgroup: xt_cgroup: no path or classid specified [ 1835.951402][T10471] xt_cgroup: xt_cgroup: no path or classid specified [ 1835.959084][T10465] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:40:39 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x6, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:39 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1835.967159][T10467] netlink: 'syz-executor.0': attribute type 11 has an invalid length. 00:40:39 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x400000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:39 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f630c400200000000000000000000000063104400000000000000000000000000000000046304400300010008631040030000000000000000000000000076800b630000fa24075af25b41f1bba9b9e2f6eb19d52d05f46c7df8c49cb66c82b9a5d21c7c8ff0ed1fb08afe07c3d921006225223884f2b8fbda6bef24854447af1ddc42e82fc59bf6377cdc7b57c68be39951e32ee0d70d4d0c"], 0x88, 0x0, &(0x7f0000000080)="c0de9857372e291bef573fb5eee0f1d3495097aa478d4bfeab5854d2614cd63ef5ac5f0343843f3872b657d903746d67c55238789c89ed40b5e39d7062db746480ae80aed26b478c45527ab09512ab7d52b390a16057def9b3a499852646481e85ffc2110e86208f7e3bdda936f4b026d1ceb068f7d7a397c7c35f5ef68e2ba24b01ee62931eb2ad"}) [ 1836.034267][T10477] device wlan1 entered promiscuous mode 00:40:39 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:39 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x7, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1836.100638][T10481] xt_cgroup: xt_cgroup: no path or classid specified [ 1836.100869][T10477] device wlan1 left promiscuous mode [ 1836.124948][T10489] xt_cgroup: xt_cgroup: no path or classid specified 00:40:39 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:39 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1836.186757][T10492] binder: 10485:10492 ioctl 40086602 400500 returned -22 [ 1836.210666][T10493] xt_cgroup: xt_cgroup: no path or classid specified 00:40:39 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x8, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1836.280056][T10500] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1836.296010][T10508] xt_cgroup: xt_cgroup: no path or classid specified [ 1836.308680][T10507] xt_cgroup: xt_cgroup: no path or classid specified [ 1836.464878][T10522] xt_cgroup: xt_cgroup: no path or classid specified [ 1836.477572][T10518] binder: 10511:10518 ioctl 40086602 40b301 returned -22 [ 1836.493642][T10526] xt_cgroup: xt_cgroup: no path or classid specified 00:40:39 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|7l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:39 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:39 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xf, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:39 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x500000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:39 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x6177e79997e72671, 0x10, r2, 0x1c2c5000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:39 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1836.737449][T10533] device wlan1 entered promiscuous mode [ 1836.756577][T10536] xt_cgroup: xt_cgroup: no path or classid specified [ 1836.764927][T10535] xt_cgroup: xt_cgroup: no path or classid specified [ 1836.775882][T10533] device wlan1 left promiscuous mode 00:40:40 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x12, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:40 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1836.787631][T10543] xt_cgroup: xt_cgroup: no path or classid specified 00:40:40 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1836.843490][T10551] xt_cgroup: xt_cgroup: no path or classid specified 00:40:40 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x48, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1836.903635][T10558] xt_cgroup: xt_cgroup: no path or classid specified 00:40:40 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r5}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:40 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1836.994234][T10567] binder: 10564:10567 ioctl 40086602 40b301 returned -22 [ 1837.045834][T10571] xt_cgroup: xt_cgroup: no path or classid specified [ 1837.129710][T10581] binder: 10579:10581 ioctl 40086602 40b301 returned -22 [ 1837.148490][T10574] binder: 10570:10574 ioctl 40086602 40b301 returned -22 00:40:40 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|=l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:40 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x4c, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:40 executing program 0: clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:40 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:40 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x600000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:40 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:40 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1837.406089][T10589] xt_cgroup: xt_cgroup: no path or classid specified [ 1837.422964][T10594] ecn_mt_check6: 8 callbacks suppressed [ 1837.422981][T10594] xt_ecn: cannot match TCP bits for non-tcp packets [ 1837.428442][T10597] xt_cgroup: xt_cgroup: no path or classid specified [ 1837.442237][T10591] binder: 10584:10591 ioctl 40086602 40b301 returned -22 00:40:40 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x700000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:40 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x5a, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1837.479617][T10598] xt_cgroup: xt_cgroup: no path or classid specified [ 1837.501371][T10601] device wlan1 entered promiscuous mode 00:40:40 executing program 0: clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1837.551245][T10601] device wlan1 left promiscuous mode 00:40:40 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1837.587222][T10607] xt_ecn: cannot match TCP bits for non-tcp packets 00:40:40 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1837.655718][T10614] xt_cgroup: xt_cgroup: no path or classid specified [ 1837.666260][T10612] xt_cgroup: xt_cgroup: no path or classid specified [ 1837.682804][T10621] xt_cgroup: xt_cgroup: no path or classid specified [ 1837.689975][T10616] binder: 10613:10616 ioctl 40086602 40b301 returned -22 [ 1837.756529][T10626] xt_ecn: cannot match TCP bits for non-tcp packets [ 1837.757846][T10628] xt_cgroup: xt_cgroup: no path or classid specified 00:40:41 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|cl\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:41 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x5c, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:41 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:41 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xf00000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:41 executing program 0: clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:41 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:41 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:41 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x1200000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1838.021608][T10633] xt_cgroup: xt_cgroup: no path or classid specified [ 1838.052588][T10637] xt_cgroup: xt_cgroup: no path or classid specified [ 1838.059150][T10639] xt_cgroup: xt_cgroup: no path or classid specified 00:40:41 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:41 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1838.120077][T10650] device wlan1 entered promiscuous mode 00:40:41 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x60, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1838.186449][T10650] device wlan1 left promiscuous mode [ 1838.196921][T10653] binder: 10645:10653 ioctl 40086602 40b301 returned -22 00:40:41 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1838.241861][T10666] xt_cgroup: xt_cgroup: no path or classid specified [ 1838.316602][T10678] xt_cgroup: xt_cgroup: no path or classid specified [ 1838.338577][T10684] xt_cgroup: xt_cgroup: no path or classid specified [ 1838.339077][T10682] xt_cgroup: xt_cgroup: no path or classid specified [ 1838.360613][T10686] xt_ecn: cannot match TCP bits for non-tcp packets 00:40:41 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6\n\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:41 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x68, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:41 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:41 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x1c03000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:41 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:41 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1838.688099][T10689] xt_cgroup: xt_cgroup: no path or classid specified [ 1838.692267][T10692] xt_cgroup: xt_cgroup: no path or classid specified [ 1838.714663][T10693] xt_ecn: cannot match TCP bits for non-tcp packets 00:40:41 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x6c, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:42 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x1f00000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1838.738428][T10697] xt_cgroup: xt_cgroup: no path or classid specified [ 1838.793672][T10701] device wlan1 entered promiscuous mode [ 1838.804934][T10700] nla_validate_range_unsigned: 12 callbacks suppressed [ 1838.804960][T10700] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1838.835799][T10701] device wlan1 left promiscuous mode 00:40:42 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1838.845843][T10707] xt_cgroup: xt_cgroup: no path or classid specified 00:40:42 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x74, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1838.887880][T10703] binder: 10702:10703 ioctl 40086602 40b301 returned -22 [ 1838.889211][T10715] xt_cgroup: xt_cgroup: no path or classid specified [ 1838.934227][T10703] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1838.963047][T10721] xt_ecn: cannot match TCP bits for non-tcp packets [ 1838.972001][T10720] xt_cgroup: xt_cgroup: no path or classid specified 00:40:42 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x7a, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1838.989128][T10725] xt_cgroup: xt_cgroup: no path or classid specified [ 1839.000145][T10726] xt_cgroup: xt_cgroup: no path or classid specified 00:40:42 executing program 4: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1839.093064][T10729] xt_cgroup: xt_cgroup: no path or classid specified [ 1839.137559][T10732] xt_ecn: cannot match TCP bits for non-tcp packets 00:40:42 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6#\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:42 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x8e, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:42 executing program 4: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:42 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x2000000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:42 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:42 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1839.393124][T10741] xt_cgroup: xt_cgroup: no path or classid specified [ 1839.411913][T10748] xt_cgroup: xt_cgroup: no path or classid specified [ 1839.428514][T10745] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1839.428785][T10746] xt_cgroup: xt_cgroup: no path or classid specified 00:40:42 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xda, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:42 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:42 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x4800000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1839.455961][T10753] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1839.480052][T10744] xt_ecn: cannot match TCP bits for non-tcp packets [ 1839.493300][T10758] device wlan1 entered promiscuous mode [ 1839.544124][T10758] device wlan1 left promiscuous mode [ 1839.552696][T10764] xt_cgroup: xt_cgroup: no path or classid specified [ 1839.576546][T10755] binder: 10752:10755 ioctl 40086602 40b301 returned -22 [ 1839.587132][T10767] xt_cgroup: xt_cgroup: no path or classid specified 00:40:42 executing program 4: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:42 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x1c8, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1839.619014][T10755] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1839.664027][T10772] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1839.674195][T10773] xt_cgroup: xt_cgroup: no path or classid specified [ 1839.696858][T10774] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:40:43 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x1d4, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1839.743948][T10779] xt_ecn: cannot match TCP bits for non-tcp packets [ 1839.753294][T10780] xt_cgroup: xt_cgroup: no path or classid specified [ 1839.777075][T10784] xt_cgroup: xt_cgroup: no path or classid specified [ 1839.778046][T10786] xt_cgroup: xt_cgroup: no path or classid specified [ 1839.875640][T10788] xt_cgroup: xt_cgroup: no path or classid specified [ 1839.886198][T10791] xt_cgroup: xt_cgroup: no path or classid specified 00:40:43 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:43 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x29a, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:43 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6%\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:43 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x4811000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:43 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:43 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:43 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x4a03000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:43 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x2a2, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1840.133474][T10795] xt_cgroup: xt_cgroup: no path or classid specified [ 1840.157184][T10797] xt_cgroup: xt_cgroup: no path or classid specified [ 1840.168497][T10801] xt_cgroup: xt_cgroup: no path or classid specified [ 1840.216306][T10806] device wlan1 entered promiscuous mode 00:40:43 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1840.266867][T10810] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1840.279666][T10806] device wlan1 left promiscuous mode [ 1840.280450][T10807] binder: 10804:10807 ioctl 40086602 40b301 returned -22 [ 1840.289862][T10816] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1840.306607][T10818] xt_cgroup: xt_cgroup: no path or classid specified 00:40:43 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x300, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:43 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1840.306793][T10820] xt_cgroup: xt_cgroup: no path or classid specified [ 1840.323360][T10823] xt_cgroup: xt_cgroup: no path or classid specified [ 1840.343220][T10824] netlink: 'syz-executor.0': attribute type 11 has an invalid length. 00:40:43 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x31c, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1840.399141][T10831] xt_cgroup: xt_cgroup: no path or classid specified [ 1840.416598][T10834] xt_cgroup: xt_cgroup: no path or classid specified 00:40:43 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) 00:40:43 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x34a, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1840.508956][T10842] xt_cgroup: xt_cgroup: no path or classid specified [ 1840.612619][T10850] xt_cgroup: xt_cgroup: no path or classid specified [ 1840.631139][T10854] xt_cgroup: xt_cgroup: no path or classid specified 00:40:44 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6*\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:44 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) 00:40:44 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:44 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x360, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:44 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:44 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x4c00000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:44 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) 00:40:44 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x37c, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1840.899092][T10863] xt_cgroup: xt_cgroup: no path or classid specified [ 1840.921115][T10870] xt_cgroup: xt_cgroup: no path or classid specified [ 1840.937110][T10867] xt_cgroup: xt_cgroup: no path or classid specified 00:40:44 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x5012000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:44 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x0, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1840.971249][T10873] device wlan1 entered promiscuous mode 00:40:44 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1841.025800][T10876] binder: 10876:10876 ioctl 40086602 40b301 returned -22 [ 1841.037687][T10873] device wlan1 left promiscuous mode 00:40:44 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x396, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1841.101576][T10886] xt_cgroup: xt_cgroup: no path or classid specified [ 1841.102369][T10883] xt_cgroup: xt_cgroup: no path or classid specified [ 1841.123358][T10888] xt_ecn: cannot match TCP bits for non-tcp packets [ 1841.133388][T10892] xt_cgroup: xt_cgroup: no path or classid specified [ 1841.188214][T10897] xt_cgroup: xt_cgroup: no path or classid specified [ 1841.274520][T10902] xt_cgroup: xt_cgroup: no path or classid specified 00:40:44 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6+\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:44 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x0, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:44 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x3ba, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:44 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x5a00000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:44 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:44 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:44 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x0, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:44 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x5c00000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1841.554789][T10918] xt_cgroup: xt_cgroup: no path or classid specified [ 1841.561905][T10919] binder: 10919:10919 ioctl 40086602 40b301 returned -22 [ 1841.569379][T10916] xt_cgroup: xt_cgroup: no path or classid specified 00:40:44 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:44 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1841.635655][T10930] device wlan1 entered promiscuous mode [ 1841.644338][T10932] xt_cgroup: xt_cgroup: no path or classid specified 00:40:44 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1841.683706][T10930] device wlan1 left promiscuous mode 00:40:45 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x3f4, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1841.755699][T10940] binder: 10940:10940 ioctl 40086602 40b301 returned -22 [ 1841.774238][T10946] xt_cgroup: xt_cgroup: no path or classid specified [ 1841.808790][T10949] xt_cgroup: xt_cgroup: no path or classid specified [ 1841.869992][T10958] xt_cgroup: xt_cgroup: no path or classid specified [ 1841.884612][T10957] xt_cgroup: xt_cgroup: no path or classid specified [ 1841.893943][T10961] xt_cgroup: xt_cgroup: no path or classid specified 00:40:45 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6-\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:45 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:45 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x3fa, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:45 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x6000000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:45 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:45 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:45 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:45 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x6800000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1842.129499][T10964] xt_cgroup: xt_cgroup: no path or classid specified [ 1842.145534][T10966] xt_cgroup: xt_cgroup: no path or classid specified 00:40:45 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x3fc, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1842.187914][T10972] xt_cgroup: xt_cgroup: no path or classid specified [ 1842.210002][T10980] device wlan1 entered promiscuous mode [ 1842.217457][T10973] binder: 10969:10973 ioctl 40086602 40b301 returned -22 00:40:45 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:45 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f0, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x350) 00:40:45 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1842.309664][T10988] xt_cgroup: xt_cgroup: no path or classid specified [ 1842.324702][T10986] xt_cgroup: xt_cgroup: no path or classid specified 00:40:45 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6.\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:45 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x6c00000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:45 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f0, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x350) [ 1842.373253][T10993] xt_cgroup: xt_cgroup: no path or classid specified [ 1842.403184][T10999] xt_cgroup: xt_cgroup: no path or classid specified 00:40:45 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x3fe, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:45 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f0, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x350) 00:40:45 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x7400000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1842.481782][T11006] xt_cgroup: xt_cgroup: no path or classid specified [ 1842.514357][T11011] binder: 11011:11011 ioctl 40086602 40b301 returned -22 00:40:45 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1842.550362][T11015] device wlan1 left promiscuous mode 00:40:45 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x12f8, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x10d8, 0x1120, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1358) 00:40:45 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x500, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1842.642081][T11025] xt_cgroup: xt_cgroup: no path or classid specified [ 1842.666860][T11029] xt_cgroup: xt_cgroup: no path or classid specified [ 1842.675295][T11031] xt_cgroup: xt_cgroup: no path or classid specified 00:40:45 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:45 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x12f8, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x10d8, 0x1120, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1358) [ 1842.772848][T11041] xt_cgroup: xt_cgroup: no path or classid specified 00:40:46 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1842.828591][T11045] xt_cgroup: xt_cgroup: no path or classid specified [ 1842.837572][T11052] xt_cgroup: xt_cgroup: no path or classid specified [ 1842.970430][T11060] binder: 11060:11060 ioctl 40086602 40b301 returned -22 [ 1843.132188][T11019] device wlan1 entered promiscuous mode [ 1843.151776][T11015] device wlan1 left promiscuous mode 00:40:46 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|60\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:46 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x600, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:46 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x12f8, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x10d8, 0x1120, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1358) 00:40:46 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:46 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x7403000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:46 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:46 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:46 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x7a00000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:46 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x700, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1843.440207][T11067] xt_cgroup: xt_cgroup: no path or classid specified [ 1843.456203][T11068] xt_cgroup: xt_cgroup: no path or classid specified [ 1843.469511][T11077] xt_cgroup: xt_cgroup: no path or classid specified [ 1843.518313][T11080] device wlan1 entered promiscuous mode [ 1843.526112][T11071] binder: 11064:11071 ioctl 40086602 40b301 returned -22 00:40:46 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r1, 0x1, 0x13, &(0x7f0000e530e9)=""/16, &(0x7f0000000000)=0x170) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:46 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1843.592363][T11086] xt_cgroup: xt_cgroup: no path or classid specified [ 1843.599321][T11080] device wlan1 left promiscuous mode 00:40:46 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1843.651627][T11093] xt_cgroup: xt_cgroup: no path or classid specified [ 1843.681075][T11096] xt_cgroup: xt_cgroup: no path or classid specified [ 1843.699652][T11100] xt_cgroup: xt_cgroup: no path or classid specified [ 1843.741338][T11107] binder: 11107:11107 ioctl 40086602 40b301 returned -22 [ 1843.754887][T11108] xt_cgroup: xt_cgroup: no path or classid specified [ 1843.773587][T11111] xt_cgroup: xt_cgroup: no path or classid specified [ 1843.866904][T11113] nla_validate_range_unsigned: 18 callbacks suppressed [ 1843.866923][T11113] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:40:47 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6L\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:47 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x48}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:47 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xf00, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:47 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:47 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x8e00000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:47 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) socket(0x20000000000000a, 0x2, 0x0) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:47 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x1148, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1844.096778][T11118] xt_cgroup: xt_cgroup: no path or classid specified [ 1844.109719][T11119] xt_cgroup: xt_cgroup: no path or classid specified 00:40:47 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r4}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:47 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x9603000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:47 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1844.157652][T11127] binder: 11127:11127 ioctl 40086602 40b301 returned -22 [ 1844.162865][T11129] xt_cgroup: xt_cgroup: no path or classid specified [ 1844.177343][T11128] device wlan1 entered promiscuous mode [ 1844.196825][T11127] netlink: 'syz-executor.0': attribute type 11 has an invalid length. 00:40:47 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x1200, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1844.243871][T11134] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1844.261822][T11128] device wlan1 left promiscuous mode [ 1844.274564][T11135] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1844.286130][T11140] xt_cgroup: xt_cgroup: no path or classid specified 00:40:47 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r4}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1844.336520][T11148] binder: 11148:11148 ioctl 40086602 40b301 returned -22 [ 1844.356037][T11152] xt_cgroup: xt_cgroup: no path or classid specified [ 1844.359975][T11145] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1844.432428][T11162] xt_cgroup: xt_cgroup: no path or classid specified [ 1844.447537][T11166] xt_cgroup: xt_cgroup: no path or classid specified [ 1844.464541][T11169] xt_cgroup: xt_cgroup: no path or classid specified 00:40:47 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6X\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:47 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r4}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:47 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x1250, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:47 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:47 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0x9a02000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:47 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) socket(0x20000000000000a, 0x2, 0x0) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:48 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xa202000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1844.772656][T11175] xt_cgroup: xt_cgroup: no path or classid specified [ 1844.779568][T11174] xt_cgroup: xt_cgroup: no path or classid specified [ 1844.790758][T11182] xt_cgroup: xt_cgroup: no path or classid specified 00:40:48 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x1c03, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:48 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x0, 0x0, 0x4}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1844.827410][T11184] binder: 11171:11184 ioctl 40086602 40b301 returned -22 [ 1844.848462][T11187] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1844.851793][T11185] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:40:48 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b254", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1844.871939][T11194] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1844.894603][T11193] device wlan1 entered promiscuous mode [ 1844.928098][T11193] device wlan1 left promiscuous mode [ 1844.956105][T11200] xt_cgroup: xt_cgroup: no path or classid specified [ 1844.981855][T11201] xt_cgroup: xt_cgroup: no path or classid specified [ 1844.991154][T11207] xt_cgroup: xt_cgroup: no path or classid specified 00:40:48 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x1f00, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:48 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="8de2b25bc21d6e5a3a50c8a3ea9c9c700dd1e0ab76d8f05ab85f08b03fcfb73cecb0cd62e16b05fcd6585552cb3eb32297a67308c642cf8c9a55b4d75737579df880a53fe707b4b11d29ec8cab5ffc792cab92640d9a351e7a5e6d8733641de28e9f", &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000200)="84bd74e15ec18ad4e16d6e7743c34ae0be8c3545aa65bf654a353d9f03b3c47d1bee22e576527d1089efbaf357d2c036c98e9ea62e34bc987b022b8b5a00e89c5098df11d40be49482e6f5afe285221bfc2a5e7e6202598422f842fd15c2dd114a77a83f92d188a9343d8dc64a916b4ca4d57b1543c4b10ef29a5337e3cb6e33e7380f22bd190ed4245b4b2ac771be58f0617ee04ea0caabe5dd0d952fc76218f9b94041ca3c284340701054749ba85d9ce0efd2ad11752ae9bcf5681a8b56def194fc807672f5fef0f2adbdc16453d109dd6894730d6922cdd147a4fe3619d8d22eedfd6aa4b91202f153cbd25e2b1fc14264a5dd3ba6c54c40797227375386f3932ce7678328ca7b315fdd76f82b7c9bbc2d7f06cbd51364c853101f68603f791810c5cbcd4e8b4196907e370180d33685282793bcf30e734be55282d9bb6d90420fe19e9bb83c2318bfd8be29b8b96f43be433908d3dadfec157e4f47333cf74a15a5c7b2d8375540a751c5618da11f2fc7920667924895de0e2fb58d501d04a43c25538750814dfb02e4c4a66c4a56e2d28dcad6178afa7b70f7a68c1a0b52572826ed0b49261e83e84cd649f5348b837278b942c5366670b11b0c7da85bcea734533c3c1add96f3aa1dd2bc753184bfff42047af758264914d44caebd58f960d2719daf679780d1f022be7a21430141b66e96d1f41c9fe4a3ae8ef0cd855a110b079079d717d31d2124e90028ae3f539bdc26373b65b62bffc1bfe1fe2752f3127f4a457ef8aa0a3b5cd76238ecd9cfcde81d0225eb84c13bcf663fb531f16071b5d3f3b96d3b1edd4a5f1c0edae8eeaf961503b99acac273be9f0bb93d77e3251c05c4ddb4484e6458419928f2c82d90c00b8618236c92dfab0489dfa98f41143de483781c384fd1660175c419aba24a6a5a0f20cc8379865ce5ac43bce335f4a699ae6b9970f02a527dc9a71735b0d68b2946906b1f6081fd0fb45b3fac34c3044a42ecf973f337fcad77c94d3049bd7817ee4a0d77ea2a8de940ef5c6993e2bd5b134f1bb47273db460a07adb978402012685a4d758e661fea20921bfc418281aabf15358daf38184a364d6a6549e3b91806a4c1d3c8863caf3fde19433bd3114f1c352c5764e8c12612b30805bb88858cb3674bcaf2af3992f13b0b1ac7cd378cd61427dcd78d0d2e915f777455064ff079b805adb4910581b3a2016d15d5171a3dcd34cc29a0e9b7ca8754f9a5622ce8dad7417d9c5e84c1a1d9a20ad9f35b8d591259b9fd1017ac855c162eb869a7fad892eb671ea1533fbce3545cbb84e906124b43e5425245859d66b200a1792daf6c894a86856e7a9ab0059f614b559e3d027de5abc6b1465f9c557a6f74c6c96cdc8a81d78223ec89fd95cef16c6f10006870980979cfee34558a463f3b21ac94729d4997246a1a6861155905e29f2e2b5b8f78d05dda3d69df551e9e6fba3cc470f57ca53ecb4596f2911c119a9c20f533e33bb47ee658f8257163d9427dd88c47745c756c393570e36bac69d72c2635f44be71dba156db3b4353c4cd035630980f3b40c80851bfefc16b988805d97c9c8918c23cfd87b05aa61e25408f1fc4e55a3845fcbeb5fcbb6f2da480c24ad7166d3824bb8f836e6f98db271d8c1105eb345961bf4cd765662b64d76a06e3c9ab445cd0a446801704d97cb430b5199ecc0ac16065801f1503fdbdd9626be7ff18c21d298eadeb014c2a3cecdf10c61255625ea778b71b6cf3e45e5bc83b1ab4de4f8c3d1a9e824624e1741703cd7c91f2035f4118fd6b49b78126e7b33e2ba5bff0c0d39c277e7e410784b0adb6ec974bbc6aed9525be9f1c41f02526174047eb0696970dd3a78bd5f3fc266ce12b40f40415b25df0ccf98e882daf6bbffd9ebdb6328cfe8487f4077912525aaf73e8e8f41c07583d9ff8e46d0317ecf52e0221fb680634499cf524b667c036c39769d6d896454a90b88bbe4c3a41d281a41188481fbe9488c12727ebff795d092b160d8b29d74faf28b272205a87a3e0f4de773db226da802fc07b5d92ba37def5eb653baf3819c4aeab4124f04e119226bd7baf4783fa642b9bcd793d583f952a65ac8cd9f6ef76e9f52ed65aea7c04d99ba37afdee887a31d3b2c54749e252bac83dfcf5fe273fd27e146a373fcf525dedc6b641a3763d45c52012a130ff5609227e5499293a83c1198eaafd9976079abcbf2a072748a98ba86473f8e76192be0e0093241eb93c9c476522d312fd5de121c80d84ad5f4ce4125232ec1161868934c8825fa4d3902b0e056d09608c5d8239a1d08121e50c042dee4646ea1380b1650189b5bbe2f8a2fc2e4687816a08c2faa81a83ee33b0104ae2c479de79b00a7888ce1f667227dfdf6dd2b28cfc2f7c7a5acc0cf578968a5405c5e5278b0a218ceda27e7a2f2c400f91e6f61ab0014b92747dfddc25a174f9416f4a40dd31571c17a3e54442a050e6faeb1dbe1a7a6c30c2d4a1957672d5599e0a0d68668d1ab4d00cdcad2b5fefa7ff27acb150c61c660c8addaa44a746d757812e67f4d8e119e88816a733955259b2ddfc139cd74511e49b7e17c715851d43bb87dcaa3c19e02f1dc18fee54168f9cc2dfb1128c478c5d9cc03ebd4b82c138e949e6d069ffe335174e9daaba86ab93891aaf4f9d3c49258965ebcc421e7c058a1db72768e4cdf60cce264793ab207fee6b7d0163c8ac7ba810b39f9a8478e02a6ce4629549c70ebdcce1df00b9aec30073e58e674eb82ecb5b0dfb0a2be74870251d2c7018557e76d36533089f7ec108edd21cb90c437845a8b2c3bc2174c5f9b73cde576b227b0ac3487cee3d23458ba12cc28142ef64275279cd13d778c2fa646ac7359079bbecabf1449f255789e881a1595b5b81e28223a73d4b206b0581d1d48056b17191abb2f76ee352980c47df300a2b965cb9301c110b5f211fd2e0262ba8b73ce1aece826d9eb11ab3f39ea5f3e173d7cd5b1d0c4a0a1037d944d41cb203dd447579439af77e8fc9972b601909392e57b6a986cab4daf07fa6ce44ba19f558bfbaadcea2907f9d6b9d17032383beb225a3e80d3406dfd34c0fa478c5cd1fbf61d93f9fc6c9f02be1e9abc33d5a3253c711c4836b2c2ec3130bd1af21d57c17ac174a7e602eae1608314451e0a16abea9ba360fa8b86137368db507f30152de2e1dcd3e019bab66a85fbb4d7b1135a152133d0ee8f7088d291fe7cf5a2aecdcf9dbbd739dd4a1ace3355b8577509a43bfeb35b8e21497cef33b1d7f001cab7ae8392450fc52d38d5ab241fbac91e5cbe925ef9f87e898d3eca3f75698ac615137be00ae745eb16c362c0ae0ae30a604f80fb6406408d0641ab8bdf1070c70fc38a7ca27ca37a9e9b836f0e1856d882033510056fdef9eb557112849c81de22a48404ec02dfe4a2d5a3284ca5856e13a6aa4562be679b604baaf589eefddbfc8a244b1b98d126ae652d8d27429e849573bcf760fde741572fd1ac2e5ba1dc43246fc39032115d6b56ea694fc4e6162a860d190b06a3c70cc821dbb5209081a5f8c9fc6f425f05c0c67b66c108504652b7a99b5ddf191262fdf987a1821edb68f6850c109e0c807b23bfc205ba4e8822b952897088188decd942ba57092a3c0a2992e62091e152d274db4440b412cc5b7ce608edd13b01ef4f210abf9387ae950fe5420a2e7f4c6d5f7322fa8736b2da430abd56328416288d509167f5b7576367ea3fc6241a8a805bba4a14fa25067dc8e1b29fddef772ca44bdb8d2c615b449a1d50cc34e5cd2f15d5368f779c2398886f1705ad1395d7b4d2d22aaf5f11e2e2c1972e889753ad0b8ae4e0e82c15187860d51bdf38722a2bf97bcef363db59ddcb50300f74d03df1a187aebeee34c1bf8f082f3c80c16565c3cfb5f0643ba22630e903340d9d9dc59a920eee5b7ca3ff374acfafaf5c3a81c0c2f21ed94b3d704ba398ca7e1cd08197b5bb76264417da13ce43c260f8b1ace0dab423111002e32df9707373faee6fed88d96220d627a5ccf2e0ac18f5c63a4f2cc370ca40ae3c59b9e8068cf16b744ad5e271a6e1c4b643b5319a9e081ffe5eef189c35038178fee1f7337c9fe55ce209e9ddfe5b92621b46cde76d9779b40d913b15c5ddb5015a27c2640a274dd7c96b96564abe1ad6f916484abe720bf9544a9f1a3db237136879ff4b992959397481dd0ebabf6062de269d6e169d95589769f450b03cd8a3f40251be59d70ead9b089424cbe6de8eedd0bf0e096026af0425242f9d11d845c37b0a0f212296088d0f743a5e78e24c6b92a76bd06de847bb23800bca5706c74b52e2a1d65dc2680ee80590a36ebff967aba0800bd64ba22ec6115c526969879da4015520cc4f9c15309e9a393c9610fd3900143a7fc30f4ba3a869e4c5cef1a13c353fb2d8bc42a1113413b71cf858d8b7980118efef65fceb58014c0fd849c353543d1a1a2bdfc064a9672458bcd3026f6a0fc1697828173a12141a098525493cd7af3a400b55f84e454de220599b0947f8fd65fa776ee189fe1d05dfcdff190345c8972bd27e1c4ed2d5cc18f641d1beab8462c2b7aacbdc7694651d274aa2a44ab8f997f94fa2ab641a572e04ba5594e04136867b59892834f5800f80fbdeb905a5db3875fbe6949dc1533699475dc8291ea4f8d668dab8bed34b415aa3e3991b3fbe7d79722c9b0cad21e3d0669d66321a130089bce3dddb696cfd4c8b4a97ba145049c8ec29dc8400911428f88fcce081168631126bca2002d6db62c6f9016e0eb1d7455da25a9104e587c5053b71ebe49ced5a7c0493300e5ff48d43fb7082171de970871bb7627e4564e9ec170616b436ccc60cb97487bb77273ceacd72e2dd09afd965b0f09d33ea41ae521829e9efa4007a5b82bbbf0f8e905cb355f14d85efd16ec144c4faa5ffc99610b54b9ee4d0b72a306e34eb08d94e91f523c8f22823471e9ab3b4b975f0f8804391708cb850724b07e0dec029f70d2f5ee118f8ea69835d45c51f7f7fb39ae679122704c317e731ca4686aedb738a4902c15d14c247fe314be9b8c67893aca439ca810831dd53d610dc20ecbce9f986c569ef258cf222ad25c47702a64f4a8b3a5c0aa5c37576f9cc124e0c2211695aec749adb02a3ac8fbf22df057f7ab928ce58a16c3e7b9a1f008023665c5ceb4f10581d12c2425e5569640a24d37c1eeef4ee9bf08eed688b9e4d2c14b5e8afec8690185b37818568dc3c580fc1f70d383923ce871c5ccdbf2509585981f9b932508e4d699bc860421c6db7cf762c86e9356aeef26674de366bad9cc547b4d81359640988b9fefc96ea95179c1060962293658dd7b3919c6f35d5c6c8d37e761ec980681fc6f85cc84355262ca24951a939a6da155de4e0f23fcec33c855e819a007d57ef9befea654e19195c7bf46acc1ac06ce17684ffa8fc27604d2c96bbf746de143901c8d7a379bb403a44ebedb3dc5949305c126d7c364df96d83b6cf466af461af81fcea72df60b00f5f58aab0b8b49db880fa7a156978e1b351c0d55d0c6874e02bbcf50d4b9c8cd0873f2c52ed778b3826c3cb1a39463f7390d1c9aa388ca9b041d7b555b57bd22ca5ca11a77c53719972bdb398d4a65c5be69d5ad3323b91dc38f4a12a617f9b5d3f08bebe6ec27a31058923dd47af9dc52e6bb9cae4a5ec051050e5665122101b0bac9ec42a5f7bbebe85c509505f1cd313389d80f006476be1626b021f2572f9b3152dc836f36958c4c773b74bfe1535ba33a604fe2af45f052e53a13603c9683c4e") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x400500) preadv(r0, &(0x7f0000001500)=[{&(0x7f0000000100)=""/133, 0x85}, {&(0x7f0000001200)=""/226, 0xe2}, {&(0x7f0000001300)=""/5, 0x5}, {&(0x7f0000001340)=""/153, 0x99}, {&(0x7f0000001400)=""/225, 0xe1}], 0x5, 0x8, 0x5) [ 1845.009664][T11202] xt_cgroup: xt_cgroup: no path or classid specified [ 1845.029913][T11209] xt_cgroup: xt_cgroup: no path or classid specified [ 1845.112345][T11215] xt_cgroup: xt_cgroup: no path or classid specified [ 1845.134229][T11219] xt_cgroup: xt_cgroup: no path or classid specified [ 1845.223895][T11220] binder: 11221:11220 ioctl 40086602 400500 returned -22 00:40:48 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6u\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:48 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b254", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:48 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x2000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:48 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:48 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) socket(0x20000000000000a, 0x2, 0x0) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:48 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xb801000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1845.422664][T11233] xt_cgroup: xt_cgroup: no path or classid specified [ 1845.441659][T11234] xt_cgroup: xt_cgroup: no path or classid specified [ 1845.442146][T11241] xt_cgroup: xt_cgroup: no path or classid specified [ 1845.459027][T11236] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:40:48 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:48 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:48 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xba03000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1845.474753][T11242] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1845.495720][T11231] binder: 11223:11231 ioctl 40086602 40b301 returned -22 00:40:48 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x4800, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1845.539364][T11247] device wlan1 entered promiscuous mode 00:40:48 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b254", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1845.610203][T11247] device wlan1 left promiscuous mode 00:40:48 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1845.683398][T11259] xt_cgroup: xt_cgroup: no path or classid specified [ 1845.691531][T11260] xt_cgroup: xt_cgroup: no path or classid specified [ 1845.711725][T11265] xt_cgroup: xt_cgroup: no path or classid specified [ 1845.778996][T11275] xt_cgroup: xt_cgroup: no path or classid specified [ 1845.794869][T11271] binder: 11266:11271 ioctl 40086602 40b301 returned -22 00:40:49 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9=\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:49 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x4811, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:49 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b254", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:49 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xc801000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:49 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:49 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:49 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:49 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xd401000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:49 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b254", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1846.182536][T11288] xt_cgroup: xt_cgroup: no path or classid specified [ 1846.183901][T11292] xt_cgroup: xt_cgroup: no path or classid specified [ 1846.215842][T11302] xt_cgroup: xt_cgroup: no path or classid specified 00:40:49 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x4a03, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1846.260003][T11304] device wlan1 entered promiscuous mode [ 1846.293613][T11306] binder: 11306:11306 ioctl 40086602 40b301 returned -22 [ 1846.303466][T11304] device wlan1 left promiscuous mode 00:40:49 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b254", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:49 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x4c00, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1846.386101][T11319] xt_cgroup: xt_cgroup: no path or classid specified [ 1846.387132][T11321] xt_cgroup: xt_cgroup: no path or classid specified [ 1846.416069][T11326] xt_cgroup: xt_cgroup: no path or classid specified [ 1846.482079][T11333] xt_cgroup: xt_cgroup: no path or classid specified [ 1846.525462][T11337] xt_cgroup: xt_cgroup: no path or classid specified 00:40:50 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9\x00 \xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:50 executing program 4: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee%\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:50 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x5012, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:50 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xda00000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:50 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:50 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:50 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x5a00, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1846.814423][T11346] device wlan1 left promiscuous mode [ 1846.825374][T11348] xt_cgroup: xt_cgroup: no path or classid specified [ 1846.837733][T11354] xt_cgroup: xt_cgroup: no path or classid specified [ 1846.844551][T11357] xt_cgroup: xt_cgroup: no path or classid specified [ 1846.855735][T11347] binder: 11343:11347 ioctl 40086602 40b301 returned -22 00:40:50 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1846.969613][T11370] xt_cgroup: xt_cgroup: no path or classid specified [ 1846.981526][T11369] xt_cgroup: xt_cgroup: no path or classid specified [ 1846.997174][T11376] xt_cgroup: xt_cgroup: no path or classid specified 00:40:50 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x5c00, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1847.022964][T11373] binder: 11373:11373 ioctl 40086602 40b301 returned -22 00:40:50 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x6000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1847.077806][T11379] xt_cgroup: xt_cgroup: no path or classid specified 00:40:50 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x6003, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1847.134160][T11385] xt_cgroup: xt_cgroup: no path or classid specified 00:40:50 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x6800, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1847.188979][T11390] xt_cgroup: xt_cgroup: no path or classid specified [ 1847.234288][T11359] device wlan1 entered promiscuous mode [ 1847.252991][T11366] device wlan1 entered promiscuous mode [ 1847.276633][T11396] xt_cgroup: xt_cgroup: no path or classid specified [ 1847.306540][T11361] device wlan1 left promiscuous mode 00:40:50 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x12\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:50 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xfa03000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:50 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x6c00, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:50 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79be", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:50 executing program 3: ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:50 executing program 4: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00=\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:50 executing program 3: ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:50 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x7400, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:50 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79be", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1847.580959][T11408] device wlan1 left promiscuous mode [ 1847.592594][T11410] xt_cgroup: xt_cgroup: no path or classid specified [ 1847.614707][T11414] xt_cgroup: xt_cgroup: no path or classid specified 00:40:51 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79be", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1847.711998][T11429] xt_cgroup: xt_cgroup: no path or classid specified [ 1847.721848][T11428] xt_cgroup: xt_cgroup: no path or classid specified [ 1847.736230][T11436] xt_cgroup: xt_cgroup: no path or classid specified 00:40:51 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x7a00, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1847.860175][T11443] binder: 11443:11443 ioctl 40086602 40b301 returned -22 00:40:51 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x7c03, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1847.902660][T11445] xt_cgroup: xt_cgroup: no path or classid specified [ 1847.956165][T11450] xt_cgroup: xt_cgroup: no path or classid specified [ 1848.017710][T11418] device wlan1 entered promiscuous mode [ 1848.035385][T11433] device wlan1 entered promiscuous mode [ 1848.112021][T11423] device wlan1 left promiscuous mode 00:40:51 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;%\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:51 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x8e00, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:51 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xfc03000000000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:51 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb8888", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:51 executing program 3: ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:51 executing program 4: write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x1d}, 0x2) r0 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=0xffffffffffffffff, 0x4) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r0) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r2 = getpgrp(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) getsockname$packet(r3, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14) sendmsg$nl_route_sched(r3, &(0x7f00000005c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000500)={0x0}, 0x1, 0x0, 0x0, 0x4000006}, 0x4044040) write$USERIO_CMD_SEND_INTERRUPT(r3, &(0x7f0000000080)={0x2, 0x3}, 0x2) tkill(r2, 0x23) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40086602, 0x400500) 00:40:51 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x9603, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1848.328107][T11457] xt_cgroup: xt_cgroup: no path or classid specified 00:40:51 executing program 3: socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:51 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x20000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:51 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x0, 0xffffffff00000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1848.387718][T11465] binder: 11466:11465 ioctl 40086602 40b301 returned -22 [ 1848.396325][T11469] xt_cgroup: xt_cgroup: no path or classid specified 00:40:51 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb8888", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:51 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x20000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1848.472275][T11478] device wlan1 entered promiscuous mode [ 1848.496109][T11483] xt_cgroup: xt_cgroup: no path or classid specified [ 1848.513388][T11485] xt_cgroup: xt_cgroup: no path or classid specified [ 1848.536479][T11478] device wlan1 left promiscuous mode [ 1848.550667][T11495] xt_cgroup: xt_cgroup: no path or classid specified [ 1848.578401][T11499] xt_cgroup: xt_cgroup: no path or classid specified [ 1848.591145][T11502] xt_cgroup: xt_cgroup: no path or classid specified [ 1848.604382][T11498] binder: 11498:11498 ioctl 40086602 40b301 returned -22 [ 1848.654983][T11508] xt_cgroup: xt_cgroup: no path or classid specified 00:40:52 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;=\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:52 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x9a02, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:52 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108, 0x0, {0x20000000}}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:52 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb8888", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:52 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:52 executing program 3: socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1848.987389][T11512] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.014663][T11519] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.016591][T11514] xt_cgroup: xt_cgroup: no path or classid specified 00:40:52 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x2, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:52 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40054c) [ 1849.037919][T11526] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.048539][T11522] device wlan1 entered promiscuous mode 00:40:52 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xa202, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1849.082847][T11521] nla_validate_range_unsigned: 21 callbacks suppressed [ 1849.082864][T11521] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1849.121934][T11522] device wlan1 left promiscuous mode [ 1849.132503][T11530] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1849.149363][T11531] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1849.172579][T11536] binder: 11532:11536 ioctl 40086602 40054c returned -22 00:40:52 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc00c620f, 0x40b301) 00:40:52 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xba03, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1849.192783][T11541] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.211809][T11542] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.232807][T11547] xt_cgroup: xt_cgroup: no path or classid specified 00:40:52 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc00c620f, 0x40b301) [ 1849.263438][T11551] binder: 11550:11551 ioctl c00c620f 40b301 returned -22 [ 1849.287719][T11553] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.324720][T11556] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.336375][T11557] binder: 11555:11557 ioctl c00c620f 40b301 returned -22 00:40:52 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;]\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:52 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xa202, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:52 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x3, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:52 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xc801, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:52 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:52 executing program 3: socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:52 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x4, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:52 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) [ 1849.647960][T11565] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.664516][T11573] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.670324][T11572] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.695841][T11579] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.706426][T11576] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1849.723286][T11582] device wlan1 entered promiscuous mode [ 1849.733764][T11580] binder: 11580:11580 ioctl 40086602 40b301 returned -22 00:40:52 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xd401, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1849.749128][T11577] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1849.778167][T11585] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:40:53 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:53 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) [ 1849.797205][T11582] device wlan1 left promiscuous mode [ 1849.812850][T11587] binder: 11586:11587 ioctl 401c5820 400500 returned -22 00:40:53 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xda00, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1849.868822][T11594] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.882663][T11595] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.899957][T11601] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.923357][T11604] binder: 11598:11604 ioctl 401c5820 400500 returned -22 [ 1849.943615][T11600] binder: 11600:11600 ioctl 40086602 40b301 returned -22 [ 1849.950651][T11606] xt_cgroup: xt_cgroup: no path or classid specified [ 1849.968137][T11597] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1850.012107][T11609] xt_cgroup: xt_cgroup: no path or classid specified 00:40:53 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xbe\n\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:53 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) 00:40:53 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xf403, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:53 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x5, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:53 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:53 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:53 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x401c5820, 0x400500) [ 1850.274136][T11615] binder: 11613:11615 ioctl 401c5820 400500 returned -22 [ 1850.292192][T11617] xt_cgroup: xt_cgroup: no path or classid specified [ 1850.309920][T11621] xt_cgroup: xt_cgroup: no path or classid specified 00:40:53 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xfa03, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:53 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x401c5820, 0x400500) [ 1850.335207][T11622] device wlan1 entered promiscuous mode [ 1850.363218][T11622] device wlan1 left promiscuous mode [ 1850.375777][T11629] xt_cgroup: xt_cgroup: no path or classid specified [ 1850.405931][T11631] binder: 11631:11631 ioctl 40086602 40b301 returned -22 [ 1850.422773][T11627] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1850.428102][T11635] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1850.446308][T11639] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:40:53 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xfc03, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:53 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x401c5820, 0x400500) [ 1850.455665][T11640] xt_cgroup: xt_cgroup: no path or classid specified [ 1850.467529][T11643] xt_cgroup: xt_cgroup: no path or classid specified [ 1850.475965][T11645] xt_cgroup: xt_cgroup: no path or classid specified 00:40:53 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xfe03, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1850.570269][T11650] xt_cgroup: xt_cgroup: no path or classid specified [ 1850.589975][T11653] xt_cgroup: xt_cgroup: no path or classid specified [ 1850.695894][T11658] xt_cgroup: xt_cgroup: no path or classid specified [ 1850.708118][T11661] xt_cgroup: xt_cgroup: no path or classid specified 00:40:54 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xbe%\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) 00:40:54 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x40000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:54 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x6, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:54 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", 0x0, &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:54 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:40:54 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x7, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1850.999516][T11668] xt_cgroup: xt_cgroup: no path or classid specified [ 1851.006127][T11672] xt_cgroup: xt_cgroup: no path or classid specified [ 1851.019585][T11673] binder: 11666:11673 ioctl 401c5820 400500 returned -22 [ 1851.028589][T11679] xt_cgroup: xt_cgroup: no path or classid specified 00:40:54 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x1000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:54 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1851.065008][T11675] binder: 11675:11675 ioctl 40086602 40b301 returned -22 [ 1851.078641][T11681] device wlan1 entered promiscuous mode 00:40:54 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", 0x0, &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) [ 1851.157497][T11681] device wlan1 left promiscuous mode [ 1851.184204][T11689] xt_cgroup: xt_cgroup: no path or classid specified [ 1851.187370][T11690] xt_cgroup: xt_cgroup: no path or classid specified 00:40:54 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x2000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1851.285974][T11704] binder: 11701:11704 ioctl 401c5820 400500 returned -22 [ 1851.303564][T11708] xt_cgroup: xt_cgroup: no path or classid specified [ 1851.310952][T11705] binder: 11698:11705 ioctl 40086602 40b301 returned -22 [ 1851.326887][T11710] xt_cgroup: xt_cgroup: no path or classid specified [ 1851.346976][T11715] xt_cgroup: xt_cgroup: no path or classid specified 00:40:54 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber=\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:54 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x3000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:54 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", 0x0, &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) 00:40:54 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0xf, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:54 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1851.728613][T11728] xt_cgroup: xt_cgroup: no path or classid specified [ 1851.731818][T11722] binder: 11722:11722 ioctl 40086602 40b301 returned -22 [ 1851.737690][T11730] binder: 11724:11730 ioctl 401c5820 400500 returned -22 [ 1851.749823][T11725] xt_cgroup: xt_cgroup: no path or classid specified [ 1851.757323][T11734] xt_cgroup: xt_cgroup: no path or classid specified 00:40:55 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), 0x0, &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:55 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x12, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1851.774854][T11735] device wlan1 entered promiscuous mode 00:40:55 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x4000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1851.832381][T11735] device wlan1 left promiscuous mode 00:40:55 executing program 4: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) 00:40:55 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1851.942165][T11744] binder: 11744:11744 ioctl 40086602 40b301 returned -22 [ 1851.958675][T11746] xt_cgroup: xt_cgroup: no path or classid specified [ 1851.968688][T11747] xt_cgroup: xt_cgroup: no path or classid specified [ 1852.022248][T11756] xt_cgroup: xt_cgroup: no path or classid specified [ 1852.047883][T11759] xt_cgroup: xt_cgroup: no path or classid specified [ 1852.067817][T11754] binder: 11750:11754 ioctl 401c5820 400500 returned -22 00:40:55 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x5000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1852.224808][T11764] xt_cgroup: xt_cgroup: no path or classid specified [ 1852.232712][T11767] xt_cgroup: xt_cgroup: no path or classid specified 00:40:55 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\x00 \xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:40:55 executing program 4: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) 00:40:55 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x6000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:55 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x48, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:40:55 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), 0x0, &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:40:55 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)) ioctl$TUNSETLINK(0xffffffffffffffff, 0x8912, 0x400308) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1852.434632][T11769] binder: 11768:11769 ioctl 401c5820 400500 returned -22 [ 1852.447950][T11776] xt_cgroup: xt_cgroup: no path or classid specified [ 1852.457964][T11774] xt_cgroup: xt_cgroup: no path or classid specified [ 1852.476064][T11783] xt_cgroup: xt_cgroup: no path or classid specified 00:40:55 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x4c, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1852.478900][T11779] device wlan1 entered promiscuous mode 00:40:55 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x7000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1852.517504][T11779] device wlan1 left promiscuous mode 00:40:55 executing program 4: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) [ 1852.547781][T11785] binder: 11785:11785 ioctl 40086602 40b301 returned -22 [ 1852.612192][T11795] xt_cgroup: xt_cgroup: no path or classid specified [ 1852.635932][T11796] xt_cgroup: xt_cgroup: no path or classid specified [ 1852.654658][ T3266] ieee802154 phy0 wpan0: encryption failed: -22 [ 1852.661013][ T3266] ieee802154 phy1 wpan1: encryption failed: -22 00:41:05 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) 00:41:05 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x8000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:41:06 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) [ 1863.089117][T11813] xt_cgroup: xt_cgroup: no path or classid specified [ 1863.122085][T11816] xt_cgroup: xt_cgroup: no path or classid specified [ 1863.330745][ T7260] usb 4-1: USB disconnect, device number 24 00:41:06 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\x02\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:41:06 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), 0x0, &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:41:06 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) 00:41:06 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0xf000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:41:06 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x5a, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1863.620990][T11833] xt_cgroup: xt_cgroup: no path or classid specified [ 1863.644619][T11838] xt_cgroup: xt_cgroup: no path or classid specified [ 1863.665116][T11834] binder: 11830:11834 ioctl 40086602 40b301 returned -22 [ 1863.710913][T11834] nla_validate_range_unsigned: 14 callbacks suppressed [ 1863.710931][T11834] netlink: 'syz-executor.0': attribute type 11 has an invalid length. [ 1863.792210][T11848] xt_cgroup: xt_cgroup: no path or classid specified [ 1863.979128][T11845] device wlan1 entered promiscuous mode [ 1863.997526][T11848] xt_cgroup: xt_cgroup: no path or classid specified [ 1864.008124][T11840] device wlan1 left promiscuous mode [ 1864.551859][ T6694] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1864.562577][ T6694] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1864.933572][ T6694] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1864.960213][ T6694] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1865.204203][ T6694] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1865.214566][ T6694] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1865.382065][ T6694] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1865.392378][ T6694] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1867.572792][ T6694] device hsr_slave_0 left promiscuous mode [ 1867.580782][ T6694] device hsr_slave_1 left promiscuous mode [ 1867.602780][ T6694] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1867.621177][ T6694] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1867.657064][ T6694] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1867.667066][ T6694] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1867.676811][ T6694] device bridge_slave_1 left promiscuous mode [ 1867.684081][ T6694] bridge0: port 2(bridge_slave_1) entered disabled state [ 1867.692897][ T6694] device bridge_slave_0 left promiscuous mode [ 1867.699029][ T6694] bridge0: port 1(bridge_slave_0) entered disabled state [ 1867.716425][ T6694] device veth0_macvtap left promiscuous mode [ 1867.724131][ T6694] device veth1_vlan left promiscuous mode [ 1867.731361][ T6694] device veth0_vlan left promiscuous mode [ 1869.599818][ T6778] Bluetooth: hci3: command 0x0409 tx timeout [ 1871.597194][ T6694] bond1 (unregistering): Released all slaves [ 1871.679728][ T7260] Bluetooth: hci3: command 0x041b tx timeout [ 1871.696408][ T6694] team0 (unregistering): Port device team_slave_1 removed [ 1871.708758][ T6694] team0 (unregistering): Port device team_slave_0 removed [ 1871.724511][ T6694] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1871.737445][ T6694] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1871.802207][ T6694] bond0 (unregistering): Released all slaves [ 1871.946425][T11914] chnl_net:caif_netlink_parms(): no params data found [ 1872.038805][T11914] bridge0: port 1(bridge_slave_0) entered blocking state [ 1872.048340][T11914] bridge0: port 1(bridge_slave_0) entered disabled state [ 1872.061036][T11914] device bridge_slave_0 entered promiscuous mode [ 1872.070580][T11914] bridge0: port 2(bridge_slave_1) entered blocking state [ 1872.077781][T11914] bridge0: port 2(bridge_slave_1) entered disabled state [ 1872.087085][T11914] device bridge_slave_1 entered promiscuous mode [ 1872.126107][T11914] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1872.138638][T11914] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1872.184272][T11914] team0: Port device team_slave_0 added [ 1872.193763][T11914] team0: Port device team_slave_1 added [ 1872.214417][T11914] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1872.221714][T11914] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1872.248033][T11914] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1872.271426][T11914] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1872.278366][T11914] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1872.305487][T11914] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1872.335172][T11914] device hsr_slave_0 entered promiscuous mode [ 1872.342626][T11914] device hsr_slave_1 entered promiscuous mode [ 1872.349025][T11914] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1872.357092][T11914] Cannot create hsr debugfs directory [ 1872.502895][T11914] bridge0: port 2(bridge_slave_1) entered blocking state [ 1872.510005][T11914] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1872.517351][T11914] bridge0: port 1(bridge_slave_0) entered blocking state [ 1872.524477][T11914] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1872.600842][T11914] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1872.671073][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1872.680331][ T20] bridge0: port 1(bridge_slave_0) entered disabled state [ 1872.695955][ T20] bridge0: port 2(bridge_slave_1) entered disabled state [ 1872.726130][T11914] 8021q: adding VLAN 0 to HW filter on device team0 [ 1872.755856][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1872.765262][ T20] bridge0: port 1(bridge_slave_0) entered blocking state [ 1872.772392][ T20] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1872.812210][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1872.821845][ T7959] bridge0: port 2(bridge_slave_1) entered blocking state [ 1872.828900][ T7959] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1872.852901][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1872.862318][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1872.880913][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1872.897659][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1872.907728][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1872.924127][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1872.935581][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1872.952549][T11914] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1872.981573][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1872.989025][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1873.011393][T11914] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1873.051736][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1873.061424][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1873.094370][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1873.103962][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1873.115835][T11914] device veth0_vlan entered promiscuous mode [ 1873.125397][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1873.134981][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1873.150136][T11914] device veth1_vlan entered promiscuous mode [ 1873.179816][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1873.187863][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1873.197978][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1873.207703][ T7959] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1873.220304][T11914] device veth0_macvtap entered promiscuous mode [ 1873.236975][T11914] device veth1_macvtap entered promiscuous mode [ 1873.257305][T11914] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1873.269211][T11914] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1873.280290][T11914] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1873.291665][T11914] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1873.301562][T11914] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1873.312252][T11914] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1873.326668][T11914] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1873.337223][T11914] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1873.357752][T11914] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1873.368520][T11914] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1873.380480][T11914] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1873.388756][ T9666] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1873.398059][ T9666] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1873.406533][ T9666] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1873.415599][ T9666] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1873.434981][T11914] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1873.452452][T11914] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1873.470317][T11914] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1873.488619][T11914] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1873.498693][T11914] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1873.518185][T11914] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1873.529984][T11914] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1873.548286][T11914] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1873.558218][T11914] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 1873.576831][T11914] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1873.591275][T11914] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1873.601992][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1873.620262][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1873.714918][ T6702] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1873.729745][ T6702] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1873.742815][ T20] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1873.769543][ T9666] Bluetooth: hci3: command 0x040f tx timeout [ 1873.813157][ T6702] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1873.839793][ T6702] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1873.870530][ T9666] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 00:41:17 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x0) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:41:17 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x401c5820, 0x400500) 00:41:17 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x12000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:41:17 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), 0x0) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:41:17 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x5c, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:41:17 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\x03\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') [ 1873.999010][T12146] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1874.019544][T12146] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:41:17 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x401c5820, 0x400500) [ 1874.100090][T12163] xt_cgroup: xt_cgroup: no path or classid specified [ 1874.112590][T12161] xt_cgroup: xt_cgroup: no path or classid specified [ 1874.117922][T12160] device wlan1 entered promiscuous mode 00:41:17 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x60, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:41:17 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), 0x0) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1874.141977][T12168] xt_cgroup: xt_cgroup: no path or classid specified [ 1874.159674][T12160] device wlan1 left promiscuous mode [ 1874.176862][T12169] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:41:17 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x1c030000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1874.191358][T12173] netlink: 'syz-executor.3': attribute type 11 has an invalid length. 00:41:17 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x401c5820, 0x400500) [ 1874.311376][T12187] xt_cgroup: xt_cgroup: no path or classid specified [ 1874.333737][T12183] binder: 12176:12183 ioctl 40086602 40b301 returned -22 [ 1874.356541][T12189] xt_cgroup: xt_cgroup: no path or classid specified [ 1874.374475][T12195] xt_cgroup: xt_cgroup: no path or classid specified [ 1874.383704][T12183] netlink: 'syz-executor.0': attribute type 11 has an invalid length. 00:41:17 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x1f000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1874.407204][T12198] xt_cgroup: xt_cgroup: no path or classid specified [ 1874.518509][T12203] xt_cgroup: xt_cgroup: no path or classid specified 00:41:18 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x0) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:41:18 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", 0x0, &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:41:18 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x20000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:41:18 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x68, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:41:18 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\x05\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:41:18 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), 0x0) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1874.843517][T12210] xt_cgroup: xt_cgroup: no path or classid specified [ 1874.866913][T12213] xt_cgroup: xt_cgroup: no path or classid specified 00:41:18 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", 0x0, &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:41:18 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x48000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1874.902538][T12218] xt_cgroup: xt_cgroup: no path or classid specified 00:41:18 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x6c, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1874.949613][T12221] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1874.960323][T12221] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1874.981190][T12229] device wlan1 entered promiscuous mode [ 1875.003184][T12228] binder: 12228:12228 ioctl 40086602 40b301 returned -22 [ 1875.020331][T12227] netlink: 'syz-executor.0': attribute type 11 has an invalid length. 00:41:18 executing program 4: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", 0x0, &(0x7f0000000100), &(0x7f0000000200)="57c52ca0d4a2a6437484b505cb7d065a251f434b5c3fa532d175ca6e42844efad36ae013d5f908f80686ded31ed2c9f4ebc312662e9f361fe01fa45656b3c894c79a4ab6f6e8f5fa76a8441c082ea44483fbccb8dcf91c4ad785915070d5d8515010e3a71b396b33103855e4d24246a074ce6e07da83a677299da9956fa37336477e2be077480b0045cefe205ef0d0e9974c5f1c040a7f1a21738bb0cdaa4ad916c890ac468dd9cae53fbfc0aefe475490970928b2f35c4616d64c32551f7e2b5df053524e866760b460b1355651bd849c5c") r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) [ 1875.059148][T12229] device wlan1 left promiscuous mode [ 1875.066537][T12238] xt_cgroup: xt_cgroup: no path or classid specified [ 1875.076553][T12239] xt_cgroup: xt_cgroup: no path or classid specified 00:41:18 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x0) clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 00:41:18 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x48110000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1875.120474][T12243] xt_cgroup: xt_cgroup: no path or classid specified 00:41:18 executing program 4 (fault-call:2 fault-nth:0): clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) 00:41:18 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x4a030000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1875.190970][T12248] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1875.191531][T12252] xt_cgroup: xt_cgroup: no path or classid specified [ 1875.214340][T12250] netlink: 'syz-executor.3': attribute type 11 has an invalid length. [ 1875.225610][T12254] xt_cgroup: xt_cgroup: no path or classid specified 00:41:18 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x4c000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1875.299874][T12265] xt_cgroup: xt_cgroup: no path or classid specified [ 1875.323546][T12262] FAULT_INJECTION: forcing a failure. [ 1875.323546][T12262] name failslab, interval 1, probability 0, space 0, times 0 [ 1875.344419][T12271] xt_cgroup: xt_cgroup: no path or classid specified [ 1875.354744][T12262] CPU: 1 PID: 12262 Comm: syz-executor.4 Not tainted 5.14.0-rc4-syzkaller #0 [ 1875.363533][T12262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1875.373597][T12262] Call Trace: [ 1875.376881][T12262] dump_stack_lvl+0xcd/0x134 [ 1875.381496][T12262] should_fail.cold+0x5/0xa [ 1875.386022][T12262] ? tomoyo_realpath_from_path+0xc3/0x620 [ 1875.391763][T12262] should_failslab+0x5/0x10 [ 1875.396280][T12262] __kmalloc+0x72/0x330 [ 1875.400456][T12262] tomoyo_realpath_from_path+0xc3/0x620 [ 1875.406022][T12262] ? tomoyo_profile+0x42/0x50 [ 1875.410718][T12262] tomoyo_path_number_perm+0x1d5/0x590 [ 1875.416189][T12262] ? tomoyo_path_number_perm+0x18d/0x590 [ 1875.421837][T12262] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 1875.427694][T12262] ? lock_downgrade+0x6e0/0x6e0 [ 1875.432570][T12262] ? __fget_files+0x23d/0x3e0 [ 1875.437252][T12262] security_file_ioctl+0x50/0xb0 [ 1875.442198][T12262] __x64_sys_ioctl+0xb3/0x200 [ 1875.446877][T12262] do_syscall_64+0x35/0xb0 [ 1875.451290][T12262] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1875.457190][T12262] RIP: 0033:0x4665e9 [ 1875.461075][T12262] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1875.480678][T12262] RSP: 002b:00007faed682b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1875.489091][T12262] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9 00:41:18 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x50120000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1875.497053][T12262] RDX: 0000000000400500 RSI: 00000000401c5820 RDI: 0000000000000003 [ 1875.505015][T12262] RBP: 00007faed682b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1875.512997][T12262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1875.520960][T12262] R13: 0000000000a9fb1f R14: 00007faed682b300 R15: 0000000000022000 [ 1875.573976][T12262] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1875.581128][T12262] binder: 12261:12262 ioctl 401c5820 400500 returned -22 [ 1875.596694][T12276] xt_cgroup: xt_cgroup: no path or classid specified [ 1875.623291][T12279] xt_cgroup: xt_cgroup: no path or classid specified [ 1875.761715][ T6694] ================================================================== [ 1875.770348][ T6694] BUG: KASAN: use-after-free in dec_ucount+0x54/0x130 [ 1875.777373][ T6694] Write of size 8 at addr ffff88801d52ec40 by task kworker/u4:7/6694 [ 1875.785516][ T6694] [ 1875.787840][ T6694] CPU: 0 PID: 6694 Comm: kworker/u4:7 Not tainted 5.14.0-rc4-syzkaller #0 [ 1875.796324][ T6694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1875.806371][ T6694] Workqueue: netns cleanup_net [ 1875.811203][ T6694] Call Trace: [ 1875.814476][ T6694] dump_stack_lvl+0xcd/0x134 [ 1875.819103][ T6694] print_address_description.constprop.0.cold+0x6c/0x309 [ 1875.826197][ T6694] ? dec_ucount+0x54/0x130 [ 1875.830603][ T6694] ? dec_ucount+0x54/0x130 [ 1875.835007][ T6694] kasan_report.cold+0x83/0xdf [ 1875.839780][ T6694] ? dec_ucount+0x54/0x130 [ 1875.844205][ T6694] kasan_check_range+0x13d/0x180 [ 1875.849268][ T6694] dec_ucount+0x54/0x130 [ 1875.853511][ T6694] cleanup_net+0x6f3/0xb10 [ 1875.857920][ T6694] ? ops_free_list.part.0+0x3d0/0x3d0 [ 1875.863296][ T6694] process_one_work+0x98d/0x1630 [ 1875.868259][ T6694] ? pwq_dec_nr_in_flight+0x320/0x320 [ 1875.873672][ T6694] ? rwlock_bug.part.0+0x90/0x90 [ 1875.878605][ T6694] ? _raw_spin_lock_irq+0x41/0x50 [ 1875.883630][ T6694] worker_thread+0x658/0x11f0 [ 1875.888337][ T6694] ? process_one_work+0x1630/0x1630 [ 1875.893532][ T6694] kthread+0x3e5/0x4d0 [ 1875.897594][ T6694] ? set_kthread_struct+0x130/0x130 [ 1875.902793][ T6694] ret_from_fork+0x1f/0x30 [ 1875.907256][ T6694] [ 1875.909563][ T6694] Allocated by task 8464: [ 1875.913869][ T6694] kasan_save_stack+0x1b/0x40 [ 1875.918534][ T6694] __kasan_kmalloc+0x9b/0xd0 [ 1875.923111][ T6694] alloc_ucounts+0x23d/0x5b0 [ 1875.927699][ T6694] set_cred_ucounts+0x171/0x3a0 [ 1875.932556][ T6694] copy_creds+0x70e/0xb60 [ 1875.936882][ T6694] copy_process+0x13c5/0x74d0 [ 1875.941549][ T6694] kernel_clone+0xe7/0xac0 [ 1875.945982][ T6694] __do_sys_clone+0xc8/0x110 [ 1875.950558][ T6694] do_syscall_64+0x35/0xb0 [ 1875.954962][ T6694] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1875.960842][ T6694] [ 1875.963149][ T6694] Freed by task 11857: [ 1875.967196][ T6694] kasan_save_stack+0x1b/0x40 [ 1875.971858][ T6694] kasan_set_track+0x1c/0x30 [ 1875.976449][ T6694] kasan_set_free_info+0x20/0x30 [ 1875.981397][ T6694] __kasan_slab_free+0xfb/0x130 [ 1875.986251][ T6694] slab_free_freelist_hook+0xdf/0x240 [ 1875.991624][ T6694] kfree+0xe4/0x530 [ 1875.995413][ T6694] put_ucounts+0x153/0x1c0 [ 1875.999815][ T6694] put_cred_rcu+0x27a/0x520 [ 1876.004309][ T6694] rcu_core+0x7ab/0x1380 [ 1876.008553][ T6694] __do_softirq+0x29b/0x9c2 [ 1876.013047][ T6694] [ 1876.015357][ T6694] Last potentially related work creation: [ 1876.021062][ T6694] kasan_save_stack+0x1b/0x40 [ 1876.025727][ T6694] kasan_record_aux_stack+0xe5/0x110 [ 1876.030996][ T6694] insert_work+0x48/0x370 [ 1876.035311][ T6694] __queue_work+0x5c1/0xed0 [ 1876.039797][ T6694] queue_work_on+0xee/0x110 [ 1876.044287][ T6694] call_usermodehelper_exec+0x1f0/0x4c0 [ 1876.049826][ T6694] kobject_uevent_env+0xf8f/0x1650 [ 1876.055009][ T6694] kobject_synth_uevent+0x701/0x850 [ 1876.060198][ T6694] store_uevent+0x12/0x20 [ 1876.064565][ T6694] module_attr_store+0x50/0x80 [ 1876.069310][ T6694] sysfs_kf_write+0x110/0x160 [ 1876.074036][ T6694] kernfs_fop_write_iter+0x342/0x500 [ 1876.079329][ T6694] new_sync_write+0x426/0x650 [ 1876.084000][ T6694] vfs_write+0x75a/0xa40 [ 1876.088234][ T6694] ksys_write+0x12d/0x250 [ 1876.092566][ T6694] do_syscall_64+0x35/0xb0 [ 1876.096977][ T6694] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1876.102869][ T6694] [ 1876.105438][ T6694] Second to last potentially related work creation: [ 1876.112003][ T6694] kasan_save_stack+0x1b/0x40 [ 1876.116677][ T6694] kasan_record_aux_stack+0xe5/0x110 [ 1876.121963][ T6694] insert_work+0x48/0x370 [ 1876.126279][ T6694] __queue_work+0x5c1/0xed0 [ 1876.130810][ T6694] queue_work_on+0xee/0x110 [ 1876.135329][ T6694] call_usermodehelper_exec+0x1f0/0x4c0 [ 1876.140877][ T6694] kobject_uevent_env+0xf8f/0x1650 [ 1876.145980][ T6694] driver_register+0x2db/0x3a0 [ 1876.150811][ T6694] init+0x528/0xba7 [ 1876.154647][ T6694] do_one_initcall+0x103/0x650 [ 1876.159403][ T6694] kernel_init_freeable+0x6b8/0x741 [ 1876.164607][ T6694] kernel_init+0x1a/0x1d0 [ 1876.168944][ T6694] ret_from_fork+0x1f/0x30 [ 1876.173349][ T6694] [ 1876.175669][ T6694] The buggy address belongs to the object at ffff88801d52ec00 [ 1876.175669][ T6694] which belongs to the cache kmalloc-192 of size 192 [ 1876.189733][ T6694] The buggy address is located 64 bytes inside of [ 1876.189733][ T6694] 192-byte region [ffff88801d52ec00, ffff88801d52ecc0) [ 1876.202922][ T6694] The buggy address belongs to the page: [ 1876.208542][ T6694] page:ffffea0000754b80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d52e [ 1876.218686][ T6694] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 1876.226220][ T6694] raw: 00fff00000000200 ffffea0000618b80 0000000700000007 ffff888010841a00 [ 1876.234798][ T6694] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 1876.243381][ T6694] page dumped because: kasan: bad access detected [ 1876.249775][ T6694] page_owner tracks the page as allocated [ 1876.255468][ T6694] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 9655281338, free_ts 9629271192 [ 1876.271086][ T6694] get_page_from_freelist+0xa72/0x2f80 [ 1876.276532][ T6694] __alloc_pages+0x1b2/0x500 [ 1876.281110][ T6694] alloc_page_interleave+0x1e/0x200 [ 1876.286334][ T6694] alloc_pages+0x238/0x2a0 [ 1876.290734][ T6694] allocate_slab+0x32e/0x4b0 [ 1876.295332][ T6694] ___slab_alloc+0x4ba/0x820 [ 1876.299909][ T6694] __slab_alloc.constprop.0+0xa7/0xf0 [ 1876.305308][ T6694] kmem_cache_alloc_trace+0x30f/0x3c0 [ 1876.310663][ T6694] call_usermodehelper_setup+0x97/0x340 [ 1876.316200][ T6694] kobject_uevent_env+0xf73/0x1650 [ 1876.321325][ T6694] driver_register+0x2db/0x3a0 [ 1876.326090][ T6694] usb_register_driver+0x249/0x460 [ 1876.331245][ T6694] do_one_initcall+0x103/0x650 [ 1876.336009][ T6694] kernel_init_freeable+0x6b8/0x741 [ 1876.341192][ T6694] kernel_init+0x1a/0x1d0 [ 1876.345504][ T6694] ret_from_fork+0x1f/0x30 [ 1876.349920][ T6694] page last free stack trace: [ 1876.354582][ T6694] free_pcp_prepare+0x2c5/0x780 [ 1876.359424][ T6694] free_unref_page+0x19/0x690 [ 1876.364097][ T6694] __mmdrop+0xcb/0x3f0 [ 1876.368160][ T6694] __mmput+0x3b4/0x470 [ 1876.372218][ T6694] mmput+0x58/0x60 [ 1876.375923][ T6694] free_bprm+0x65/0x2e0 [ 1876.380063][ T6694] kernel_execve+0x380/0x460 [ 1876.384727][ T6694] call_usermodehelper_exec_async+0x2e3/0x580 [ 1876.390812][ T6694] ret_from_fork+0x1f/0x30 [ 1876.395235][ T6694] [ 1876.397552][ T6694] Memory state around the buggy address: [ 1876.403161][ T6694] ffff88801d52eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1876.411204][ T6694] ffff88801d52eb80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 1876.419246][ T6694] >ffff88801d52ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1876.427311][ T6694] ^ [ 1876.433458][ T6694] ffff88801d52ec80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 1876.441507][ T6694] ffff88801d52ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1876.449561][ T6694] ================================================================== [ 1876.457616][ T6694] Disabling lock debugging due to kernel taint 00:41:19 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000900)='wlan1\x00\x1b\x1a\xec\xd8n\xff\xc3\x87\xe2\xa3\x80\x8a\xb2\xd9\xa8L\x06\xb5\x12\x03F\xd9\x1f\x8a\xcc\xba\\\xceYF2C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\xea\x84]\xdf\xf7\xber\'\x8a\xd5W\xbb\xac%j\x9d\xeb\xba\xe6\xc4\xc4\xa9\xf5\xd5\xa1\xf5\\\x9b\xb2\a\xde\xbb\xc18\x84\xb5:f\xcb\xe8o\aArYZ\xe1\xc9\x86\xfe\x8f(\xa1\vhb\x18\xf3\xe3\xa1\xd2\x93*h\xd7\xa2F\x88\xd57\xb2\xc8\x8cS\xe8:H}\x91\x91\xcc\xa7Y\xcbkK\xf0\xfe\x9e\xd5\xa1\x1e\x99~\x9d3\xd2?\b\xbfU\xe8\x8b\x93\xea`\x00\x80\x00\x00V\xbf!\xb7\xe9\x11\r\xbd\xa3\xc6-t\x9c;\x9as\x86\xe7\xbd\xb0\xd5\";\xecuP\"\xebrV\x88\xca\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x98\xe8\xc6\xc3\nE\x91\xff\xd8E$\xc4As\x80\xdbt\x0e\xe21_v1\xd8,\xa4\x7fD\x94\xe8?\xf8\xcd[1\xb2U,\xc8w0|E\x00\x88IoQpH\xa0\xe8\xf0\x7f\xbd\xbcs;\xc9\xd2\x19oS\xac\xc6\x9b`:6\xc9DS\x13\xfb\xddw\nK\x19\xfa\x99\xc6~\x044\xa3+)\xef@Lr\xed\x85\xf3\xe8#\xa4\x84\xe9W8\xd6\x80\x95\xba.?+O\xbe[&\x87\xe1\xc5\xd7C\xa1\xde\xa4\b*w\xdc]\x92\xce\xe6BNFj;\xd7 \xfb\f\xeb\xb1\xb8\x86x\x19\xa0\xc4\xd3^W\xb7\x10\x18\xba\xcc\xabJ\xdfYB\"\x96\rny3\xe9\xec\xdf\xc4\xae\xfaM\xa2k\xd8X\xe6hQ\t\x93\xc1\xfd\xb7\xa4\x04W\xa0n\xff') r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000300)='wlan1\x00\x1b\x1a\xec\xb5\x12\x03F\xd9U\x1c\xc9%\x9b\xa0\xf5\xee\x16\x1f\xb9\xf2-\xda,C\xfdj\xe3\x8d\xe3\xd6\xe0|6l\xe9\xd9;\x13\xdf\xf7\xber\'\x8a\xd5\xd5\xe1\xf5\\\x9b\xb2\x06\xde\xbb\xc18\x84\xb5:f\xcb\xe8oOArYZ\xe1\xc9\x86\xfe\x88\x9d\xfa\xacJ\x1f\xebp\xf5\xfb\xaad\x1a\xa0\xb1\x9c\xac\xe8\xff^9P\xee\x8aG\xdd2') 00:41:19 executing program 4 (fault-call:2 fault-nth:1): clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401c5820, 0x400500) 00:41:19 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x5a000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:41:19 executing program 0: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x0, &(0x7f0000000000)="1750af002a865d7e7b0ca8c71ee81e503527bfffff86cf8dbaf397dd54de13ed69589128fcc92efb3cb1557302721b3a019082166da4aea954d78d4be043fffc157201d21ea079615ed6ebc641f115a56e632eda9ac41fa3b3f06040c5d161a88806ed79614e5930c91e20c5654c9e4540372c3304d91ad93fe13960110f693e35f7a9423c591cc1472b832c94a8882fefb6111440967a3a106751f92ec4b2b2548036fd19fc294a15a59ce791191e1dea79bedb88883f4c", &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000200)) r0 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086602, 0x40b301) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.log\x00', 0x10400, 0x60) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r4, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x1cb0c0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000001900)={0x28, 0x0, &(0x7f0000001880)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x2}, @enter_looper, @acquire={0x40046305, 0x1}, @acquire={0x40046305, 0x3}], 0x29, 0x0, &(0x7f00000018c0)="3431831ca925ed4e45373d0468aa3afa0b78fe79c8f4ddc44c1a6f15f5d146dbbb0b95049ab2987e14"}) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000380), 0x840, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000740)={0xf0, 0x0, &(0x7f0000000580)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x0, 0x3}, @fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}, 0x1000}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001780)={@fda={0x66646185, 0x7, 0x2, 0x12}, @ptr={0x70742a85, 0x0, &(0x7f0000000780)=""/4096, 0x1000, 0x1, 0x10}, @fda={0x66646185, 0x2, 0x0, 0x18}}, &(0x7f0000000400)={0x0, 0x20, 0x48}}, 0x1000}, @enter_looper, @request_death={0x400c630e, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001800)={@flat=@binder={0x73622a85, 0x110a}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/79, 0x4f, 0x1, 0x9}, @fda={0x66646185, 0x6, 0x2, 0x100000001}}, &(0x7f0000000540)={0x0, 0x18, 0x40}}}], 0xad, 0x0, &(0x7f0000000680)="0d5bb5e18918ec35aa0b50f30d9cb307711a293295fe44fa893146ae96f2f4eb0d2b194158f8f050fd52b7972c5a0837c09676d47564d8476315f7731041ff1129229428eab46f21fb99930ec79d8e019d98d99208ccb6262f35d9491421e8229ce4a60169a7483f25447f9234b6822b0b45789c2cf62cf8bedbc79a5e657a9245315cbd4cc173e1a27e8a7d24f61ec0f4568274ccb90c40b35a6ed2f2a33589c2f2e80c1b8f9722f3c2961512"}) 00:41:19 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x74, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) 00:41:19 executing program 3: socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32=r3, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="09000000000000f0ff000700000008000300", @ANYRES32, @ANYBLOB="0800051d0000000014000600c54ff763a54945635f746501000000000400cc000800050009000000140004"], 0x58}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) [ 1876.473634][ T9666] Bluetooth: hci3: command 0x0419 tx timeout 00:41:19 executing program 2: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r0, 0x8912, 0x400308) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x0, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x7a, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1876.528138][T12285] xt_cgroup: xt_cgroup: no path or classid specified [ 1876.542564][T12286] xt_cgroup: xt_cgroup: no path or classid specified [ 1876.550774][T12294] xt_cgroup: xt_cgroup: no path or classid specified [ 1876.561938][T12291] FAULT_INJECTION: forcing a failure. [ 1876.561938][T12291] name failslab, interval 1, probability 0, space 0, times 0 00:41:19 executing program 1: clone(0x3a3dd4008480af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x1320, 0x1148, 0x1170, 0x1170, 0x0, 0x1170, 0x1250, 0x1398, 0x1398, 0x1250, 0x1398, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], 'ip6tnl0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6}, 0x5c000000, 0x1100, 0x1148, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x10}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private0, 'netpci0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x108}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private0}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1380) [ 1876.582547][T12290] binder: 12283:12290 ioctl 40086602 40b301 returned -22 [ 1876.621832][T12300] device wlan1 entered promiscuous mode [ 1876.635422][T12291] CPU: 1 PID: 12291 Comm: syz-executor.4 Tainted: G B 5.14.0-rc4-syzkaller #0 [ 1876.637273][T12305] xt_cgroup: xt_cgroup: no path or classid specified [ 1876.645586][T12291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1876.645604][T12291] Call Trace: [ 1876.645612][T12291] dump_stack_lvl+0xcd/0x134 [ 1876.645647][T12291] should_fail.cold+0x5/0xa [ 1876.645675][T12291] ? tomoyo_encode2.part.0+0xe9/0x3a0 [ 1876.645700][T12291] should_failslab+0x5/0x10 [ 1876.645730][T12291] __kmalloc+0x72/0x330 [ 1876.645757][T12291] tomoyo_encode2.part.0+0xe9/0x3a0 [ 1876.656994][ T6694] Kernel panic - not syncing: panic_on_warn set ... [ 1876.662450][T12291] tomoyo_encode+0x28/0x50 [ 1876.704881][T12291] tomoyo_realpath_from_path+0x186/0x620 [ 1876.710520][T12291] tomoyo_path_number_perm+0x1d5/0x590 [ 1876.715977][T12291] ? tomoyo_path_number_perm+0x18d/0x590 [ 1876.721612][T12291] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 1876.727420][T12291] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 1876.733661][T12291] ? rcu_read_lock_sched_held+0xd/0x70 [ 1876.739120][T12291] ? lock_acquire+0x442/0x510 [ 1876.743881][T12291] ? rcu_read_lock_sched_held+0xd/0x70 [ 1876.749336][T12291] ? lock_release+0x522/0x720 [ 1876.754007][T12291] ? lock_downgrade+0x6e0/0x6e0 [ 1876.758849][T12291] ? lock_acquire+0x442/0x510 [ 1876.763522][T12291] ? rcu_read_lock_sched_held+0xd/0x70 [ 1876.768979][T12291] ? lock_release+0x522/0x720 [ 1876.773646][T12291] ? __context_tracking_exit+0xb8/0xe0 [ 1876.779106][T12291] ? __fget_files+0x23d/0x3e0 [ 1876.783784][T12291] security_file_ioctl+0x50/0xb0 [ 1876.788720][T12291] __x64_sys_ioctl+0xb3/0x200 [ 1876.793398][T12291] do_syscall_64+0x35/0xb0 [ 1876.797818][T12291] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1876.803706][T12291] RIP: 0033:0x4665e9 [ 1876.807602][T12291] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 1876.827200][T12291] RSP: 002b:00007faed682b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1876.835602][T12291] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9 [ 1876.843564][T12291] RDX: 0000000000400500 RSI: 00000000401c5820 RDI: 0000000000000003 [ 1876.851523][T12291] RBP: 00007faed682b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1876.859483][T12291] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1876.867443][T12291] R13: 0000000000a9fb1f R14: 00007faed682b300 R15: 0000000000022000 [ 1876.875423][ T6694] CPU: 0 PID: 6694 Comm: kworker/u4:7 Tainted: G B 5.14.0-rc4-syzkaller #0 [ 1876.885318][ T6694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1876.891844][T12291] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1876.895369][ T6694] Workqueue: netns cleanup_net [ 1876.895400][ T6694] Call Trace: [ 1876.895406][ T6694] dump_stack_lvl+0xcd/0x134 [ 1876.895434][ T6694] panic+0x306/0x73d [ 1876.895482][ T6694] ? __warn_printk+0xf3/0xf3 [ 1876.895504][ T6694] ? preempt_schedule_common+0x59/0xc0 [ 1876.895530][ T6694] ? dec_ucount+0x54/0x130 [ 1876.895553][ T6694] ? preempt_schedule_thunk+0x16/0x18 [ 1876.895574][ T6694] ? trace_hardirqs_on+0x38/0x1c0 [ 1876.895595][ T6694] ? trace_hardirqs_on+0x51/0x1c0 [ 1876.907954][T12291] binder: 12282:12291 ioctl 401c5820 400500 returned -22 [ 1876.910247][ T6694] ? dec_ucount+0x54/0x130 [ 1876.910274][ T6694] ? dec_ucount+0x54/0x130 [ 1876.910295][ T6694] end_report.cold+0x5a/0x5a [ 1876.968806][ T6694] kasan_report.cold+0x71/0xdf [ 1876.973558][ T6694] ? dec_ucount+0x54/0x130 [ 1876.977957][ T6694] kasan_check_range+0x13d/0x180 [ 1876.982884][ T6694] dec_ucount+0x54/0x130 [ 1876.987131][ T6694] cleanup_net+0x6f3/0xb10 [ 1876.991538][ T6694] ? ops_free_list.part.0+0x3d0/0x3d0 [ 1876.996902][ T6694] process_one_work+0x98d/0x1630 [ 1877.001827][ T6694] ? pwq_dec_nr_in_flight+0x320/0x320 [ 1877.007187][ T6694] ? rwlock_bug.part.0+0x90/0x90 [ 1877.012106][ T6694] ? _raw_spin_lock_irq+0x41/0x50 [ 1877.017218][ T6694] worker_thread+0x658/0x11f0 [ 1877.021916][ T6694] ? process_one_work+0x1630/0x1630 [ 1877.027118][ T6694] kthread+0x3e5/0x4d0 [ 1877.031174][ T6694] ? set_kthread_struct+0x130/0x130 [ 1877.036377][ T6694] ret_from_fork+0x1f/0x30 [ 1877.041955][ T6694] Kernel Offset: disabled [ 1877.046265][ T6694] Rebooting in 86400 seconds..