[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   29.125078] kauditd_printk_skb: 7 callbacks suppressed
[   29.125088] audit: type=1800 audit(1545640676.060:29): pid=5877 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0
[   29.158015] audit: type=1800 audit(1545640676.060:30): pid=5877 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0
[....] startpar: service(s) returned failure: ssh ...[?25l[?1c7[FAIL8[?25h[?0c failed!

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   33.920884] sshd (6039) used greatest stack depth: 15728 bytes left
Warning: Permanently added '10.128.10.17' (ECDSA) to the list of known hosts.
2018/12/24 08:38:07 fuzzer started
2018/12/24 08:38:09 dialing manager at 10.128.0.26:34681
2018/12/24 08:38:10 syscalls: 1
2018/12/24 08:38:10 code coverage: enabled
2018/12/24 08:38:10 comparison tracing: enabled
2018/12/24 08:38:10 setuid sandbox: enabled
2018/12/24 08:38:10 namespace sandbox: enabled
2018/12/24 08:38:10 Android sandbox: /sys/fs/selinux/policy does not exist
2018/12/24 08:38:10 fault injection: enabled
2018/12/24 08:38:10 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2018/12/24 08:38:10 net packet injection: enabled
2018/12/24 08:38:10 net device setup: enabled
08:40:23 executing program 0:
mmap(&(0x7f00006ea000/0x200000)=nil, 0x200000, 0x3000007, 0x8d471, 0xffffffffffffffff, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)

[  177.151255] IPVS: ftp: loaded support on port[0] = 21
08:40:24 executing program 1:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
poll(&(0x7f0000000040)=[{r0}], 0x1, 0x0)

[  177.424849] IPVS: ftp: loaded support on port[0] = 21
08:40:24 executing program 2:
r0 = open(&(0x7f0000000000)='./file0\x00', 0x281, 0x0)
mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0)

[  177.749220] IPVS: ftp: loaded support on port[0] = 21
08:40:24 executing program 3:
msgget(0x3, 0x11)

[  178.089004] IPVS: ftp: loaded support on port[0] = 21
08:40:25 executing program 4:
utimes(0x0, &(0x7f0000000080)={{}, {0x100000000000000}})
r0 = socket$inet6(0x18, 0x1, 0x0)
close(r0)
socket$inet6(0x18, 0x3, 0x0)
r1 = socket$unix(0x1, 0x1000000000002, 0x0)
setsockopt$sock_int(r1, 0xffff, 0x1023, &(0x7f00000000c0), 0x396)
r2 = semget$private(0x0, 0x6, 0x100)
semctl$SETALL(r2, 0x0, 0x9, &(0x7f0000000140)=[0x6, 0x8, 0x6, 0x5, 0x1, 0x3, 0x5])
semop(r2, &(0x7f0000000100)=[{0x3, 0x8, 0x800}, {0x3, 0x0, 0x800}, {0x0, 0x7fffffff, 0x1800}], 0x3)

[  178.508927] IPVS: ftp: loaded support on port[0] = 21
08:40:25 executing program 5:
unlink(&(0x7f0000000080)='./file0\x00')
semctl$IPC_STAT(0x0, 0x0, 0x2, &(0x7f0000000000)=""/53)
r0 = semget$private(0x0, 0x1, 0x2)
semctl$GETPID(r0, 0x3, 0x4, &(0x7f00000000c0)=""/29)
semop(0x0, &(0x7f0000000040)=[{0x3, 0x1, 0x1800}], 0x1)
r1 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
bind$inet6(r1, &(0x7f0000000100)={0x18, 0x1, 0xff}, 0xc)

[  178.828914] IPVS: ftp: loaded support on port[0] = 21
[  179.080480] bridge0: port 1(bridge_slave_0) entered blocking state
[  179.087019] bridge0: port 1(bridge_slave_0) entered disabled state
[  179.100847] device bridge_slave_0 entered promiscuous mode
[  179.289014] bridge0: port 2(bridge_slave_1) entered blocking state
[  179.303117] bridge0: port 2(bridge_slave_1) entered disabled state
[  179.319067] device bridge_slave_1 entered promiscuous mode
[  179.500834] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  179.681011] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  179.817230] bridge0: port 1(bridge_slave_0) entered blocking state
[  179.828401] bridge0: port 1(bridge_slave_0) entered disabled state
[  179.839804] device bridge_slave_0 entered promiscuous mode
[  179.987486] bridge0: port 2(bridge_slave_1) entered blocking state
[  180.003535] bridge0: port 2(bridge_slave_1) entered disabled state
[  180.011517] device bridge_slave_1 entered promiscuous mode
[  180.053807] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  180.164167] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  180.182672] bridge0: port 1(bridge_slave_0) entered blocking state
[  180.191622] bridge0: port 1(bridge_slave_0) entered disabled state
[  180.200002] device bridge_slave_0 entered promiscuous mode
[  180.208864] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  180.342486] bridge0: port 2(bridge_slave_1) entered blocking state
[  180.348989] bridge0: port 2(bridge_slave_1) entered disabled state
[  180.368558] device bridge_slave_1 entered promiscuous mode
[  180.406805] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  180.477170] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  180.487173] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  180.519620] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  180.559061] bridge0: port 1(bridge_slave_0) entered blocking state
[  180.570470] bridge0: port 1(bridge_slave_0) entered disabled state
[  180.581790] device bridge_slave_0 entered promiscuous mode
[  180.633478] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  180.701625] bridge0: port 2(bridge_slave_1) entered blocking state
[  180.708894] bridge0: port 2(bridge_slave_1) entered disabled state
[  180.721860] device bridge_slave_1 entered promiscuous mode
[  180.782201] bridge0: port 1(bridge_slave_0) entered blocking state
[  180.804724] bridge0: port 1(bridge_slave_0) entered disabled state
[  180.815880] device bridge_slave_0 entered promiscuous mode
[  180.826918] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  180.870776] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  180.928416] bridge0: port 2(bridge_slave_1) entered blocking state
[  180.959608] bridge0: port 2(bridge_slave_1) entered disabled state
[  180.967059] device bridge_slave_1 entered promiscuous mode
[  180.984503] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  180.998911] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  181.014339] team0: Port device team_slave_0 added
[  181.052874] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  181.073108] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  181.094351] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  181.137292] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  181.152721] team0: Port device team_slave_1 added
[  181.206756] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  181.223681] bridge0: port 1(bridge_slave_0) entered blocking state
[  181.245035] bridge0: port 1(bridge_slave_0) entered disabled state
[  181.253220] device bridge_slave_0 entered promiscuous mode
[  181.272180] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  181.334817] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  181.392916] bridge0: port 2(bridge_slave_1) entered blocking state
[  181.408288] bridge0: port 2(bridge_slave_1) entered disabled state
[  181.416379] device bridge_slave_1 entered promiscuous mode
[  181.429414] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  181.438965] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  181.453714] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  181.482168] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  181.496901] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  181.529857] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  181.559276] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  181.569315] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  181.601063] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  181.609001] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  181.620531] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  181.650321] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  181.667868] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  181.702918] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  181.724979] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  181.736269] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  181.752811] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  181.763010] team0: Port device team_slave_0 added
[  181.770214] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  181.786289] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  181.800144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  181.829994] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  181.863319] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  181.888893] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  181.904991] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  181.913387] team0: Port device team_slave_1 added
[  181.931949] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  181.999627] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  182.026152] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  182.085300] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  182.107344] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  182.130119] team0: Port device team_slave_0 added
[  182.188646] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  182.233313] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  182.285318] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  182.300829] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  182.308250] team0: Port device team_slave_1 added
[  182.329426] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  182.336911] team0: Port device team_slave_0 added
[  182.352288] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  182.370309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  182.403186] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  182.414578] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  182.440202] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  182.449963] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  182.461101] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  182.477015] team0: Port device team_slave_1 added
[  182.486487] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  182.523933] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  182.539810] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  182.547837] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  182.576388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  182.590228] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  182.597808] team0: Port device team_slave_0 added
[  182.605999] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  182.621490] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  182.630130] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  182.670966] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  182.679626] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  182.706023] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  182.720193] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  182.749769] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  182.780451] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  182.787731] team0: Port device team_slave_1 added
[  182.808791] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  182.817236] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  182.850000] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  182.871243] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  182.880575] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  182.888579] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  182.934796] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  182.955013] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  182.983709] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  183.010243] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  183.017961] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  183.045532] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  183.059246] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  183.078727] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  183.092108] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  183.120587] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  183.128581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  183.157811] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  183.176830] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  183.201307] team0: Port device team_slave_0 added
[  183.211639] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  183.219699] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  183.250072] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  183.286239] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  183.309999] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  183.317912] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  183.338978] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  183.350426] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  183.361730] team0: Port device team_slave_1 added
[  183.379317] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  183.387372] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  183.515842] bridge0: port 2(bridge_slave_1) entered blocking state
[  183.522460] bridge0: port 2(bridge_slave_1) entered forwarding state
[  183.529692] bridge0: port 1(bridge_slave_0) entered blocking state
[  183.536092] bridge0: port 1(bridge_slave_0) entered forwarding state
[  183.552806] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  183.563392] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  183.582828] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  183.602523] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  183.709069] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  183.716211] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  183.736143] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  183.839558] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  183.846785] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  183.880507] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  183.983326] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  183.991145] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  184.010242] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  184.126811] bridge0: port 2(bridge_slave_1) entered blocking state
[  184.133284] bridge0: port 2(bridge_slave_1) entered forwarding state
[  184.140055] bridge0: port 1(bridge_slave_0) entered blocking state
[  184.146453] bridge0: port 1(bridge_slave_0) entered forwarding state
[  184.160034] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  184.472383] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  184.490531] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  184.759373] bridge0: port 2(bridge_slave_1) entered blocking state
[  184.765805] bridge0: port 2(bridge_slave_1) entered forwarding state
[  184.772608] bridge0: port 1(bridge_slave_0) entered blocking state
[  184.779036] bridge0: port 1(bridge_slave_0) entered forwarding state
[  184.802429] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  184.811527] bridge0: port 2(bridge_slave_1) entered blocking state
[  184.817919] bridge0: port 2(bridge_slave_1) entered forwarding state
[  184.824728] bridge0: port 1(bridge_slave_0) entered blocking state
[  184.831165] bridge0: port 1(bridge_slave_0) entered forwarding state
[  184.842677] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  184.955675] bridge0: port 2(bridge_slave_1) entered blocking state
[  184.962157] bridge0: port 2(bridge_slave_1) entered forwarding state
[  184.968846] bridge0: port 1(bridge_slave_0) entered blocking state
[  184.975295] bridge0: port 1(bridge_slave_0) entered forwarding state
[  184.990706] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  185.322950] bridge0: port 2(bridge_slave_1) entered blocking state
[  185.329413] bridge0: port 2(bridge_slave_1) entered forwarding state
[  185.336112] bridge0: port 1(bridge_slave_0) entered blocking state
[  185.342582] bridge0: port 1(bridge_slave_0) entered forwarding state
[  185.375018] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  185.510553] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  185.520102] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  185.547880] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  185.563157] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  189.025973] 8021q: adding VLAN 0 to HW filter on device bond0
[  189.482094] 8021q: adding VLAN 0 to HW filter on device bond0
[  189.539982] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  189.948268] 8021q: adding VLAN 0 to HW filter on device bond0
[  189.959101] 8021q: adding VLAN 0 to HW filter on device bond0
[  189.977132] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  190.072810] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  190.094541] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  190.102203] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  190.153558] 8021q: adding VLAN 0 to HW filter on device bond0
[  190.285775] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  190.447017] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  190.465909] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  190.490576] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  190.497734] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  190.617402] 8021q: adding VLAN 0 to HW filter on device team0
[  190.641303] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  190.670576] 8021q: adding VLAN 0 to HW filter on device bond0
[  190.806045] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  190.812549] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  190.831217] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  190.870488] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  190.876732] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  190.885688] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  190.915653] 8021q: adding VLAN 0 to HW filter on device team0
[  191.122756] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  191.234591] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  191.241985] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  191.251579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  191.291460] 8021q: adding VLAN 0 to HW filter on device team0
[  191.452658] 8021q: adding VLAN 0 to HW filter on device team0
[  191.647346] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  191.662144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  191.673713] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  191.725635] 8021q: adding VLAN 0 to HW filter on device team0
[  192.074201] 8021q: adding VLAN 0 to HW filter on device team0
08:40:40 executing program 0:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
socket$inet6(0xa, 0x0, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff"], 0x1)

08:40:40 executing program 1:
socket$inet6(0xa, 0x2, 0x0)
setxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.ima\x00', &(0x7f00000004c0)=ANY=[@ANYBLOB="0208c6137d71bd243b4016e733dc3a468d514319d5199e95ad61c89cc5c5f8e1fd4026681508006933b0d592b50000000000000000"], 0x1, 0x0)
r0 = socket$inet6(0xa, 0x400000000001, 0x0)
sendto$inet6(0xffffffffffffffff, &(0x7f0000e77fff), 0x0, 0x0, 0x0, 0x0)
close(r0)
io_setup(0x0, &(0x7f0000000100))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x5002})
openat$uhid(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/uhid\x00', 0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000100)={&(0x7f00000000c0), 0xc, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
ftruncate(r3, 0x2007fff)
ioctl$LOOP_SET_STATUS(r3, 0x4c02, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x3f, 0x1f, 0x6, 0x0, "6cff51263c9afa8803956fa178b0f0dc39c07c0d7d0baf91d0f4d1ee58aa9f1c85fceec8e95e16fb6d7434c631491b6c03268977cfacca43a25c2816fc8ceaec", "dfe3148da099a1435cd26ed50c091924a94e16d998df02f5541db56d91884a84"})
pipe(&(0x7f0000000380)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
write(r5, &(0x7f00000001c0), 0xfffffef3)
read(r4, &(0x7f0000000200)=""/250, 0x50c7e3e3)
sendfile(r0, r3, &(0x7f0000d83ff8), 0x8000fffffffe)
r6 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$IP_VS_SO_GET_SERVICES(r6, 0x0, 0x482, &(0x7f0000000000)=""/48, &(0x7f0000000040)=0x30)
setsockopt$sock_void(r6, 0x29, 0x3f, 0x0, 0x300)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$KDSKBMETA(r4, 0x4b63, &(0x7f0000000140)=0x401)

[  194.097710] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  194.105707] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
08:40:41 executing program 0:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
sendmsg(r1, &(0x7f0000000080)={&(0x7f00000000c0)=@in={0x2, 0x4e22}, 0x80, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="200000000000000000000000070000000000000000007417e7b8c841a10eb27b"], 0x20}, 0x0)

08:40:41 executing program 3:
futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0)
perf_event_open(&(0x7f0000000580)={0x2, 0x70, 0x859, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0)
r0 = timerfd_create(0x9, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f0000000040)=""/123, 0x7b}], 0x1)
readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/170, 0xaa}], 0x1)
timerfd_settime(r0, 0x0, &(0x7f0000000140)={{0x4000000000000000}, {0x0, 0x989680}}, 0x0)

[  194.308587] IPVS: length: 48 != 46600
08:40:41 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001500050000000000000000000100000004000200fe800000000000000000000000000000"], 0x1}}, 0x0)

08:40:41 executing program 0:
syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @random="a29ab0893fde", [], {@ipv6={0x86dd, {0x0, 0x6, '?:T', 0x14, 0x2f, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x608]}, @mcast2, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0)

08:40:41 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:41 executing program 0:
r0 = socket$inet6(0xa, 0x803, 0x3)
ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070")
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x7a05, 0x1700)
ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000040))
pwrite64(r1, &(0x7f0000000200)="4ebefa1e923f1e018b6e53bf4815b78e1f2ef9212b93090c1ff6b35c208d50aef3fd759f995b53dd37c58cf8332b8a6b66575478e02ef0145bf122ba2e2c53a7ec45e375683475a6495f8d7b7a088f5e32dc266569074319bf8c8d3d8007cc92e2ba0d9082c41b63e330f353a3f675a98d2e74a08e38400f7f5eb113a0e25fd90115d57a7acdcab1128cf4f9c719f3f29d460c507f8a2a6594d259217d32eae9be93c6ed17a67ae2e7e689a31fa8449da12fd62bf423cff702b09e6ee1ff0e698b8bb517819eb712ba2b34b54b28b79d9399d920d5a5507e8a85f37060dfe3051f06f8d7cc9b068495ee5d5fcce85410bcd9f91d1f198353ce94b2e03370e43875c1a035bb88fd26fbb5b1252e2056d6b67e2b2f424051a40ad9170e76a81a6ca4f149ff643db76f8f2c1aa8024a6279952027489bbad6479e47ea5ba9e47d8136df398665f6cdfd15e93cfbf2ce1151afe9321ed63fe7100e704b232646fc1e0e936b90cceaaa70225ce71640e10316d2cc637355eddb3c4e16ff1635fa4e65a66eb5ab2cbf9d6f063e05f0e46fcc14bf31eedfb9f33c215fc14946cc6f7493924442e939f71ac4bd3e35e78857f9624c663f3669a47a7146e3249ee3eaaf681f371d515af5b934f9252c7ac2a164bf318fc2b194ee087b2b28ed5e4618c0906fc3f32c43a3b9e08a2e0d509f65a7de909e8c3c535f1d8cb9c236716e5ad709", 0x200, 0x1e00)

08:40:41 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:41 executing program 0:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000005140)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000003500)=[{0xc, 0x1}], 0xc}}], 0x1, 0x0)

08:40:41 executing program 4:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{}, {0x20000000304, @dev}, 0x0, {0x2, 0x0, @local}, '\x00\x00\x00\x00\x01\x00\x00\x01\x00'})

[  194.896255] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  195.013024] IPVS: length: 48 != 46600
08:40:42 executing program 5:
perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x85a, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
unlink(&(0x7f0000000080)='./bus\x00')
creat(&(0x7f0000000040)='./bus\x00', 0x0)

08:40:42 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:42 executing program 1:
r0 = socket$inet6(0xa, 0x2, 0x0)
sendto$inet6(r0, 0x0, 0x0, 0x3c99830876959646, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @mcast1}, 0x1c)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
dup2(r1, r0)

08:40:42 executing program 0:
move_pages(0x0, 0x4000000000000501, &(0x7f00000001c0), 0x0, &(0x7f00000035c0), 0x0)

08:40:42 executing program 3:
futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0)
perf_event_open(&(0x7f0000000580)={0x2, 0x70, 0x859, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000), 0x0)
r0 = timerfd_create(0x9, 0x0)
readv(r0, &(0x7f0000001400)=[{&(0x7f0000000040)=""/123, 0x7b}], 0x1)
readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/170, 0xaa}], 0x1)
timerfd_settime(r0, 0x0, &(0x7f0000000140)={{0x4000000000000000}, {0x0, 0x989680}}, 0x0)

08:40:42 executing program 4:
syz_open_dev$ndb(0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'ip_vti0\x00\x1e\x00', 0x800201e})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'ip_vti0\x00', <r2=>0x0})
ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f00000000c0)={@dev, 0x0, r2})
sendto(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

08:40:42 executing program 5:
r0 = gettid()
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setpgid(r0, 0x0)

08:40:42 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:42 executing program 1:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000b00)='/dev/uinput\x00', 0x805, 0x0)
ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)={0x1, {0x0, 0x0, 0x28}})
write$uinput_user_dev(r0, &(0x7f0000001100)={'syz0\x00'}, 0x45c)
ioctl$UI_DEV_CREATE(r0, 0x5501)

[  195.395761] input: syz0 as /devices/virtual/input/input5
08:40:42 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00'})
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:42 executing program 4:
r0 = socket$inet6(0xa, 0x803, 0x3)
ioctl(r0, 0x800001000008912, &(0x7f0000000080)="0a5c2d023c126285718070")
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000140)={0x84, @multicast1, 0x0, 0x1102, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c)
setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0)

[  195.478558] input: syz0 as /devices/virtual/input/input6
08:40:42 executing program 5:
r0 = socket$inet(0x10, 0x3, 0x6)
sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)="4c0000001200ff09fffefd856fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0)

08:40:42 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00'})
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:42 executing program 4:
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x223}, @dev}, @icmp=@parameter_prob={0xb, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x223}, @dev}}}}}}, 0x0)

[  195.579344] netlink: 60 bytes leftover after parsing attributes in process `syz-executor5'.
08:40:42 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='ns\x00')
getdents(r0, &(0x7f0000000000)=""/138, 0x8a)

08:40:44 executing program 4:
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x223}, @dev}, @icmp=@parameter_prob={0xb, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x223}, @dev}}}}}}, 0x0)

08:40:44 executing program 0:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0)
r2 = dup2(r0, r1)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0)
write$P9_RMKDIR(r2, 0x0, 0x0)

08:40:44 executing program 5:
socketpair$unix(0x1, 0x80001, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r')
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f00000004c0)='lo\x00\x96o8\x14d\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\'m\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1')

08:40:44 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00'})
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:44 executing program 1:
r0 = socket$kcm(0xa, 0x2, 0x11)
setsockopt$sock_attach_bpf(r0, 0x29, 0x1b, &(0x7f0000000040)=r0, 0x52d)
close(r0)

08:40:44 executing program 3:
r0 = socket$inet6(0xa, 0x803, 0x7)
ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070")
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000400)={0x0, {}, {0x2, 0x0, @multicast2}, {0x2, 0x0, @dev}, 0x2a4, 0x0, 0x0, 0x0, 0x4})
getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000180)=""/217, &(0x7f0000000080)=0xd9)

08:40:44 executing program 4:
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x223}, @dev}, @icmp=@parameter_prob={0xb, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x223}, @dev}}}}}}, 0x0)

08:40:44 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0)
ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0)
ioctl$KDGKBDIACR(0xffffffffffffffff, 0x4b4a, 0x0)
creat(0x0, 0x0)
ioctl$RNDADDENTROPY(r0, 0x40085203, 0x0)

[  197.364350] IPVS: length: 217 != 24
[  197.369763] device lo entered promiscuous mode
[  197.383231] IPVS: length: 217 != 24
08:40:44 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket(0x200000000000011, 0x3, 0x8)
bind$packet(r0, &(0x7f0000000080), 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:44 executing program 0:
r0 = socket$inet6(0xa, 0x80003, 0x88)
connect$unix(r0, &(0x7f0000000d00)=@file={0x0, './file0\x00'}, 0x6e)

08:40:44 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002c00)=""/125, 0x7d}}], 0x1, 0x0, &(0x7f0000000080))
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='syscall\x00')
preadv(r0, &(0x7f00000017c0), 0x3ba, 0x0)

08:40:44 executing program 0:
r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000000c0)={0xffffffffffffffff})

08:40:44 executing program 4:
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x223}, @dev}, @icmp=@parameter_prob={0xb, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x223}, @dev}}}}}}, 0x0)

08:40:44 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket(0x200000000000011, 0x3, 0x8)
bind$packet(r0, &(0x7f0000000080), 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:44 executing program 5:
alarm(0x0)
setxattr$security_evm(0x0, 0x0, 0x0, 0x0, 0x0)
r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0)
getpeername$inet6(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0)
write$P9_RFLUSH(r0, 0x0, 0x0)
ioctl$PIO_CMAP(0xffffffffffffffff, 0x4b71, 0x0)
ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0)
getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, 0x0, &(0x7f0000000c80))

08:40:44 executing program 4:
syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x223}, @dev}, @icmp=@parameter_prob={0xb, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x223}, @dev}}}}}}, 0x0)

08:40:44 executing program 1:
timer_create(0x7, 0x0, 0x0)
timer_settime(0x0, 0x0, 0x0, 0x0)
r0 = gettid()
ioctl$TIOCLINUX3(0xffffffffffffffff, 0x541c, 0x0)
pipe(0x0)
setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, 0x0, 0x0)
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000))
getgid()
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, 0x0)
pipe2(0x0, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
prctl$PR_MCE_KILL_GET(0x22)
lstat(0x0, 0x0)
getuid()
capget(&(0x7f0000000000), 0x0)
tkill(r0, 0x1000000000016)

08:40:44 executing program 0:
r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f00000000c0)={0xffffffffffffffff})

08:40:44 executing program 5:
socket$inet6(0xa, 0x803, 0x3)
ioctl(0xffffffffffffffff, 0x0, 0x0)
r0 = socket(0xa, 0x4000000000000001, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'bridge0\x00\x00\x01\x00'})

08:40:44 executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)

08:40:44 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket(0x200000000000011, 0x3, 0x8)
bind$packet(r0, &(0x7f0000000080), 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:44 executing program 3:
socketpair$unix(0x1, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = memfd_create(&(0x7f0000000080)='\x00', 0x0)
ftruncate(r1, 0x1000000)
ioctl$BLKBSZSET(0xffffffffffffffff, 0x40081271, 0x0)
sendfile(r0, r1, &(0x7f00000037c0)=0xf10001, 0xfffffdef)
prctl$PR_SET_MM(0x23, 0x0, &(0x7f0000ffd000/0x3000)=nil)
memfd_create(&(0x7f0000000740)='(cgroupself\x00', 0x4)
ioctl$LOOP_CLR_FD(r1, 0x4c01)
setgroups(0x0, 0x0)

08:40:44 executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)

08:40:44 executing program 0:
clone(0x100041fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = getpid()
rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f00000000c0))
tkill(r0, 0x29)

[  197.876405] bridge0: port 2(bridge_slave_1) entered disabled state
[  197.883517] bridge0: port 1(bridge_slave_0) entered disabled state
[  197.905705] hrtimer: interrupt took 30850 ns
08:40:44 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r0=>0x0})
bind$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, r0}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:44 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002c00)=""/125, 0x7d}}], 0x1, 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='syscall\x00')
preadv(r0, &(0x7f00000017c0), 0x3ba, 0x0)

08:40:44 executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)

08:40:45 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r0=>0x0})
bind$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, r0}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:47 executing program 1:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
sched_setattr(0x0, 0x0, 0x0)
write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:47 executing program 4:
syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x223}, @dev}, @icmp=@parameter_prob={0xb, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x223}, @dev}}}}}}, 0x0)

08:40:47 executing program 2:
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r0=>0x0})
bind$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, r0}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:47 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002c00)=""/125, 0x7d}}], 0x1, 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='syscall\x00')
preadv(r0, &(0x7f00000017c0), 0x3ba, 0x0)

08:40:47 executing program 3:
openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0)
setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:47 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002c00)=""/125, 0x7d}}], 0x1, 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='syscall\x00')
preadv(r0, &(0x7f00000017c0), 0x3ba, 0x0)

08:40:47 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:47 executing program 4:
syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x223}, @dev}, @icmp=@parameter_prob={0xb, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x223}, @dev}}}}}}, 0x0)

08:40:47 executing program 3:
r0 = syz_open_dev$sndctrl(&(0x7f0000000380)='/dev/snd/controlC#\x00', 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f00000001c0))
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x40000000040201, 0x0)
r2 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x405)
write$P9_RREADLINK(r1, &(0x7f0000002740)=ANY=[@ANYBLOB="a6"], 0x1)
write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20)

08:40:47 executing program 0:
r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0)
ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0xd78)

08:40:47 executing program 2:
r0 = socket(0x0, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:47 executing program 4:
syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x223}, @dev}, @icmp=@parameter_prob={0xb, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x223}, @dev}}}}}}, 0x0)

08:40:48 executing program 1:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
sched_setattr(0x0, 0x0, 0x0)
write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:48 executing program 0:
clone(0x0, &(0x7f0000000000), 0x0, 0x0, 0x0)
io_setup(0x3, &(0x7f0000000000))
wait4(0x0, &(0x7f0000000380), 0x40000002, 0x0)

08:40:48 executing program 2:
r0 = socket(0x0, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:48 executing program 5:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
wait4(0x0, 0x0, 0x80000000, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
tkill(r1, 0x1b)
ptrace$cont(0x18, r1, 0x0, 0x0)
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x4, 0x0, 0x0, 0x8, 0xfa})
ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080))
ptrace$cont(0x1f, r1, 0x0, 0x0)

08:40:48 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
write$cgroup_type(r1, &(0x7f0000000180)='threaded\x00', 0xfe9e)
fcntl$setstatus(r1, 0x4, 0x4000)
io_setup(0x1f, &(0x7f00000001c0)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}])

08:40:48 executing program 2:
r0 = socket(0x0, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:48 executing program 1:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
sched_setattr(0x0, 0x0, 0x0)
write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:48 executing program 0:
r0 = memfd_create(0x0, 0x0)
ioctl$UI_SET_FFBIT(r0, 0x4004556b, 0x17)
r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4000001, 0x182)
r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0)
ioctl$FS_IOC_GETFSMAP(r2, 0xc0c0583b, 0x0)
utime(0x0, 0x0)
pipe(&(0x7f0000000100)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
write(r4, &(0x7f00000001c0), 0xfffffef3)
read(r3, &(0x7f0000000200)=""/250, 0x50c7e3e3)
getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x2000000000000010, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
ioctl$KIOCSOUND(r2, 0x4b2f, 0x8)
pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805)
ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2)
ioctl$LOOP_SET_CAPACITY(r1, 0x4c07)
fstat(r4, &(0x7f0000000440))
fstat(0xffffffffffffffff, 0x0)
sendfile(r1, r1, 0x0, 0x2000005)
r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00')
sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x404000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, r5, 0x8, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000001}]}, @TIPC_NLA_MEDIA={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x4000000)
ioctl$IOC_PR_RELEASE(r4, 0x401070ca, &(0x7f0000000300)={0x7, 0x2ac, 0x1})
ioctl$LOOP_CLR_FD(r1, 0x4c01)
ioctl$LOOP_SET_FD(r1, 0x4c00, r2)

[  201.703521] print_req_error: I/O error, dev loop5, sector 0 flags 801
[  201.710475] Buffer I/O error on dev loop5, logical block 0, lost async page write
[  201.718159] print_req_error: I/O error, dev loop5, sector 4 flags 801
[  201.724841] Buffer I/O error on dev loop5, logical block 1, lost async page write
[  201.732642] print_req_error: I/O error, dev loop5, sector 8 flags 801
[  201.739292] Buffer I/O error on dev loop5, logical block 2, lost async page write
[  201.747029] print_req_error: I/O error, dev loop5, sector 12 flags 801
[  201.753865] Buffer I/O error on dev loop5, logical block 3, lost async page write
[  201.761586] print_req_error: I/O error, dev loop5, sector 16 flags 801
[  201.768253] Buffer I/O error on dev loop5, logical block 4, lost async page write
[  201.776007] print_req_error: I/O error, dev loop5, sector 20 flags 801
[  201.782740] Buffer I/O error on dev loop5, logical block 5, lost async page write
[  201.790511] print_req_error: I/O error, dev loop5, sector 24 flags 801
[  201.797191] Buffer I/O error on dev loop5, logical block 6, lost async page write
[  201.804927] print_req_error: I/O error, dev loop5, sector 28 flags 801
[  201.812247] Buffer I/O error on dev loop5, logical block 7, lost async page write
[  201.813362] print_req_error: I/O error, dev loop5, sector 32 flags 801
[  201.820014] print_req_error: I/O error, dev loop5, sector 36 flags 801
[  201.820043] Buffer I/O error on dev loop5, logical block 9, lost async page write
[  201.826879] Buffer I/O error on dev loop5, logical block 8, lost async page write
08:40:49 executing program 3:

08:40:49 executing program 2:
r0 = socket(0x200000000000011, 0x0, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:49 executing program 4:

08:40:49 executing program 5:

08:40:49 executing program 1:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
sched_setattr(0x0, 0x0, 0x0)
write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:49 executing program 0:

08:40:49 executing program 4:

08:40:49 executing program 2:
r0 = socket(0x200000000000011, 0x0, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:49 executing program 0:

08:40:49 executing program 3:

08:40:49 executing program 5:

08:40:49 executing program 4:

08:40:49 executing program 0:

08:40:49 executing program 3:

08:40:49 executing program 5:

08:40:49 executing program 2:
r0 = socket(0x200000000000011, 0x0, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:49 executing program 1:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
sched_setattr(0x0, 0x0, 0x0)
write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:49 executing program 3:

08:40:49 executing program 0:

08:40:49 executing program 1:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
sched_setattr(0x0, 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:49 executing program 5:

08:40:49 executing program 4:

08:40:49 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:49 executing program 0:

08:40:49 executing program 3:

08:40:49 executing program 5:

08:40:49 executing program 4:

08:40:49 executing program 3:

08:40:49 executing program 0:

08:40:49 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:49 executing program 4:

08:40:49 executing program 1:
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:49 executing program 5:

08:40:49 executing program 3:

08:40:49 executing program 0:

08:40:49 executing program 5:

08:40:49 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:49 executing program 4:

08:40:49 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:49 executing program 0:

08:40:50 executing program 5:

08:40:50 executing program 3:

08:40:50 executing program 4:

08:40:50 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:50 executing program 5:

08:40:50 executing program 0:

08:40:50 executing program 3:

08:40:50 executing program 1:
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:50 executing program 5:

08:40:50 executing program 4:

08:40:50 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:50 executing program 0:

08:40:50 executing program 3:

08:40:50 executing program 5:

08:40:50 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x800)

08:40:50 executing program 0:

08:40:50 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:50 executing program 4:

08:40:50 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:50 executing program 3:

08:40:50 executing program 5:

08:40:50 executing program 0:

08:40:50 executing program 4:

08:40:50 executing program 3:

08:40:50 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0)
bind$packet(r0, &(0x7f0000000080), 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:50 executing program 5:

08:40:50 executing program 0:

08:40:50 executing program 4:

08:40:50 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:50 executing program 3:

08:40:50 executing program 4:

08:40:50 executing program 5:

08:40:50 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0)
bind$packet(r0, &(0x7f0000000080), 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:50 executing program 3:

08:40:50 executing program 0:

08:40:51 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:51 executing program 3:

08:40:51 executing program 5:

08:40:51 executing program 4:

08:40:51 executing program 0:

08:40:51 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0)
bind$packet(r0, &(0x7f0000000080), 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:51 executing program 3:

08:40:51 executing program 5:

08:40:51 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:51 executing program 4:

08:40:51 executing program 3:

08:40:51 executing program 0:

08:40:51 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:51 executing program 4:

08:40:51 executing program 5:

08:40:51 executing program 0:

08:40:51 executing program 3:

08:40:51 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:51 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:51 executing program 4:

08:40:51 executing program 0:

08:40:51 executing program 3:

08:40:51 executing program 5:

08:40:51 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:51 executing program 4:

08:40:51 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:51 executing program 5:

08:40:51 executing program 3:

08:40:51 executing program 0:

08:40:51 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:51 executing program 4:

08:40:51 executing program 3:

08:40:51 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00'})
bind$packet(r0, 0x0, 0x0)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:51 executing program 5:

08:40:51 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:51 executing program 0:

08:40:51 executing program 4:

08:40:52 executing program 3:

08:40:52 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00'})
bind$packet(r0, 0x0, 0x0)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:52 executing program 5:

08:40:52 executing program 0:

08:40:52 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:52 executing program 4:

08:40:52 executing program 3:

08:40:52 executing program 5:

08:40:52 executing program 0:

08:40:52 executing program 4:

08:40:52 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00'})
bind$packet(r0, 0x0, 0x0)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:52 executing program 3:

08:40:52 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:52 executing program 0:
r0 = socket$inet(0x2, 0x1, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20}, 0x10)

08:40:52 executing program 5:
r0 = gettid()
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000))
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0)
read(r1, &(0x7f0000000040)=""/11, 0xfd32)
ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000))
r2 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000140))
timer_settime(0x0, 0x0, &(0x7f00000002c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r1)
ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, &(0x7f0000000100)=0x920e)
tkill(r0, 0x13)

08:40:52 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00'})
bind$packet(r0, &(0x7f0000000080), 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:52 executing program 3:
clone(0x200, 0x0, 0x0, 0x0, 0x0)
mknod(&(0x7f0000000180)='./file0\x00', 0x103f, 0x0)
execve(&(0x7f0000000240)='./file0\x00', 0x0, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0)

08:40:52 executing program 4:
r0 = syz_open_procfs(0x0, &(0x7f0000000180)='oom_adj\x00\xc0\xaf\x1d\x99E\xa9\xcd\xc9\xb7\xa8\xc4\x93\x92m\xa3\xa3G\xd1\xfckd5\xec_\xcb\xf6\b\x00D\xda\x03\xc8\xdb\xe7\x85\xd5;\xff\xf04S+\xe7\xaa\n\xd4\xad\xb4!u\xaf\xc6\xea\xdc\xb3\xf0g-\xa0M\xb3}@53DcF\x17\xb7\xea\xcf\xf3\x9e>\xfb%\xfel\xe4\xee\x87IE\xe4\x87\xcb\x98pr~\xd0F{\x94*)\xe4H\xbf\x04\x80\xc2\x80\n\x06w]\xd2boa\x8e\xb03I\xb7\xe8Y\x1e\x8ap:K\xc5\xc3$')
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x18032, 0xffffffffffffffff, 0x0)
write$binfmt_script(r0, &(0x7f0000000080)={'#! ', './file0'}, 0xb)

08:40:52 executing program 0:

08:40:52 executing program 4:

08:40:52 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00'})
bind$packet(r0, &(0x7f0000000080), 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:52 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:52 executing program 0:
r0 = socket$inet6(0xa, 0x803, 0x7)
ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070")
syz_init_net_socket$llc(0x1a, 0x0, 0x0)
r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
bind$llc(0xffffffffffffffff, 0x0, 0x0)
bind$llc(0xffffffffffffffff, 0x0, 0x0)
close(r1)

08:40:52 executing program 5:
r0 = socket$inet6(0xa, 0x803, 0x20)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c2d023c126285718070")
r1 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x78, 0x4)
bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10)
sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6)
recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0)
write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd)

08:40:52 executing program 4:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
r1 = socket$l2tp(0x18, 0x1, 0x1)
r2 = accept(r1, &(0x7f0000000000)=@generic, &(0x7f0000000080)=0x80)
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'vcan0\x00', <r3=>0x0})
ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000180)={r3, 0x3, 0x8, 0x101, 0x8, 0x4, 0x97})
ioctl(0xffffffffffffffff, 0x1000008912, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000140)={'team0\x00', <r4=>0x0})
r5 = socket(0x1, 0x2, 0x0)
ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40086607, &(0x7f00000001c0)=0x1000)
ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f00000002c0)={'team0\x00'})
ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000480)={@local, 0x0, r4})

08:40:52 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00'})
bind$packet(r0, &(0x7f0000000080), 0x14)
syz_emit_ethernet(0x32, &(0x7f00000001c0)={@broadcast, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @broadcast}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "fbb1fe", 0x0, "1d2b16"}}}}}}, 0x0)

08:40:52 executing program 0:
r0 = socket(0x40000000015, 0x5, 0x0)
setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000380)=0x1, 0x4)
getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0)
setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000007c0)=0x800000000000002, 0x4)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4)
bind$inet(r0, &(0x7f0000000840)={0x2, 0x4e20, @loopback}, 0x10)
sendto$inet(r0, &(0x7f0000000a00)="ba671368d1010000004900000001000000018be49e9301442865319997d0efdb2f54b6a10c7327757482bfce945c2a91fb8dfafc1d3f56bc543ab87321e12cca08a744a2d128b00634bc882151d36809229a96bc3437ef159489384ade077ba295eac2882dbfd3781dd4d4e609c42628dbb709b3eb1fa030009045dd98b9e6d77b6cec9ceb685595d43995e0f04c32260943add79831e661c6a351dedc8b9d220fbf9fb6e44fb6a629ce9a82025124fec9f3ee751f7da0cd7e799be88ddbdac20b48e890ff81d7fa28c2d017d7932f2569038740461accd4582f576e4fdb6150a3399f8266bc19eb943648ad1ad81420ed6c382436e474390c8995e829e4f9df43eed85a60b9ee254e31eb62900857fa134e76cc64880334adbff069a2e5e647d2ed36a96b23834b6f6ca6b8113baf4cf30347fbb7ffc30aea99872cc0dba03b07d3347b2d257edbe2733c26b7337a79962d8ce85469e3bcbe0e4a48a6ae69d13f2d4b5155b390ef67aa714b82b6313ee277cb8986eca5db2e97cb1ae2243bba80274f614ece521baef443394b4c161cb9ae926e21892578b49cfd6efe1cb1572148c10d92218ed73ec116a18de80ac42d2726a4523a764fc6dc356c5fbbf9d2c947ae3bc9a3dc76099f3257c8d5952876151b0326d8cb1d5683ee4ad5ded9a34c00ac1b03f34627ec18a7c2e92c87b7896549cfab5eb55fa85a970994bd4b22b5f0d045e241256d06f485a47b4a55ed389bc1734541232cd41908b5cfa4b8fcfcafce500a0c7ae99767713a98e7927aa69f6ccd7daea62f19ceb82559f41899c9a9aee99113e7e64b5f8b9824be9fdbfa4dd4995673d882bb4daeb64413b334e114965d2ba3cea8051e692508701b9400cb12eae457f8b8549944091b729160939918d8fcae611a5ded665f770db637487a236da1a58ba7566668651a77171fc4fe506496d19059343dbe4f426625d3f2b705f54581372361770bf5a9098a9fafefaf546426b294239ac33e3186e4d58ad2fa995a6ad4dc074e7cca11aead109563b2076c7c6e9f57ec63df960804e2e7f9d8444de9550cca3df7834d864e9777291c2e1f6205de2e43dc995ab8bb1515a365efc2830fa3e7a1dd137f550d6035212bc1f51c3b4ceea430df49ffc9210084ef156ad7e0d219efd6c116693735b44521d389969a3a65617cd2fd6e14060601cee4cd054cf36fe048b57d1d9ee3cad2a73552449926b4a6b03fbe9c0ec68357e1fbe52ed77b67f5870c0aefb7ee8236747e0d67a26725fb515544cbbe8464da94cfd8c0b94bb4e51a263b1749bd0a7cf651931f806d1b928d1f9994f1ad4d50e6a5cd7a8e4e687f8564fdacc864013d095ba9d5709eced3c28eabda476d177a7836400a01e02beeb5a6636d4064fdda344967ad8682d14b87c71727cb66be27d1d39191f4223c545b62fb4860262ba8076a65dbc194cee1df846c584b7bbe9dce6e6895b2cbbb64b03b55548b845cc3de2f939ef918421af9a5e9157e837651245299c03992d0ddee06bd22a31522aca0f309b1feccebc0b1c0ed9d21c19bfd15cd313ff64394fd6a10904890c9f6d646b026f27253e8f584c3ffd20ad67e8b62ed7676706d40bc5c80e376980b81", 0x481, 0x0, 0x0, 0x0)

08:40:52 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x0, 0x0, 0x0)

08:40:53 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x0, 0x0, 0x0)

08:40:53 executing program 0:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0xfffffe2d)
setsockopt$packet_int(r1, 0x107, 0x9, &(0x7f0000000000)=0x20007, 0x4)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0)
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0)
sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0)
pipe2(0x0, 0x0)
setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0)

08:40:53 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:53 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$cgroup_int(r0, &(0x7f0000000040)='cpuset.mems\x00', 0x2, 0x0)
write$cgroup_subtree(r1, 0x0, 0x0)

08:40:53 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

08:40:53 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

[  206.512543] binder: undelivered death notification, 0000000000000000
[  206.535757] binder: BINDER_SET_CONTEXT_MGR already set
[  206.555416] binder: 8269:8277 ioctl 40046207 0 returned -16
08:40:53 executing program 2:
r0 = socket(0x200000000000011, 0x3, 0x8)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'syz_tun\x00', <r1=>0x0})
bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1}, 0x14)
syz_emit_ethernet(0x0, 0x0, 0x0)

[  206.578470] binder: undelivered death notification, 0000000000000000
08:40:53 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

08:40:53 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:53 executing program 3:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000b00)='/dev/uinput\x00', 0x805, 0x0)
socketpair$unix(0x1, 0x100000002, 0x0, &(0x7f0000000640)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
write$uinput_user_dev(r0, &(0x7f0000001100)={'syz0\x00'}, 0x45c)
ioctl$UI_DEV_CREATE(r0, 0x5501)
write$uinput_user_dev(r0, &(0x7f0000000680)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x9ce0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x45c)

08:40:53 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

[  206.745511] binder: undelivered death notification, 0000000000000000
[  206.770341] input: syz0 as /devices/virtual/input/input7
08:40:53 executing program 2:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000b00)='/dev/uinput\x00', 0x805, 0x0)
ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
write$uinput_user_dev(r0, &(0x7f0000001100)={'syz0\x00'}, 0x45c)
ioctl$UI_DEV_CREATE(r0, 0x5501)
write$uinput_user_dev(r0, &(0x7f0000000680)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x9ce0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c)

08:40:53 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

[  206.795817] input: syz0 as /devices/virtual/input/input8
[  206.818739] binder: undelivered death notification, 0000000000000000
[  206.879837] input: syz0 as /devices/virtual/input/input9
[  206.942705] binder: undelivered death notification, 0000000000000000
[  206.982751] input: syz0 as /devices/virtual/input/input10
08:40:54 executing program 0:
r0 = socket$inet6(0xa, 0x803, 0x20)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c2d023c126285718070")
r1 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x78, 0x4)
bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10)
sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='hybla\x00', 0x6)
recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0)
write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd)

08:40:54 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x10, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0x4}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:54 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

08:40:54 executing program 3:
perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

08:40:54 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

08:40:54 executing program 2:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x800000000000012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
msync(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3)

[  207.327146] binder: undelivered death notification, 0000000000000000
[  207.343083] binder: BINDER_SET_CONTEXT_MGR already set
08:40:54 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

08:40:54 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x10, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0x4}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

[  207.368999] binder: 8321:8322 ioctl 40046207 0 returned -16
[  207.397835] binder: 8321:8322 Acquire 1 refcount change on invalid ref 0 ret -22
[  207.423261] binder: 8321:8322 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[  207.451878] binder: 8321:8336 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:40:54 executing program 2:
r0 = socket$inet(0x2, 0x3, 0x17)
r1 = socket$inet6(0xa, 0x3, 0x7)
ioctl(r1, 0x1000008912, &(0x7f0000000040)="0a5c2d023c126285718070")
setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@broadcast}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8)

[  207.500142] binder: undelivered death notification, 0000000000000000
08:40:54 executing program 3:
syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @random="a29ab0893fde", [], {@ipv6={0x86dd, {0x0, 0x6, '?:T', 0x14, 0x2f, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x608]}, @mcast2, {[], @tcp={{0x0, 0x883e, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0)

08:40:54 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x10, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0x4}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:54 executing program 4:
r0 = socket$inet6(0xa, 0x803, 0x7)
ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000f36000)={&(0x7f0000333f88)=ANY=[@ANYBLOB="020300090c000000ffffffffffffffff02001300020000000000000000000000030006000000000002004e20e0000001000000000000002402000100f8ffffff0000000200000000030005000000000002004e20e00000010000000000000000"], 0x60}}, 0x0)

[  207.634887] ip6_tunnel: non-ECT from fe80:0000:0800:0000:0000:0000:0000:00bb with DS=0x3
[  207.662492] ip6_tunnel: non-ECT from fe80:0000:0800:0000:0000:0000:0000:00bb with DS=0x3
08:40:55 executing program 2:
r0 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r0, &(0x7f00000001c0)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e)
ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000680))
sendmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000080)="f810", 0x2}], 0x1}}], 0x1, 0x0)

08:40:55 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:55 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:55 executing program 3:
r0 = socket$inet6(0xa, 0x803, 0x9)
ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070")
syz_emit_ethernet(0x36, &(0x7f00000008c0)={@link_local={0x9, 0x80, 0xc2, 0x4788}, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0xf401, 0x0, @dev, @local}, @icmp=@timestamp}}}}, 0x0)

08:40:55 executing program 0:
r0 = socket$kcm(0x2, 0x3, 0x84)
sendmsg(r0, &(0x7f0000001b80)={&(0x7f00000001c0)=@in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x80, 0x0}, 0x0)

08:40:55 executing program 4:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000580)={&(0x7f0000000000), 0xc, &(0x7f0000000540)={&(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x1}}, 0x0)

08:40:55 executing program 3:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
bpf$OBJ_GET_PROG(0x7, &(0x7f0000000140)={&(0x7f0000000080)='./file0\x00', 0x0, 0x10}, 0x10)
close(r0)
r1 = socket$kcm(0x2, 0x802, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000200)='md5sum[\x00')
ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f00000004c0)={0x0, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfcd9, 0x10, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xffc0000000000000, 0x3, 0x5, 0x0, 0x4, 0x0, 0x1ff, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}})
r2 = openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0)
mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff)
ioctl$TUNGETSNDBUF(0xffffffffffffffff, 0x800454d3, 0x0)
ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, 0x0)
perf_event_open(&(0x7f00000003c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x77, 0x401, 0x4, 0x0, 0x3fe0000, 0x10001, 0x0, 0x8, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff01}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$cgroup_type(r2, 0x0, 0x2, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={<r3=>0x0, <r4=>0x0})
write$cgroup_int(r4, &(0x7f0000000980), 0xffffff4d)
socket$kcm(0x29, 0x7, 0x0)
recvmsg$kcm(r1, &(0x7f0000000740)={&(0x7f0000000540)=@nl=@proc, 0x80, &(0x7f0000000700)=[{&(0x7f00000005c0)=""/140, 0x8c}, {&(0x7f0000000680)=""/115, 0x73}, {&(0x7f0000000480)=""/28, 0x1c}], 0x3}, 0x40000140)
close(r4)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$cgroup_int(r0, &(0x7f0000000240)='memory.max\x00', 0x2, 0x0)
recvmsg$kcm(r3, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00)
r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000280)={0xffffffffffffffff, 0x3, 0x8}, 0xc)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000440)={r5, &(0x7f00000002c0)="df5b5710ba012a47625b67983b7f8649d8f79f282e336963c25cbb0f800c119d2da8cd55775ffc29b3f9d69f904e192fe8d614cfbf873f4ce876fef9872cb38af04080855ed35b250e3f2fe333bfdc546a107500970e6b7788d4a5fc1e8e464aa30bd9f6ebd7f3d1d05f506c22bcb4efad3cd3d7ee5e7169d7ce4abca2fe0fde7a3f6e0911a780949eb4abe89b92b7cd9932f440213b657cf68ef3bc8e35c32d72bb969e12c71ca56c558754ad192c31d417f373e1eb391ac8ac22ad14e14ee5dc5c7b87ebe16ad80959c85542e3a9fbd0f00499ba33f7c719bd6aba756010546e99e63620", 0x0}, 0x18)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmsg(r1, &(0x7f0000000000)={&(0x7f00000000c0)=@in={0x2, 0x4e22}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x8953, &(0x7f0000000040)=0x2)

[  208.246916] binder: undelivered death notification, 0000000000000000
08:40:55 executing program 2:
r0 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r0, &(0x7f00000001c0)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e)
ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000680))
sendmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000080)="f810", 0x2}], 0x1}}], 0x1, 0x0)

08:40:55 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:55 executing program 4:
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$kcm(0x10, 0x800000000002, 0x0)
sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="2e0000001d008100e00f80ecdb4cb90402c865160b000000d4126efb120001000e00da1b40d819a9060015000000", 0x2e}], 0x1}, 0x0)

08:40:55 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:55 executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = socket$kcm(0xa, 0x2, 0x11)
sendmsg$kcm(r0, &(0x7f0000000480)={&(0x7f0000000080)=@in6={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x2, [0xe803, 0xee6e0000, 0x2a0]}, 0xf}, 0x80, 0x0}, 0x0)

[  208.388237] binder: 8380:8383 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:40:55 executing program 2:
r0 = accept$inet(0xffffffffffffffff, 0x0, 0x0)
getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={<r1=>0xffffffffffffffff})
r2 = accept$unix(0xffffffffffffffff, 0x0, 0x0)
r3 = eventfd(0x0)
getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f0000000240)=""/165, 0x0)
r4 = dup3(r1, r3, 0x80000)
getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, 0x0, &(0x7f00000004c0))
getegid()
ioctl$PIO_UNIMAP(r4, 0x4b67, 0x0)
ioctl$sock_SIOCGPGRP(r0, 0x8904, 0x0)
inotify_init()
flock(0xffffffffffffffff, 0xc)
ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0)
ioctl$KDSETLED(0xffffffffffffffff, 0x4b32, 0x0)
fstat(r1, 0x0)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f00000009c0)=0x2, 0x4)

08:40:55 executing program 4:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0)
sendmmsg$unix(r0, &(0x7f0000007300)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)}], 0x1, 0x80)

[  208.446813] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based  firewall rule not found. Use the iptables CT target to attach helpers instead.
08:40:55 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:55 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x38, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:55 executing program 0:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
socket$inet(0x2, 0x0, 0x0)

[  208.595286] binder: 8406:8407 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:40:55 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ipv6_route\x00')
preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000000)=""/1, 0x1}], 0x1, 0x63)

08:40:56 executing program 3:
socketpair$unix(0x1, 0x0, 0x0, 0x0)
setgroups(0x14ce, &(0x7f0000000140))

08:40:56 executing program 4:
msgrcv(0x0, 0x0, 0x0, 0x0, 0x1000)
msgsnd(0x0, &(0x7f0000000300)={0x2}, 0x8, 0x0)

08:40:56 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0)
ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0)

08:40:56 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:56 executing program 2:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ipv6_route\x00')
preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000000)=""/1, 0x1}], 0x1, 0x63)

08:40:56 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:56 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:56 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000006c0)=0x200, 0x20)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10)
recvmsg(r0, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100)
write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd)
shutdown(r0, 0x1)

08:40:56 executing program 2:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_settime(0x0, &(0x7f0000000000))

08:40:56 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

[  209.439989] binder: 8431:8432 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:40:56 executing program 3:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
clock_settime(0x0, &(0x7f0000000000))

08:40:56 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

[  209.718125] binder: 8454:8457 Acquire 1 refcount change on invalid ref 0 ret -22
[  209.751470] binder: 8454:8457 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
08:40:56 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:56 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c)
connect$inet6(r0, &(0x7f0000000800)={0xa, 0x0, 0x0, @remote}, 0x1c)

[  209.765903] binder: 8454:8459 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:40:56 executing program 0:
pipe(&(0x7f0000000300)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$alg(0x26, 0x5, 0x0)
write$binfmt_script(r1, &(0x7f0000000040)=ANY=[@ANYRES32], 0xffffff58)
bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(hmac(sha256-generic))\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0)
r3 = accept4(r2, 0x0, 0x0, 0x0)
r4 = accept4$alg(r3, 0x0, 0x0, 0x0)
splice(r0, 0x0, r4, 0x0, 0x20000000003, 0x0)

08:40:56 executing program 4:
clone(0x20040200, 0x0, 0x0, 0x0, 0x0)
mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0)
execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000280)='clear_refs\x00\xb0Ix\xe6\fK\xa3/\xd7\xb9IqK\xcb\xe8\fW\xafYt|a\xa3\x16\x19\xcb\xaf\xea\x03O[k\xb1S2\x86\v\x9f\x14\xc6T\xd1\x01$\x84\xf5\xc9\xd8\xed\xca\xd2\xf0s\xe0\xcaPx\xfcd\xd3\x8d\x1e){\x9df\xa7\x14R\xb9,\xaegV\x96!n\b\xf2\x1e\x87\xb8\xb5M\xa0\xd1\xb5\xf3\xb4\xd6\xf8\xca\xf3J\x15\xed+,\x98\xfc\xbfX\x12\x97\xb3\x1b\xea\xfa\xff\xb7gx\xa1\x96\xad\x93\xaa=-z\x06r\b\'')
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='syscall\x00')
sendmsg$unix(0xffffffffffffffff, 0x0, 0x0)
sendfile(r0, r1, 0x0, 0x1)
execve(&(0x7f0000000500)='./file1\x00', 0x0, 0x0)
open$dir(&(0x7f00000000c0)='./file0\x00', 0x100027e, 0x0)

08:40:56 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}}, 0x800)

08:40:56 executing program 3:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000b00)='/dev/uinput\x00', 0x805, 0x0)
ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3)
write$uinput_user_dev(r0, &(0x7f0000001100)={'syz0\x00', {}, 0x0, [], [], [0x1]}, 0x45c)
ioctl$UI_DEV_CREATE(r0, 0x5501)
write$uinput_user_dev(r0, &(0x7f0000000680)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x9ce0]}, 0x45c)

[  209.890380] binder: 8465:8468 Acquire 1 refcount change on invalid ref 0 ret -22
[  209.929651] binder: 8465:8468 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
08:40:56 executing program 2:
socketpair$unix(0x1, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f0000000180))
sendfile(r0, 0xffffffffffffffff, 0x0, 0xfffffdef)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
memfd_create(&(0x7f0000000740)='(cgroupself\x00', 0x4)
sigaltstack(&(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0))
ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01)
setgroups(0x14ce, &(0x7f0000000140))
openat$selinux_attr(0xffffffffffffff9c, 0x0, 0x2, 0x0)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14)
setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000480)={{{@in6=@loopback, @in6=@loopback, 0x0, 0x1f, 0x4e21, 0x0, 0xa, 0x0, 0x20, 0x2f, r1}, {0x1, 0x1, 0x81, 0x7f, 0x0, 0x1ff, 0x0, 0x3}, {0x0, 0x5, 0x2, 0x3f}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@loopback, 0x4d6, 0x3e}, 0x0, @in6, 0x0, 0x0, 0x0, 0x81, 0x9, 0xfffffffffffffff8}}, 0xe8)
setxattr$trusted_overlay_upper(&(0x7f0000000780)='./file0/file0\x00', &(0x7f00000007c0)='trusted.overlay.upper\x00', &(0x7f0000000800)={0x0, 0xfb, 0x15, 0x0, 0x0, "9edf28140055daab97583593724de3cd"}, 0x15, 0x0)
stat(0x0, 0x0)
syz_genetlink_get_family_id$tipc(0x0)

[  210.011211] binder: 8465:8468 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:40:57 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:57 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}}, 0x800)

[  210.095615] input: syz0 as /devices/virtual/input/input11
[  210.156150] binder: 8500:8504 Acquire 1 refcount change on invalid ref 0 ret -22
[  210.202121] binder: 8500:8511 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:40:57 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}}, 0x800)

08:40:57 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffdef)
write(0xffffffffffffffff, 0x0, 0x0)
setgroups(0x14ce, &(0x7f0000000140))

08:40:57 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:57 executing program 4:
clock_gettime(0x0, 0x0)
clock_settime(0x0, &(0x7f00000000c0))

08:40:57 executing program 2:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="430200000000000008000a00060000001800120008000100767469000c00020008000400b4420002"], 0x1}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

[  210.388668] binder: undelivered death notification, 0000000000000000
08:40:57 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:57 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)

08:40:57 executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0))
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f0000000180))
r1 = memfd_create(&(0x7f0000000080)='\x00', 0x0)
ftruncate(r1, 0x1000000)
ioctl$BLKBSZSET(0xffffffffffffffff, 0x40081271, &(0x7f00000001c0))
sendfile(r0, r1, &(0x7f00000037c0)=0xf10001, 0xfffffdef)
connect$netlink(0xffffffffffffffff, 0x0, 0x0)
prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000ffd000/0x3000)=nil)
memfd_create(0x0, 0x0)
sigaltstack(&(0x7f0000ffc000/0x4000)=nil, 0x0)
write(0xffffffffffffffff, 0x0, 0x0)

08:40:57 executing program 4:
timerfd_create(0x0, 0x0)
timerfd_settime(0xffffffffffffffff, 0x3, 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000080)={<r0=>0x0})
clock_settime(0x0, &(0x7f00000000c0)={r0})

08:40:57 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f0000000180))
r1 = memfd_create(&(0x7f0000000080)='\x00', 0x0)
ftruncate(r1, 0x1000000)
ioctl$BLKBSZSET(0xffffffffffffffff, 0x40081271, &(0x7f00000001c0))
sendfile(r0, r1, 0x0, 0xfffffdef)
memfd_create(0x0, 0x4)
write(r0, &(0x7f0000000600), 0x0)

08:40:57 executing program 2:
r0 = timerfd_create(0x0, 0x0)
timerfd_settime(r0, 0x3, &(0x7f000000b000)={{}, {0x0, 0x1c9c380}}, 0x0)
clock_settime(0x0, &(0x7f0000000000))

[  210.830282] binder: undelivered death notification, 0000000000000000
08:40:57 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:57 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:40:57 executing program 2:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={<r1=>0x0}, &(0x7f0000000180)=0xc)
keyctl$assume_authority(0x10, 0x0)
clone(0x2102001fbc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
request_key(&(0x7f0000000100)='trusted\x00', &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000000240)='cgroup.threads\x00', 0xfffffffffffffffd)
add_key(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x325, 0xfffffffffffffffa)
sched_setaffinity(r1, 0x8, &(0x7f00000003c0)=0x2)
ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, 0x0)
ioctl$VT_OPENQRY(0xffffffffffffffff, 0x5600, &(0x7f0000000280))
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vga_arbiter\x00', 0x80000, 0x0)
r3 = gettid()
mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000003, 0x40010, r2, 0x0)
bpf$OBJ_GET_PROG(0x7, 0x0, 0xffffffe7)
bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x1}, 0xfffffe5d)
clone(0x30000000, 0x0, &(0x7f00000004c0), &(0x7f0000000140), &(0x7f0000000500)="77e58a9ec2fb2700624f8f992fabfaeb98e2afa72f1e3c5cea8e99081c4594b0297940d7389c0e7f0000004ed293816927e0b560355bc2a5fc06ede8f6fae40ea28042b48f239a92dbeb65e58e571024d4f83381050273479bfa3bdf88d0a7f0")
ptrace$setopts(0x4206, r3, 0x0, 0x0)
tkill(r3, 0x6)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x3)
wait4(0x0, &(0x7f0000000040), 0x0, &(0x7f0000000680))

08:40:57 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)

08:40:57 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:57 executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)

08:40:57 executing program 2:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={<r1=>0x0}, &(0x7f0000000180)=0xc)
keyctl$assume_authority(0x10, 0x0)
clone(0x2102001fbc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
request_key(&(0x7f0000000100)='trusted\x00', &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000000240)='cgroup.threads\x00', 0xfffffffffffffffd)
add_key(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x325, 0xfffffffffffffffa)
sched_setaffinity(r1, 0x8, &(0x7f00000003c0)=0x2)
ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, 0x0)
ioctl$VT_OPENQRY(0xffffffffffffffff, 0x5600, &(0x7f0000000280))
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vga_arbiter\x00', 0x80000, 0x0)
r3 = gettid()
mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000003, 0x40010, r2, 0x0)
bpf$OBJ_GET_PROG(0x7, 0x0, 0xffffffe7)
bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x1}, 0xfffffe5d)
clone(0x30000000, 0x0, &(0x7f00000004c0), &(0x7f0000000140), &(0x7f0000000500)="77e58a9ec2fb2700624f8f992fabfaeb98e2afa72f1e3c5cea8e99081c4594b0297940d7389c0e7f0000004ed293816927e0b560355bc2a5fc06ede8f6fae40ea28042b48f239a92dbeb65e58e571024d4f83381050273479bfa3bdf88d0a7f0")
ptrace$setopts(0x4206, r3, 0x0, 0x0)
tkill(r3, 0x6)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x3)
wait4(0x0, &(0x7f0000000040), 0x0, &(0x7f0000000680))

08:40:57 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:40:57 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:57 executing program 0:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={<r1=>0x0}, &(0x7f0000000180)=0xc)
keyctl$assume_authority(0x10, 0x0)
clone(0x2102001fbc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
request_key(&(0x7f0000000100)='trusted\x00', &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000000240)='cgroup.threads\x00', 0xfffffffffffffffd)
add_key(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x325, 0xfffffffffffffffa)
sched_setaffinity(r1, 0x8, &(0x7f00000003c0)=0x2)
ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, 0x0)
ioctl$VT_OPENQRY(0xffffffffffffffff, 0x5600, &(0x7f0000000280))
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vga_arbiter\x00', 0x80000, 0x0)
r3 = gettid()
mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000003, 0x40010, r2, 0x0)
bpf$OBJ_GET_PROG(0x7, 0x0, 0xffffffe7)
bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x1}, 0xfffffe5d)
clone(0x30000000, 0x0, &(0x7f00000004c0), &(0x7f0000000140), &(0x7f0000000500)="77e58a9ec2fb2700624f8f992fabfaeb98e2afa72f1e3c5cea8e99081c4594b0297940d7389c0e7f0000004ed293816927e0b560355bc2a5fc06ede8f6fae40ea28042b48f239a92dbeb65e58e571024d4f83381050273479bfa3bdf88d0a7f0")
ptrace$setopts(0x4206, r3, 0x0, 0x0)
tkill(r3, 0x6)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x3)
wait4(0x0, &(0x7f0000000040), 0x0, &(0x7f0000000680))

08:40:57 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f0000000180))
r1 = memfd_create(&(0x7f0000000080)='\x00', 0x0)
ftruncate(r1, 0x1000000)
ioctl$BLKBSZSET(0xffffffffffffffff, 0x40081271, &(0x7f00000001c0))
sendfile(r0, r1, 0x0, 0xfffffdef)
memfd_create(0x0, 0x4)
write(r0, &(0x7f0000000600), 0x0)

08:40:57 executing program 2:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={<r1=>0x0}, &(0x7f0000000180)=0xc)
keyctl$assume_authority(0x10, 0x0)
clone(0x2102001fbc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
request_key(&(0x7f0000000100)='trusted\x00', &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000000240)='cgroup.threads\x00', 0xfffffffffffffffd)
add_key(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x325, 0xfffffffffffffffa)
sched_setaffinity(r1, 0x8, &(0x7f00000003c0)=0x2)
ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, 0x0)
ioctl$VT_OPENQRY(0xffffffffffffffff, 0x5600, &(0x7f0000000280))
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vga_arbiter\x00', 0x80000, 0x0)
r3 = gettid()
mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000003, 0x40010, r2, 0x0)
bpf$OBJ_GET_PROG(0x7, 0x0, 0xffffffe7)
bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x1}, 0xfffffe5d)
clone(0x30000000, 0x0, &(0x7f00000004c0), &(0x7f0000000140), &(0x7f0000000500)="77e58a9ec2fb2700624f8f992fabfaeb98e2afa72f1e3c5cea8e99081c4594b0297940d7389c0e7f0000004ed293816927e0b560355bc2a5fc06ede8f6fae40ea28042b48f239a92dbeb65e58e571024d4f83381050273479bfa3bdf88d0a7f0")
ptrace$setopts(0x4206, r3, 0x0, 0x0)
tkill(r3, 0x6)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x3)
wait4(0x0, &(0x7f0000000040), 0x0, &(0x7f0000000680))

08:40:57 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:57 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:40:57 executing program 1:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={<r1=>0x0}, &(0x7f0000000180)=0xc)
keyctl$assume_authority(0x10, 0x0)
clone(0x2102001fbc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
request_key(&(0x7f0000000100)='trusted\x00', &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000000240)='cgroup.threads\x00', 0xfffffffffffffffd)
add_key(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x325, 0xfffffffffffffffa)
sched_setaffinity(r1, 0x8, &(0x7f00000003c0)=0x2)
ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, 0x0)
ioctl$VT_OPENQRY(0xffffffffffffffff, 0x5600, &(0x7f0000000280))
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vga_arbiter\x00', 0x80000, 0x0)
r3 = gettid()
mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000003, 0x40010, r2, 0x0)
bpf$OBJ_GET_PROG(0x7, 0x0, 0xffffffe7)
bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x1}, 0xfffffe5d)
clone(0x30000000, 0x0, &(0x7f00000004c0), &(0x7f0000000140), &(0x7f0000000500)="77e58a9ec2fb2700624f8f992fabfaeb98e2afa72f1e3c5cea8e99081c4594b0297940d7389c0e7f0000004ed293816927e0b560355bc2a5fc06ede8f6fae40ea28042b48f239a92dbeb65e58e571024d4f83381050273479bfa3bdf88d0a7f0")
ptrace$setopts(0x4206, r3, 0x0, 0x0)
tkill(r3, 0x6)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x3)
wait4(0x0, &(0x7f0000000040), 0x0, &(0x7f0000000680))

08:40:57 executing program 0:
r0 = epoll_create(0xe2a0)
r1 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000200))
epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000000))

08:40:57 executing program 0:
r0 = epoll_create(0xe2a0)
r1 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000200))
epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000000))

08:40:58 executing program 5:
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:58 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:40:58 executing program 2:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$bt_hci(r0, 0x0, 0x2, &(0x7f0000000100)=""/2, &(0x7f0000000140)=0x2)

08:40:58 executing program 1:
r0 = timerfd_create(0x0, 0x0)
timerfd_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x1c9c380}}, 0x0)
timerfd_settime(r0, 0x0, 0x0, &(0x7f0000000100))

08:40:58 executing program 0:
r0 = epoll_create(0xe2a0)
r1 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000200))
epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000000))

08:40:58 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:40:58 executing program 2:
openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mlockall(0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x243}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x800)

08:40:58 executing program 5:
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:58 executing program 1:
r0 = socket$inet6(0xa, 0x80003, 0x88)
setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in=@multicast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in=@empty, 0x0, 0x32}, 0x0, @in6=@mcast2}}, 0xe8)
syz_emit_ethernet(0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd601bfc970008880001810000000000000000000000000000ff0200000000000000000000000000010000000000089078"], 0x0)

08:40:58 executing program 3:
r0 = epoll_create(0xe2a0)
r1 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000040)={0x20000000})
epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000000))

08:40:58 executing program 0:
r0 = epoll_create(0xe2a0)
r1 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000200))
epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000000))

08:40:58 executing program 0:
r0 = epoll_create(0xe2a0)
r1 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000200))

08:40:58 executing program 5:
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:58 executing program 1:
r0 = epoll_create(0xe2a0)
r1 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000200))

08:40:58 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:40:58 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = memfd_create(&(0x7f0000000080)='\x00', 0x0)
ftruncate(r1, 0x1000000)
sendfile(r0, r1, &(0x7f00000037c0)=0xf10001, 0xfffffdef)
connect$netlink(r0, &(0x7f0000000340), 0xfffffffffffffcc8)
prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000ffd000/0x3000)=nil)
memfd_create(&(0x7f0000000740)='(cgroupself\x00', 0x0)
sigaltstack(&(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0))
write(r0, &(0x7f0000000600), 0x0)
setgroups(0x0, 0x0)
syz_genetlink_get_family_id$tipc(0x0)

08:40:59 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:59 executing program 0:
r0 = epoll_create(0xe2a0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f0000000200))

08:40:59 executing program 1:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet6_int(r0, 0x29, 0x43, &(0x7f0000000140), 0x4)

08:40:59 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

[  212.962974] binder_release_work: 1 callbacks suppressed
[  212.962981] binder: undelivered death notification, 0000000000000000
08:40:59 executing program 0:
r0 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000200))

08:40:59 executing program 1:
r0 = socket$inet(0x2, 0x2, 0x2000000088)
bind(r0, &(0x7f0000000080)=@in={0x2, 0x4e20}, 0x80)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='ip6gretap0\x00', 0x10)
setsockopt$inet_udp_int(r0, 0x11, 0xa, &(0x7f0000000000)=0x1, 0x100000169)
sendto$inet(r0, &(0x7f0000001600)=' ', 0x1, 0x0, 0x0, 0x0)
recvmsg(r0, &(0x7f0000001300)={&(0x7f00000001c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f0000001240)=[{&(0x7f0000000240)=""/4096, 0x1000}], 0x1, &(0x7f0000001280)=""/104, 0x68}, 0x2)

08:40:59 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:59 executing program 4:
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0)

08:40:59 executing program 2:
r0 = socket$inet6(0x18, 0x8002, 0x0)
setsockopt(r0, 0x2000000000029, 0xd, &(0x7f0000000000)="ff020008aaa008000000c3513e2a5e0000000000", 0x14)

08:40:59 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = memfd_create(&(0x7f0000000080)='\x00', 0x0)
ftruncate(r1, 0x1000000)
sendfile(r0, r1, &(0x7f00000037c0)=0xf10001, 0xfffffdef)
connect$netlink(r0, &(0x7f0000000340), 0xfffffffffffffcc8)
prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000ffd000/0x3000)=nil)
memfd_create(&(0x7f0000000740)='(cgroupself\x00', 0x0)
sigaltstack(&(0x7f0000ffc000/0x4000)=nil, &(0x7f00000002c0))
write(r0, &(0x7f0000000600), 0x0)
setgroups(0x0, 0x0)
syz_genetlink_get_family_id$tipc(0x0)

08:40:59 executing program 4:
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0)

[  213.419791] binder: undelivered death notification, 0000000000000000
08:40:59 executing program 0:
r0 = epoll_create(0x0)
r1 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000200))

08:40:59 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:40:59 executing program 2:
r0 = timerfd_create(0x9, 0x0)
timerfd_settime(r0, 0x0, 0x0, 0x0)
clock_settime(0x0, &(0x7f0000000000))

08:40:59 executing program 4:
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0)

08:40:59 executing program 0:
r0 = epoll_create(0xe2a0)
r1 = syz_open_dev$sndtimer(0x0, 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000200))

08:40:59 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

[  213.590561] binder: undelivered death notification, 0000000000000000
[  213.712625] binder: 8741:8742 ioctl c0306201 0 returned -14
[  213.740039] binder: undelivered death notification, 0000000000000000
08:41:00 executing program 1:
unshare(0x8000400)
r0 = mq_open(&(0x7f0000000000)='-$\x00', 0x6e93ebbbcc0884f7, 0x0, 0x0)
mq_timedsend(r0, 0x0, 0x0, 0x0, 0x0)

08:41:00 executing program 2:
pipe2(&(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
io_setup(0x1, &(0x7f0000000340)=<r1=>0x0)
write$P9_RAUTH(r0, &(0x7f0000000240)={0x14}, 0x14)
io_submit(r1, 0x1, &(0x7f0000b52fd8)=[&(0x7f0000587000)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f000096f000)="0000bc4ffe7f00009d", 0x9}])

08:41:00 executing program 4:
r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:41:00 executing program 0:
epoll_create(0xe2a0)
r0 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000200))

08:41:00 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:00 executing program 3:
r0 = socket$inet6(0xa, 0x803, 0x65)
ioctl(r0, 0x20001000008912, &(0x7f00000000c0)="0a5c2d023c126285718070")
r1 = memfd_create(&(0x7f0000001540)='}\xbf*x\x89-vO\xd3JUk\x88O\xc4N\xa2\rqI\r\xb3\xd9Q(\n\x1a\x9f/X\x1d9\x03\xc2\x16\xaf\x9d\xffl\xdcC\xeb\xa6\x96\x12$\xd15[z\x85\xf4\x1e\xcc\xfc\xf64\x00\x00\x00\x00\x00\x00\x00Pw\x1bN[\x81\x92\x15P\xc5\x0e\x06\x17\b\xaf\nu\xd8D9z\x9eR\bjh\xce\xa9j\xda\xf8B\x84\x8d\x12.\xeb\x95\x9a\n\xb2M\xc7\xd1\x87N\xc5Os?T\"\xfc\fc\x92\xbb>\xa3l\x9a\xc9\'\x14\xd5+\xb1\xa6\xf5\x9e\xd1\xea%\xd8l\xae\xd6\\dZ\x17/\xe7$(\x8ax\xdc\xc4\xb7\xa4\x9b\x92\xd8\x16Lz\x9e\xfc\xf8\xf1\xdc\xb9+F~%\x16e\x81\x1b\x11vw1:\xdd]\xb9\xe8\x99\xea\xd1O\x83\xf3WA\xad\xaa\xdc\r~[I\x9f\xac\x03\xf9\xe2\x12Je\xe9$\xd2\x00\xef\r\x9dQ2\xa1T4\xb4\x116RO+\x0e\x98\x8b\x1b\xc1\x81\xf0U\x93\xd1\xf7\xbb}N\'\xea\x8f\xbbdd\xda\xb5\x7f\xff\xef\xfd\xd5\x9b\x01?\xad \xa8\xe3l\x86\"\x94M\xd5\xfa]\x9f\x1d\xad\xf9y\xfc\x03=$Z\x00Oa#`qHd\xcc\x8f\x80\xa1\xed\x81 \x85\xe7\x1f\x99\xbe\xe8\xe5\xcey\n\xab\x8b\xa0yM\xba\xcf7}\x8eVQ\xe6d.S\x9e\xb1\x98\xd9\xc8;\xcc\xd5\xf2)\xf7Zh)\xffF\xb8\xc7\xd2%\xe9\xc7\x05\xefq\\\x97]\xd7\x1b\xdf\"o\xca\xd4\xe0\xd5\x125\xefz1\xcc\xe1nZ\xbe\x16\xa1\x8f\xc8)9\xb8\xc6\xc2\xdd8.*U\xe0\xc5\x04\x00\xd9\xfd{ZT\xf2\xe4\xb9\x95x\xa5\xbd\x04\x0f\x8eky\xd8\x8e\xd77\xd7\x0fp\n\x11\x13)\x9b\xf3D\xb2\x88*(\x02{\xb2`:\x01\x00\x00\x00\x00\x00\x00\xee\xff\xff\xffV2\xaa\x82', 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='wchan\x00')
sendfile(r1, r2, 0x0, 0x4000000040d5)

08:41:00 executing program 4:
r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:41:00 executing program 0:
r0 = epoll_create(0xe2a0)
syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f0000000200))

[  214.249319] binder: 8750:8756 ioctl c0306201 0 returned -14
[  214.264221] binder: undelivered death notification, 0000000000000000
08:41:00 executing program 3:
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x1, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="04"], 0x0, 0x0, 0x0})

08:41:00 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:00 executing program 4:
r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:41:00 executing program 1:
io_setup(0x6, &(0x7f00000000c0))

08:41:00 executing program 2:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='illinois\x00', 0x9)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10)

[  214.429987] binder: 8771:8772 ioctl c0306201 0 returned -14
[  214.442561] binder: 8770:8777 unknown command 4
[  214.450711] binder: undelivered death notification, 0000000000000000
[  214.472467] binder: 8770:8787 unknown command 4
08:41:00 executing program 2:
r0 = syz_open_dev$sndtimer(&(0x7f0000014000)='/dev/snd/timer\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x100000001}})
close(r0)

08:41:00 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:00 executing program 0:
r0 = epoll_create(0xe2a0)
r1 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, 0x0)

[  214.486158] binder: 8770:8787 ioctl c0306201 20000180 returned -22
[  214.489780] binder: 8770:8777 ioctl c0306201 20000180 returned -22
08:41:00 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:41:00 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000300))
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180))

08:41:00 executing program 3:
clone(0x4000, 0x0, 0x0, 0x0, 0x0)
clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
socket$inet6_udplite(0xa, 0x2, 0x88)
pipe(&(0x7f0000000040))
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000480)='/dev/null\x00', 0xffffffffeffffffc, 0x0)
ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000100)={0x7, 0x48, 0x40, 0x800, 0x42, 0x9})
sched_setscheduler(0x0, 0x0, 0x0)
seccomp(0x1, 0x0, &(0x7f0000000180)={0x20000000000001f7, &(0x7f0000000000)=[{0x61, 0x0, 0xfffffffffffffffd}, {0x3, 0x0, 0x0, 0x7f}]})
sched_setscheduler(0x0, 0x0, 0x0)
ioctl$TCSBRK(r0, 0x5409, 0x7f)

08:41:00 executing program 0:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={<r0=>0xffffffffffffffff})
writev(r0, &(0x7f0000000340)=[{&(0x7f00000002c0)="575656d0d4908f635ec842e7d867c7cd6590da9369d0c8a8b4aad6bc7fc6c614cb93b6d5c18f627abcf0ee0c3083b667e10aa6fb4f083449a74be303e72f195bbc6f5b268c226d635f4282111a3184f562bcad1abbcc2c8e39c1f08482e66cd19ac0b9ea722e3a8a167fc4569631d6457fdaa35b10d83516f8379122323eef77", 0x80}], 0x1)

[  214.659281] binder: undelivered death notification, 0000000000000000
08:41:00 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:00 executing program 2:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x7, 0x4001)

08:41:00 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

[  214.710812] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.
08:41:00 executing program 0:
r0 = perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x85a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00')
clone(0x8002102001ff8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r0, 0x0)
lstat(0x0, 0x0)

08:41:01 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:41:01 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

[  214.822508] binder: undelivered death notification, 0000000000000000
08:41:01 executing program 2:
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x1e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0)
socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, <r0=>0x0})
close(r0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000500)='cpuacct.usage_sys\x00', 0x0, 0x0)
socket$kcm(0x29, 0x0, 0x0)
sendmsg(0xffffffffffffffff, 0x0, 0x0)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000340)={'bond_slave_1\x00'})
bpf$PROG_LOAD(0x5, 0x0, 0x0)

08:41:01 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

[  214.942769] binder: undelivered death notification, 0000000000000000
08:41:01 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:41:01 executing program 1:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x4001)

[  215.094275] binder: undelivered death notification, 0000000000000000
08:41:01 executing program 3:
ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x0)
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4000001, 0x0)
memfd_create(0x0, 0x0)
ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, 0x0)
utime(0x0, 0x0)
read(0xffffffffffffffff, 0x0, 0x0)
getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
ioctl$KIOCSOUND(0xffffffffffffffff, 0x4b2f, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c00, 0xffffffffffffffff)
ioctl$LOOP_SET_CAPACITY(0xffffffffffffffff, 0x4c07)
fstat(0xffffffffffffffff, 0x0)
syz_genetlink_get_family_id$tipc2(0x0)
sendmsg$TIPC_NL_BEARER_ADD(0xffffffffffffffff, 0x0, 0x0)
ioctl$IOC_PR_RELEASE(0xffffffffffffffff, 0x401070ca, 0x0)
ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01)
ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)

08:41:01 executing program 0:
clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
pause()
ptrace$setopts(0x4206, r0, 0x0, 0x1)
tkill(r0, 0x3e)
tkill(r0, 0x12)
ptrace(0x18, r0)

08:41:01 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:41:01 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:01 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, &(0x7f0000000200)})
mmap$binder(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0)

08:41:01 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
pipe(&(0x7f0000000000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
write(r2, &(0x7f00000001c0), 0xfffffef3)
read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3)
ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x11)
io_setup(0x7, &(0x7f00000005c0)=<r3=>0x0)
io_submit(r3, 0x1, &(0x7f0000000940)=[&(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x68, 0xffffffffffffffff, 0x0}])
lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480))
lstat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540))
r4 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c)
connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c)
recvfrom$packet(r1, &(0x7f0000000140)=""/167, 0xa7, 0x101, &(0x7f0000000340)={0x11, 0x1, 0x0, 0x1, 0x7ff, 0x6, @dev={[], 0x1e}}, 0x14)
sendmmsg(r4, &(0x7f0000000600), 0x0, 0x0)
setsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0)
io_setup(0x0, &(0x7f00000000c0)=<r5=>0x0)
io_cancel(r5, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f0000000180)="d9f86abdd33cdf4d2fb8ef68481b20e5", 0x10, 0xcda, 0x0, 0x2}, 0x0)
r6 = creat(&(0x7f0000000700)='./bus\x00', 0x0)
r7 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
ioctl$EXT4_IOC_SETFLAGS(r7, 0x40086602, &(0x7f00000001c0))
write$cgroup_type(r6, &(0x7f0000000340)='threaded\x00', 0xffffffc5)
getsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000040)={@loopback}, &(0x7f0000000080)=0x14)
write$binfmt_aout(r6, &(0x7f0000000980)=ANY=[@ANYBLOB="0f0108830c0200004b020000080000003b00000085c4ffff0000000000000000e76b6750f8680a74d72715455c69ec8e11b3ef5210482e6cb972ab2bdb2a8352b139976e9ed2a322319fe7f500d99a2d522cb2e2c6bd826045d2d54d821d442200925039d10b74e93b985e8dc4371b47e3bc7fa70265c2bbe4e83d007b82ae65ebce6c3c30047731732b342724ac4c23fa867bab3254d803f11caaf23a66ca9f534d691e5c45687ca06b71037bd407480d0f7cc20d119044d26950ca3ef23cb4b16d3561ba0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002105dd8a861a460f000000000000000000000000000000000000000000000000000000000000000000000000efffffff000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000001f000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003091c2d3bc89196444dd00000000000c981f635849909129002b5afa0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbff0000000000000000000000000000000000000000000000000000ffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e549da8191910eaa523596d17ecb699528e30362ae5f716235ee29f2fbe8797cf96ab130774a2ef060d6a3d48fbef5e553645ebbd6afaff7c531e27fafdda3b3824abb5057682a53ab9c3a2df9da27899f535e38f6a0b38bd9142fc9e6ed7b74589866709d87f00cca04d1b56379bd3c2573995166ccac353f7a25820e7692d49b16e3c5153fcfe9187b45bc546002cabc7b601321160fef23"], 0x375)
ioctl$EXT4_IOC_MIGRATE(r7, 0x6609)
ioctl$void(r0, 0xc0045c79)

08:41:01 executing program 2:
openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0)
clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
mknod(&(0x7f0000000140)='./file0\x00', 0xffc, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_netfilter(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2000000076fcf9e0cf880bde2327aa9a168a5000020008000100e0e807020000"], 0x20}}, 0x0)
execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0)

[  215.561373] binder: 8864:8866 ERROR: BC_REGISTER_LOOPER called without request
[  215.576399] binder: BINDER_SET_CONTEXT_MGR already set
[  215.590268] binder: 8870:8873 ioctl 40046207 0 returned -16
08:41:01 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:41:01 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
pipe(&(0x7f0000000000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
write(r2, &(0x7f00000001c0), 0xfffffef3)
read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3)
ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x11)
io_setup(0x7, &(0x7f00000005c0))
io_submit(0x0, 0x0, 0x0)
lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480))
lstat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540))
r3 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c)
connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c)
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={<r4=>0x0, @multicast1, @broadcast}, &(0x7f0000000300)=0xc)
recvfrom$packet(r1, &(0x7f0000000140)=""/167, 0xa7, 0x101, &(0x7f0000000340)={0x11, 0x1, r4, 0x1, 0x7ff, 0x6, @dev={[], 0x1e}}, 0x14)
sendmmsg(r3, &(0x7f0000000600), 0x0, 0x0)
setsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0)
io_setup(0x0, &(0x7f00000000c0)=<r5=>0x0)
io_cancel(r5, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f0000000180)="d9f86abdd33cdf4d2fb8ef68481b20e5", 0x10, 0xcda, 0x0, 0x2}, 0x0)
r6 = creat(&(0x7f0000000700)='./bus\x00', 0x0)
r7 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
ioctl$EXT4_IOC_SETFLAGS(r7, 0x40086602, &(0x7f00000001c0)=0x1)
write$cgroup_type(r6, &(0x7f0000000340)='threaded\x00', 0xffffffc5)
getsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000040)={@loopback}, &(0x7f0000000080)=0x14)
write$binfmt_aout(r6, &(0x7f0000000980)=ANY=[@ANYBLOB="0f0108830c0200004b020000080000003b00000085c4ffff0000000000000000e76b6750f8680a74d72715455c69ec8e11b3ef5210482e6cb972ab2bdb2a8352b139976e9ed2a322319fe7f500d99a2d522cb2e2c6bd826045d2d54d821d442200925039d10b74e93b985e8dc4371b47e3bc7fa70265c2bbe4e83d007b82ae65ebce6c3c30047731732b342724ac4c23fa867bab3254d803f11caaf23a66ca9f534d691e5c45687ca06b71037bd407480d0f7cc20d119044d26950ca3ef23cb4b16d3561ba0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002105dd8a861a460f000000000000000000000000000000000000000000000000000000000000000000000000efffffff000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000001f000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003091c2d3bc89196444dd00000000000c981f635849909129002b5afa0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbff0000000000000000000000000000000000000000000000000000ffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e549da8191910eaa523596d17ecb699528e30362ae5f716235ee29f2fbe8797cf96ab130774a2ef060d6a3d48fbef5e553645ebbd6afaff7c531e27fafdda3b3824abb5057682a53ab9c3a2df9da27899f535e38f6a0b38bd9142fc9e6ed7b74589866709d87f00cca04d1b56379bd3c2573995166ccac353f7a25820e7692d49b16e3c5153fcfe9187b45bc546002cabc7b601321160fef23"], 0x375)
ioctl$EXT4_IOC_MIGRATE(r7, 0x6609)
ioctl$void(r0, 0xc0045c79)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r7, 0x660c)

08:41:01 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:01 executing program 2:

08:41:01 executing program 3:

08:41:02 executing program 2:

08:41:02 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:41:02 executing program 3:

08:41:02 executing program 2:

08:41:02 executing program 3:

08:41:02 executing program 1:

08:41:02 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:02 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)

08:41:02 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/syz1\x00', 0x200002, 0x0)
pipe(&(0x7f0000000000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
write(r2, &(0x7f00000001c0), 0xfffffef3)
read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3)
ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x11)
io_setup(0x7, &(0x7f00000005c0))
io_submit(0x0, 0x0, 0x0)
lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480))
lstat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540))
r3 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c)
connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c)
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={<r4=>0x0, @multicast1, @broadcast}, &(0x7f0000000300)=0xc)
recvfrom$packet(r1, &(0x7f0000000140)=""/167, 0xa7, 0x101, &(0x7f0000000340)={0x11, 0x1, r4, 0x1, 0x7ff, 0x6, @dev={[], 0x1e}}, 0x14)
sendmmsg(r3, &(0x7f0000000600), 0x0, 0x0)
setsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0)
io_setup(0x0, &(0x7f00000000c0)=<r5=>0x0)
io_cancel(r5, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f0000000180)="d9f86abdd33cdf4d2fb8ef68481b20e5", 0x10, 0xcda, 0x0, 0x2}, 0x0)
r6 = creat(&(0x7f0000000700)='./bus\x00', 0x0)
r7 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
ioctl$EXT4_IOC_SETFLAGS(r7, 0x40086602, &(0x7f00000001c0)=0x1)
write$cgroup_type(r6, &(0x7f0000000340)='threaded\x00', 0xffffffc5)
getsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000040)={@loopback}, &(0x7f0000000080)=0x14)
write$binfmt_aout(r6, &(0x7f0000000980)=ANY=[@ANYBLOB="0f0108830c0200004b020000080000003b00000085c4ffff0000000000000000e76b6750f8680a74d72715455c69ec8e11b3ef5210482e6cb972ab2bdb2a8352b139976e9ed2a322319fe7f500d99a2d522cb2e2c6bd826045d2d54d821d442200925039d10b74e93b985e8dc4371b47e3bc7fa70265c2bbe4e83d007b82ae65ebce6c3c30047731732b342724ac4c23fa867bab3254d803f11caaf23a66ca9f534d691e5c45687ca06b71037bd407480d0f7cc20d119044d26950ca3ef23cb4b16d3561ba0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002105dd8a861a460f000000000000000000000000000000000000000000000000000000000000000000000000efffffff000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000001f000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003091c2d3bc89196444dd00000000000c981f635849909129002b5afa0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbff0000000000000000000000000000000000000000000000000000ffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e549da8191910eaa523596d17ecb699528e30362ae5f716235ee29f2fbe8797cf96ab130774a2ef060d6a3d48fbef5e553645ebbd6afaff7c531e27fafdda3b3824abb5057682a53ab9c3a2df9da27899f535e38f6a0b38bd9142fc9e6ed7b74589866709d87f00cca04d1b56379bd3c2573995166ccac353f7a25820e7692d49b16e3c5153fcfe9187b45bc546002cabc7b601321160fef23"], 0x375)
ioctl$EXT4_IOC_MIGRATE(r7, 0x6609)
ioctl$void(r0, 0xc0045c79)
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r7, 0x660c)

08:41:02 executing program 2:

08:41:02 executing program 3:

08:41:02 executing program 1:

[  216.332530] binder: 8920:8921 Acquire 1 refcount change on invalid ref 0 ret -22
[  216.344074] binder_thread_write: 1 callbacks suppressed
[  216.344087] binder: 8920:8921 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[  216.362063] binder: 8920:8921 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:41:02 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:02 executing program 1:

08:41:02 executing program 3:

08:41:02 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0)
ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0)

08:41:02 executing program 2:

[  216.543328] binder: 8937:8943 Acquire 1 refcount change on invalid ref 0 ret -22
[  216.561119] binder: 8937:8943 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
08:41:02 executing program 3:

08:41:02 executing program 1:

08:41:02 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

[  216.598587] binder: 8937:8943 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
[  216.707864] binder: 8954:8955 Acquire 1 refcount change on invalid ref 0 ret -22
[  216.724891] binder: 8954:8955 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[  216.732721] binder: 8954:8955 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:41:03 executing program 0:

08:41:03 executing program 2:

08:41:03 executing program 4:

08:41:03 executing program 1:

08:41:03 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:03 executing program 3:

08:41:03 executing program 4:

[  216.983949] binder: 8962:8964 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:41:03 executing program 3:

08:41:03 executing program 1:

08:41:03 executing program 2:

08:41:03 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:03 executing program 0:

08:41:03 executing program 4:

08:41:03 executing program 1:

08:41:03 executing program 2:

08:41:03 executing program 3:

[  217.191936] binder: 8977:8979 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:41:03 executing program 4:

08:41:03 executing program 0:

08:41:03 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:03 executing program 2:

08:41:03 executing program 1:

08:41:03 executing program 3:

08:41:03 executing program 0:

08:41:03 executing program 3:

[  217.440873] binder: 8992:8993 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:41:03 executing program 4:

08:41:03 executing program 2:

08:41:03 executing program 1:

08:41:03 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:03 executing program 0:

08:41:03 executing program 3:

08:41:03 executing program 4:

08:41:03 executing program 1:

08:41:03 executing program 2:

[  217.665596] binder: 9013:9014 ioctl c0306201 0 returned -14
08:41:03 executing program 0:

[  217.730856] binder: 9013:9021 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
08:41:03 executing program 2:

08:41:03 executing program 4:

08:41:04 executing program 3:

08:41:04 executing program 1:

08:41:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:04 executing program 0:

08:41:04 executing program 2:

08:41:04 executing program 4:

08:41:04 executing program 1:

08:41:04 executing program 3:

08:41:04 executing program 0:

[  218.031219] binder: 9038:9041 ioctl c0306201 0 returned -14
08:41:04 executing program 2:

08:41:04 executing program 4:

08:41:04 executing program 3:

08:41:04 executing program 1:

08:41:04 executing program 0:

08:41:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:04 executing program 3:

08:41:04 executing program 0:

08:41:04 executing program 4:

08:41:04 executing program 1:

08:41:04 executing program 2:

[  218.280635] binder: 9061:9062 ioctl c0306201 0 returned -14
08:41:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:04 executing program 4:

08:41:04 executing program 1:

08:41:04 executing program 3:

08:41:04 executing program 0:

08:41:04 executing program 2:

08:41:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:04 executing program 4:

08:41:04 executing program 3:

08:41:04 executing program 1:

08:41:04 executing program 2:

08:41:04 executing program 0:

08:41:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:04 executing program 4:

08:41:04 executing program 1:

08:41:04 executing program 2:

08:41:04 executing program 0:

08:41:05 executing program 3:

08:41:05 executing program 4:

08:41:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:05 executing program 1:

08:41:05 executing program 3:

08:41:05 executing program 0:

08:41:05 executing program 4:
mkdir(&(0x7f0000027000)='./file0\x00', 0x0)
clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
mount(&(0x7f0000000040)=@nullb='.d::d:/llb:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x0, 0x0)

08:41:05 executing program 2:

[  219.008470] binder: 9115:9117 BC_CLEAR_DEATH_NOTIFICATION death notification not active
08:41:05 executing program 3:

08:41:05 executing program 1:

08:41:05 executing program 0:

[  219.121925] libceph: parse_ips bad ip '.d::d'
08:41:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

[  219.172714] libceph: parse_ips bad ip '.d::d'
08:41:05 executing program 3:

08:41:05 executing program 2:

08:41:05 executing program 0:

08:41:05 executing program 4:

08:41:05 executing program 1:

[  219.309753] binder: 9138:9139 BC_CLEAR_DEATH_NOTIFICATION death notification not active
08:41:05 executing program 3:

08:41:05 executing program 2:

08:41:05 executing program 4:

08:41:05 executing program 0:

08:41:05 executing program 1:

08:41:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:05 executing program 2:

08:41:05 executing program 4:

08:41:05 executing program 3:

08:41:05 executing program 0:
socketpair$unix(0x1, 0x80003, 0x0, &(0x7f0000000200)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
shmctl$SHM_INFO(0x0, 0xe, &(0x7f00000002c0)=""/4096)

[  219.571938] binder: 9160:9162 BC_CLEAR_DEATH_NOTIFICATION death notification not active
08:41:05 executing program 1:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000011000)={0x1, 0x2, 0x81, 0x20000000000001, 0x0, 0x0}, 0x2c)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r0, &(0x7f0000000040), 0x0}, 0x18)

08:41:05 executing program 2:

08:41:05 executing program 4:

08:41:05 executing program 0:

08:41:05 executing program 4:

08:41:05 executing program 3:

08:41:05 executing program 2:

08:41:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:06 executing program 1:

08:41:06 executing program 0:

08:41:06 executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0xffffffffffffffc2, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
mprotect(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)

08:41:06 executing program 3:
openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
pread64(0xffffffffffffffff, 0x0, 0x0, 0x0)
setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a})
r2 = socket$nl_route(0x10, 0x3, 0x0)
pread64(r1, &(0x7f0000000480)=""/39, 0x27, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0)
dup2(r0, r1)

08:41:06 executing program 2:

08:41:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:06 executing program 1:

[  220.080495] ==================================================================
[  220.088035] BUG: KASAN: slab-out-of-bounds in fpstate_init+0x50/0x160
[  220.094629] Write of size 832 at addr ffff8881be44abc0 by task syz-executor4/9205
[  220.102254] 
[  220.103893] CPU: 0 PID: 9205 Comm: syz-executor4 Not tainted 4.20.0-rc6-next-20181217+ #172
[  220.112380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  220.121732] Call Trace:
[  220.124332]  dump_stack+0x244/0x39d
[  220.125328] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  220.127976]  ? dump_stack_print_info.cold.1+0x20/0x20
[  220.127993]  ? printk+0xa7/0xcf
[  220.128009]  ? kmsg_dump_rewind_nolock+0xe4/0xe4
[  220.128032]  print_address_description.cold.4+0x9/0x1ff
[  220.148926] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  220.153130]  ? fpstate_init+0x50/0x160
[  220.153148]  kasan_report.cold.5+0x1b/0x39
[  220.153161]  ? fpstate_init+0x50/0x160
[  220.153180]  ? fpstate_init+0x50/0x160
[  220.153196]  check_memory_region+0x13e/0x1b0
[  220.153212]  memset+0x23/0x40
[  220.183075]  fpstate_init+0x50/0x160
[  220.186818]  kvm_arch_vcpu_init+0x3e9/0x870
[  220.191154]  kvm_vcpu_init+0x2fa/0x420
[  220.195052]  ? vcpu_stat_get+0x300/0x300
[  220.199118]  ? kmem_cache_alloc+0x33f/0x730
[  220.203472]  vmx_create_vcpu+0x1b7/0x2695
[  220.207637]  ? _raw_spin_unlock_irqrestore+0x82/0xd0
[  220.212747]  ? lockdep_hardirqs_on+0x3bb/0x5b0
[  220.217371]  ? preempt_schedule+0x4d/0x60
[  220.221533]  ? preempt_schedule_common+0x1f/0xe0
[  220.226299]  ? vmx_exec_control+0x210/0x210
[  220.230632]  ? ___preempt_schedule+0x16/0x18
[  220.235048]  ? kasan_check_write+0x14/0x20
[  220.239288]  ? __mutex_unlock_slowpath+0x197/0x8c0
[  220.244230]  ? wait_for_completion+0x8a0/0x8a0
[  220.248848]  ? print_usage_bug+0xc0/0xc0
[  220.252926]  ? migrate_swap_stop+0x8a0/0x8a0
[  220.257349]  kvm_arch_vcpu_create+0xe5/0x220
[  220.261772]  ? kvm_arch_vcpu_free+0x90/0x90
[  220.266134]  kvm_vm_ioctl+0x526/0x2030
[  220.270042]  ? kvm_unregister_device_ops+0x70/0x70
[  220.272980] binder: 9214:9215 ioctl c0306201 0 returned -14
08:41:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000000c0)=[@release={0x400c630f}], 0x0, 0x0, 0x0})

08:41:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

08:41:06 executing program 0:

08:41:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000040)=[@enter_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x10, 0x0, &(0x7f0000005fd4)=[@acquire, @acquire={0x400c630e}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

08:41:06 executing program 1:

[  220.274987]  ? mark_held_locks+0x130/0x130
[  220.275009]  ? __sanitizer_cov_trace_switch+0x53/0x90
[  220.275045]  ? drop_futex_key_refs.isra.14+0x6d/0xe0
[  220.275064]  ? futex_wake+0x304/0x760
[  220.299087]  ? __lock_acquire+0x62f/0x4c20
[  220.303350]  ? mark_held_locks+0x130/0x130
[  220.307595]  ? graph_lock+0x270/0x270
[  220.311401]  ? do_futex+0x249/0x26d0
[  220.315121]  ? rcu_read_unlock_special+0x370/0x370
[  220.320094]  ? rcu_softirq_qs+0x20/0x20
[  220.324079]  ? unwind_dump+0x190/0x190
[  220.327995]  ? find_held_lock+0x36/0x1c0
[  220.332073]  ? __fget+0x4aa/0x740
[  220.335592]  ? lock_downgrade+0x900/0x900
[  220.339792]  ? check_preemption_disabled+0x48/0x280
[  220.344823]  ? kasan_check_read+0x11/0x20
[  220.348982]  ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170
[  220.354270]  ? rcu_read_unlock_special+0x370/0x370
[  220.359219]  ? __fget+0x4d1/0x740
[  220.362694]  ? ksys_dup3+0x680/0x680
[  220.366426]  ? __might_fault+0x12b/0x1e0
[  220.370520]  ? lock_downgrade+0x900/0x900
[  220.374684]  ? lock_release+0xa00/0xa00
08:41:06 executing program 1:

[  220.379132]  ? perf_trace_sched_process_exec+0x860/0x860
[  220.384599]  ? kvm_unregister_device_ops+0x70/0x70
[  220.389541]  do_vfs_ioctl+0x1de/0x1790
[  220.393461]  ? ioctl_preallocate+0x300/0x300
[  220.397882]  ? __fget_light+0x2e9/0x430
[  220.401871]  ? fget_raw+0x20/0x20
[  220.405333]  ? _copy_to_user+0xc8/0x110
[  220.409327]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  220.414894]  ? put_timespec64+0x10f/0x1b0
[  220.419070]  ? nsecs_to_jiffies+0x30/0x30
[  220.423243]  ? do_syscall_64+0x9a/0x820
[  220.427248]  ? do_syscall_64+0x9a/0x820
[  220.431250]  ? lockdep_hardirqs_on+0x3bb/0x5b0
[  220.435846]  ? security_file_ioctl+0x94/0xc0
[  220.440297]  ksys_ioctl+0xa9/0xd0
[  220.443779]  __x64_sys_ioctl+0x73/0xb0
[  220.447675]  do_syscall_64+0x1b9/0x820
[  220.451590]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  220.451608]  ? syscall_return_slowpath+0x5e0/0x5e0
[  220.451621]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  220.451640]  ? trace_hardirqs_on_caller+0x310/0x310
[  220.451657]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  220.451675]  ? prepare_exit_to_usermode+0x291/0x3b0
[  220.451693]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  220.451714]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  220.451724] RIP: 0033:0x457669
[  220.451738] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  220.451744] RSP: 002b:00007fa814050c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  220.451756] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457669
[  220.451762] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000004
[  220.451769] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  220.451777] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa8140516d4
[  220.458095] kobject: 'loop0' (000000000d8fcf0c): fill_kobj_path: path = '/devices/virtual/block/loop0'
[  220.462187] R13: 00000000004c00ff R14: 00000000004d1170 R15: 00000000ffffffff
[  220.462210] 
[  220.462218] Allocated by task 9205:
[  220.462234]  save_stack+0x43/0xd0
[  220.462247]  kasan_kmalloc+0xcb/0xd0
[  220.462258]  kasan_slab_alloc+0x12/0x20
[  220.462273]  kmem_cache_alloc+0x130/0x730
[  220.462287]  vmx_create_vcpu+0x110/0x2695
[  220.462305]  kvm_arch_vcpu_create+0xe5/0x220
[  220.468032] kobject: 'loop5' (00000000d65d890b): kobject_uevent_env
[  220.472153]  kvm_vm_ioctl+0x526/0x2030
[  220.472167]  do_vfs_ioctl+0x1de/0x1790
[  220.472180]  ksys_ioctl+0xa9/0xd0
[  220.472194]  __x64_sys_ioctl+0x73/0xb0
[  220.472208]  do_syscall_64+0x1b9/0x820
[  220.472223]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  220.472227] 
[  220.472233] Freed by task 0:
[  220.472237] (stack is not available)
[  220.472240] 
[  220.472256] The buggy address belongs to the object at ffff8881be44ab80
[  220.472256]  which belongs to the cache x86_fpu of size 832
[  220.478078] kobject: 'loop5' (00000000d65d890b): fill_kobj_path: path = '/devices/virtual/block/loop5'
[  220.482737] The buggy address is located 64 bytes inside of
[  220.482737]  832-byte region [ffff8881be44ab80, ffff8881be44aec0)
[  220.482742] The buggy address belongs to the page:
[  220.482756] page:ffffea0006f91280 count:1 mapcount:0 mapping:ffff8881d5137ac0 index:0x0
[  220.482767] flags: 0x2fffc0000000200(slab)
[  220.482788] raw: 02fffc0000000200 ffff8881d513fe48 ffff8881d513fe48 ffff8881d5137ac0
[  220.482804] raw: 0000000000000000 ffff8881be44a040 0000000100000004 0000000000000000
[  220.482810] page dumped because: kasan: bad access detected
[  220.482814] 
[  220.482818] Memory state around the buggy address:
[  220.482830]  ffff8881be44ad80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  220.482846]  ffff8881be44ae00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  220.488602] kobject: 'loop1' (00000000eb7de275): kobject_uevent_env
[  220.492878] >ffff8881be44ae80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[  220.492885]                                            ^
[  220.492894]  ffff8881be44af00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  220.492905]  ffff8881be44af80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  220.492910] ==================================================================
[  220.492915] Disabling lock debugging due to kernel taint
[  220.512688] Kernel panic - not syncing: panic_on_warn set ...
[  220.526204] kobject: 'loop1' (00000000eb7de275): fill_kobj_path: path = '/devices/virtual/block/loop1'
[  220.530581] CPU: 0 PID: 9205 Comm: syz-executor4 Tainted: G    B             4.20.0-rc6-next-20181217+ #172
[  220.530589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  220.530595] Call Trace:
[  220.530615]  dump_stack+0x244/0x39d
[  220.530633]  ? dump_stack_print_info.cold.1+0x20/0x20
[  220.538476] kobject: 'loop5' (00000000d65d890b): kobject_uevent_env
[  220.545169]  ? fpstate_init+0x30/0x160
[  220.545202]  panic+0x2ad/0x632
[  220.545217]  ? add_taint.cold.5+0x16/0x16
[  220.545238]  ? preempt_schedule+0x4d/0x60
[  220.552679] kobject: 'loop5' (00000000d65d890b): fill_kobj_path: path = '/devices/virtual/block/loop5'
[  220.561957]  ? ___preempt_schedule+0x16/0x18
[  220.561975]  ? trace_hardirqs_on+0xb4/0x310
[  220.561991]  ? fpstate_init+0x50/0x160
[  220.562008]  end_report+0x47/0x4f
[  220.569918] kobject: 'loop1' (00000000eb7de275): kobject_uevent_env
[  220.570887]  kasan_report.cold.5+0xe/0x39
[  220.570901]  ? fpstate_init+0x50/0x160
[  220.570919]  ? fpstate_init+0x50/0x160
[  220.574727] kobject: 'loop1' (00000000eb7de275): fill_kobj_path: path = '/devices/virtual/block/loop1'
[  220.577981]  check_memory_region+0x13e/0x1b0
[  220.577995]  memset+0x23/0x40
[  220.578013]  fpstate_init+0x50/0x160
[  220.586376] kobject: 'loop2' (00000000d9d5acb0): kobject_uevent_env
[  220.589930]  kvm_arch_vcpu_init+0x3e9/0x870
[  220.589951]  kvm_vcpu_init+0x2fa/0x420
[  220.589966]  ? vcpu_stat_get+0x300/0x300
[  220.589987]  ? kmem_cache_alloc+0x33f/0x730
[  220.594287] kobject: 'loop2' (00000000d9d5acb0): fill_kobj_path: path = '/devices/virtual/block/loop2'
[  220.598542]  vmx_create_vcpu+0x1b7/0x2695
[  220.598565]  ? _raw_spin_unlock_irqrestore+0x82/0xd0
[  220.605544] kobject: 'loop0' (000000000d8fcf0c): kobject_uevent_env
[  220.608828]  ? lockdep_hardirqs_on+0x3bb/0x5b0
[  220.608846]  ? preempt_schedule+0x4d/0x60
[  220.608866]  ? preempt_schedule_common+0x1f/0xe0
[  220.612907] kobject: 'loop0' (000000000d8fcf0c): fill_kobj_path: path = '/devices/virtual/block/loop0'
[  220.616220]  ? vmx_exec_control+0x210/0x210
[  220.616236]  ? ___preempt_schedule+0x16/0x18
[  220.616268]  ? kasan_check_write+0x14/0x20
[  220.995110]  ? __mutex_unlock_slowpath+0x197/0x8c0
[  221.000054]  ? wait_for_completion+0x8a0/0x8a0
[  221.004653]  ? print_usage_bug+0xc0/0xc0
[  221.008735]  ? migrate_swap_stop+0x8a0/0x8a0
[  221.013153]  kvm_arch_vcpu_create+0xe5/0x220
[  221.017563]  ? kvm_arch_vcpu_free+0x90/0x90
[  221.021890]  kvm_vm_ioctl+0x526/0x2030
[  221.025795]  ? kvm_unregister_device_ops+0x70/0x70
[  221.030730]  ? mark_held_locks+0x130/0x130
[  221.034984]  ? __sanitizer_cov_trace_switch+0x53/0x90
[  221.040182]  ? drop_futex_key_refs.isra.14+0x6d/0xe0
[  221.045279]  ? futex_wake+0x304/0x760
[  221.049082]  ? __lock_acquire+0x62f/0x4c20
[  221.053330]  ? mark_held_locks+0x130/0x130
[  221.057562]  ? graph_lock+0x270/0x270
[  221.061356]  ? do_futex+0x249/0x26d0
[  221.065066]  ? rcu_read_unlock_special+0x370/0x370
[  221.069993]  ? rcu_softirq_qs+0x20/0x20
[  221.073961]  ? unwind_dump+0x190/0x190
[  221.077853]  ? find_held_lock+0x36/0x1c0
[  221.081928]  ? __fget+0x4aa/0x740
[  221.085379]  ? lock_downgrade+0x900/0x900
[  221.089526]  ? check_preemption_disabled+0x48/0x280
[  221.094553]  ? kasan_check_read+0x11/0x20
[  221.098701]  ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170
[  221.103978]  ? rcu_read_unlock_special+0x370/0x370
[  221.108911]  ? __fget+0x4d1/0x740
[  221.112367]  ? ksys_dup3+0x680/0x680
[  221.116112]  ? __might_fault+0x12b/0x1e0
[  221.120176]  ? lock_downgrade+0x900/0x900
[  221.124323]  ? lock_release+0xa00/0xa00
[  221.128294]  ? perf_trace_sched_process_exec+0x860/0x860
[  221.133769]  ? kvm_unregister_device_ops+0x70/0x70
[  221.138697]  do_vfs_ioctl+0x1de/0x1790
[  221.142595]  ? ioctl_preallocate+0x300/0x300
[  221.147002]  ? __fget_light+0x2e9/0x430
[  221.151004]  ? fget_raw+0x20/0x20
[  221.154465]  ? _copy_to_user+0xc8/0x110
[  221.158439]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  221.164021]  ? put_timespec64+0x10f/0x1b0
[  221.168186]  ? nsecs_to_jiffies+0x30/0x30
[  221.172333]  ? do_syscall_64+0x9a/0x820
[  221.176310]  ? do_syscall_64+0x9a/0x820
[  221.180280]  ? lockdep_hardirqs_on+0x3bb/0x5b0
[  221.184862]  ? security_file_ioctl+0x94/0xc0
[  221.189270]  ksys_ioctl+0xa9/0xd0
[  221.192810]  __x64_sys_ioctl+0x73/0xb0
[  221.196702]  do_syscall_64+0x1b9/0x820
[  221.200603]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
[  221.206009]  ? syscall_return_slowpath+0x5e0/0x5e0
[  221.210938]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  221.215788]  ? trace_hardirqs_on_caller+0x310/0x310
[  221.220802]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  221.225820]  ? prepare_exit_to_usermode+0x291/0x3b0
[  221.230838]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[  221.235682]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  221.240868] RIP: 0033:0x457669
[  221.244059] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  221.262967] RSP: 002b:00007fa814050c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  221.270689] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457669
[  221.277953] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000004
[  221.285217] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
[  221.292487] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa8140516d4
[  221.299752] R13: 00000000004c00ff R14: 00000000004d1170 R15: 00000000ffffffff
[  221.308094] Kernel Offset: disabled
[  221.311722] Rebooting in 86400 seconds..