fff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:09 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x0, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:09 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:09 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:09 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:09 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x0, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:09 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x0, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x0, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(0x0, r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(0x0, r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(0x0, r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), 0xffffffffffffffff) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), 0xffffffffffffffff) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), 0xffffffffffffffff) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, 0x0, 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, 0x0, 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, 0x0, 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8, 0x1, r11}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8, 0x1, r11}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r1) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(0x0, r1) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(0x0, r1) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8, 0x1, r11}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(0x0, r1) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), 0xffffffffffffffff) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), 0xffffffffffffffff) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) 22:23:10 executing program 0: ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x9, 0x5, 0xa}) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000140)={0x10001, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000180)={0x2, r0, 0x2, 0x5, 0x7fffffff, 0x1}) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r2 = socket(0x2b, 0x1, 0x1) syz_genetlink_get_family_id$fou(&(0x7f0000000240), r2) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000280), 0x80000, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), 0xffffffffffffffff) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8, 0x1, r11}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8, 0x1, r11}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:10 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8, 0x1, r11}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:10 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:10 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r7}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:10 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8, 0x1, r11}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:11 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8, 0x1, r11}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r7}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 3: mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:11 executing program 1: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:11 executing program 1: r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x400, 0x0) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:11 executing program 3: mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x50, 0xffffffffffffffff, 0x10000000) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8, 0x1, r11}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r7}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 3: mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x10000000) 22:23:11 executing program 1: r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x400, 0x0) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:11 executing program 1: r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x400, 0x0) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8, 0x1, r11}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) 22:23:11 executing program 1: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:11 executing program 1: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) 22:23:11 executing program 1: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) 22:23:11 executing program 1: openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8, 0x1, r11}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:11 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8, 0x1, r11}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={0x0, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={0x0, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={0x0, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:11 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) 22:23:11 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) 22:23:11 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:11 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), 0xffffffffffffffff) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, r9, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:11 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:11 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), 0xffffffffffffffff) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:11 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), 0xffffffffffffffff) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', 0x0, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', 0x0, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', 0x0, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={0x0, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={0x0, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={0x0, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:12 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:12 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:12 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r4, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r4, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) [ 76.412222][ T48] cfg80211: failed to load regulatory.db 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', 0x0, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', 0x0, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) geteuid() r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', 0x0, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, 0xffffffffffffffff, 0x47, '\x00', r1, 0xffffffffffffffff, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r1, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000880)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r1}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, 0xffffffffffffffff, 0x47, '\x00', r1, 0xffffffffffffffff, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r1, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000880)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r1}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r4, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, 0xffffffffffffffff, 0x47, '\x00', r1, 0xffffffffffffffff, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r1, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000880)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r1}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r4, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', 0x0, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', 0x0, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', 0x0, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', 0x0, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', 0x0, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:13 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, 0xffffffffffffffff, 0x47, '\x00', r1, 0xffffffffffffffff, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:13 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r1, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r0, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r0, 0x0, &(0x7f0000000880)=[r0, r0, r0]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r1}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:13 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:13 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', 0x0, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, 0xffffffffffffffff, 0x47, '\x00', r1, 0xffffffffffffffff, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r1, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r0, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r0, 0x0, &(0x7f0000000880)=[r0, r0, r0]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r1}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, 0xffffffffffffffff, 0x47, '\x00', r1, 0xffffffffffffffff, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000880)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, 0xffffffffffffffff, 0x47, '\x00', r1, 0xffffffffffffffff, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, 0xffffffffffffffff, 0x47, '\x00', r1, 0xffffffffffffffff, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000880)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r4, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r1, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r0, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r0, 0x0, &(0x7f0000000880)=[r0, r0, r0]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r1}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r4, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, 0xffffffffffffffff, 0x47, '\x00', r1, 0xffffffffffffffff, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000880)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={0xffffffffffffffff, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r1, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r0, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r0, 0x0, &(0x7f0000000880)=[r0, r0, r0]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r1}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r4, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={0xffffffffffffffff, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r1, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r0, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r0, 0x0, &(0x7f0000000880)=[r0, r0, r0]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r1}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={0xffffffffffffffff, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r1, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r4, 0x10, r0, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r0, 0x0, &(0x7f0000000880)=[r0, r0, r0]}, 0x80) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r5, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r7, 0xc02064a5, &(0x7f0000000bc0)={r6, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r5) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r4, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r4, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r1}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r8}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r0, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r0, 0x0, &(0x7f0000000880)=[r0, r0, r0]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r0, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r0, 0x0, &(0x7f0000000880)=[r0, r0, r0]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r0, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r0, 0x0, &(0x7f0000000880)=[r0, r0, r0]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={0xffffffffffffffff, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r0, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r0, 0x0, &(0x7f0000000880)=[r0, r0, r0]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={0xffffffffffffffff, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r0, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r0, 0x0, &(0x7f0000000880)=[r0, r0, r0]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(0x0, 0x6) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={0xffffffffffffffff, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r3}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r0, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r0, 0x0, &(0x7f0000000880)=[r0, r0, r0]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(0x0, 0x6) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(0x0, 0x6) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, 0x0, 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x0, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x0, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:14 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:14 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, 0x0, 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:14 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:15 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x0, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:15 executing program 1: openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:15 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, 0x0, 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:15 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:15 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x0) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:15 executing program 1: openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:15 executing program 1: openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:15 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x400, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:15 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:15 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:15 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x0) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:15 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:15 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:15 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:15 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x0) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:15 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getpeername$packet(r0, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:15 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:15 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) r2 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r2}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', r1, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r3, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:15 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:15 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(0x0, 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:15 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, &(0x7f0000000180), 0x0, 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:15 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f0000000380)) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', 0x0, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r2, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:15 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(0x0, 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:15 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x0, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:15 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, &(0x7f0000000180), 0x0, 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:15 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x0, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:15 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f0000000380)) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', 0x0, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r2, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:15 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, &(0x7f0000000180), 0x0, 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:15 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(0x0, 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:15 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x0, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:15 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:15 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', 0x0, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r2, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:15 executing program 0: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mount$binderfs(0x0, 0x0, &(0x7f0000000180), 0x0, 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x400, 0x0) openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', 0x0, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) 22:23:15 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x0) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) 22:23:15 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:15 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', 0x0, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r2, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) 22:23:15 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x0) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) [ 78.679998][T11366] ================================================================== [ 78.682912][T11366] BUG: KASAN: slab-use-after-free in nfc_llcp_find_local+0xcf/0xe0 [ 78.686006][T11366] Read of size 8 at addr ffff88801ce12000 by task syz-executor.0/11366 [ 78.688965][T11366] [ 78.689833][T11366] CPU: 1 PID: 11366 Comm: syz-executor.0 Not tainted 6.4.0-rc7-syzkaller-00072-gdad9774deaf1 #0 [ 78.693572][T11366] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 78.697790][T11366] Call Trace: [ 78.699767][T11366] [ 78.700862][T11366] dump_stack_lvl+0xd9/0x150 [ 78.702594][T11366] print_address_description.constprop.0+0x2c/0x3c0 [ 78.705227][T11366] ? nfc_llcp_find_local+0xcf/0xe0 [ 78.707190][T11366] kasan_report+0x11c/0x130 [ 78.708910][T11366] ? nfc_llcp_find_local+0xcf/0xe0 [ 78.710812][T11366] nfc_llcp_find_local+0xcf/0xe0 [ 78.712775][T11366] nfc_llcp_unregister_device+0x1a/0x260 [ 78.714912][T11366] nfc_unregister_device+0x196/0x330 [ 78.716941][T11366] virtual_ncidev_close+0x52/0xb0 [ 78.718846][T11366] __fput+0x27c/0xa90 [ 78.720412][T11366] ? virtual_nci_open+0x10/0x10 [ 78.722286][T11366] task_work_run+0x16f/0x270 [ 78.724132][T11366] ? task_work_cancel+0x30/0x30 [ 78.725940][T11366] exit_to_user_mode_prepare+0x210/0x240 [ 78.728151][T11366] syscall_exit_to_user_mode+0x1d/0x50 [ 78.730263][T11366] do_syscall_64+0x46/0xb0 [ 78.732151][T11366] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 78.734273][T11366] RIP: 0033:0x7f1d9fa3e12b [ 78.735886][T11366] Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 [ 78.742735][T11366] RSP: 002b:00007ffda8ba0f70 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 78.745712][T11366] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f1d9fa3e12b [ 78.748536][T11366] RDX: 00007f1d9f6014d0 RSI: ffffffffffffffff RDI: 0000000000000003 [ 78.751416][T11366] RBP: 00007f1d9fbad980 R08: 0000000000000000 R09: 00007f1d9f600000 [ 78.754401][T11366] R10: 00007f1d9f6014d8 R11: 0000000000000293 R12: 00000000000132b9 [ 78.757228][T11366] R13: 00007ffda8ba1070 R14: 00007f1d9fbabf80 R15: 0000000000000032 [ 78.760098][T11366] [ 78.761269][T11366] [ 78.762182][T11366] Allocated by task 11381: [ 78.763858][T11366] kasan_save_stack+0x22/0x40 [ 78.765662][T11366] kasan_set_track+0x25/0x30 [ 78.767444][T11366] __kasan_kmalloc+0xa3/0xb0 [ 78.769244][T11366] nfc_llcp_register_device+0x49/0x9e0 [ 78.771413][T11366] nfc_register_device+0x70/0x3c0 [ 78.773328][T11366] nci_register_device+0x7cb/0xb50 [ 78.775426][T11366] virtual_ncidev_open+0x14f/0x230 [ 78.777396][T11366] misc_open+0x37a/0x4a0 [ 78.779091][T11366] chrdev_open+0x26a/0x770 [ 78.780767][T11366] do_dentry_open+0x6cc/0x13f0 [ 78.782625][T11366] path_openat+0x1baa/0x2750 [ 78.784405][T11366] do_filp_open+0x1ba/0x410 [ 78.786155][T11366] do_sys_openat2+0x16d/0x4c0 [ 78.788047][T11366] __x64_sys_openat+0x143/0x1f0 [ 78.789923][T11366] do_syscall_64+0x39/0xb0 [ 78.791708][T11366] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 78.793982][T11366] [ 78.794923][T11366] Freed by task 11379: [ 78.796468][T11366] kasan_save_stack+0x22/0x40 [ 78.798301][T11366] kasan_set_track+0x25/0x30 [ 78.800062][T11366] kasan_save_free_info+0x2b/0x40 [ 78.802003][T11366] ____kasan_slab_free+0x13b/0x1a0 [ 78.804029][T11366] __kmem_cache_free+0xcd/0x2c0 [ 78.805999][T11366] nfc_llcp_unregister_device+0x1ba/0x260 [ 78.808160][T11366] nfc_unregister_device+0x196/0x330 22:23:15 executing program 1: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x0) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x6) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', 0x0, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000d00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x30, 0x0, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {}, {0x14, 0x18, {0x8, @bearer=@udp='udp:syz0\x00'}}}, ["", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', 0x0, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) [ 78.810154][T11366] virtual_ncidev_close+0x52/0xb0 [ 78.812169][T11366] __fput+0x27c/0xa90 [ 78.813609][T11366] task_work_run+0x16f/0x270 [ 78.815288][T11366] exit_to_user_mode_prepare+0x210/0x240 [ 78.817305][T11366] syscall_exit_to_user_mode+0x1d/0x50 [ 78.819293][T11366] do_syscall_64+0x46/0xb0 [ 78.820886][T11366] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 78.823000][T11366] [ 78.823852][T11366] Last potentially related work creation: [ 78.825874][T11366] kasan_save_stack+0x22/0x40 [ 78.827570][T11366] __kasan_record_aux_stack+0x7b/0x90 [ 78.829504][T11366] insert_work+0x48/0x360 [ 78.831073][T11366] __queue_work+0x625/0x1120 [ 78.832741][T11366] queue_work_on+0xf2/0x110 [ 78.834372][T11366] rfkill_register+0x67c/0xb00 [ 78.836109][T11366] nfc_register_device+0x124/0x3c0 [ 78.837979][T11366] nci_register_device+0x7cb/0xb50 [ 78.839799][T11366] virtual_ncidev_open+0x14f/0x230 [ 78.841622][T11366] misc_open+0x37a/0x4a0 [ 78.843152][T11366] chrdev_open+0x26a/0x770 [ 78.844744][T11366] do_dentry_open+0x6cc/0x13f0 [ 78.846457][T11366] path_openat+0x1baa/0x2750 [ 78.848151][T11366] do_filp_open+0x1ba/0x410 [ 78.849764][T11366] do_sys_openat2+0x16d/0x4c0 [ 78.851466][T11366] __x64_sys_openat+0x143/0x1f0 [ 78.853194][T11366] do_syscall_64+0x39/0xb0 [ 78.854775][T11366] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 78.856879][T11366] [ 78.857734][T11366] The buggy address belongs to the object at ffff88801ce12000 [ 78.857734][T11366] which belongs to the cache kmalloc-2k of size 2048 [ 78.862730][T11366] The buggy address is located 0 bytes inside of [ 78.862730][T11366] freed 2048-byte region [ffff88801ce12000, ffff88801ce12800) [ 78.867717][T11366] [ 78.868631][T11366] The buggy address belongs to the physical page: [ 78.871004][T11366] page:ffffea0000738480 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ce12 [ 78.874694][T11366] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 78.877483][T11366] page_type: 0x1() [ 78.878863][T11366] raw: 00fff00000000200 ffff888012440800 ffffea00008a0e50 ffffea00008fee10 [ 78.882228][T11366] raw: 0000000000000000 ffff88801ce12000 0000000100000001 0000000000000000 [ 78.885268][T11366] page dumped because: kasan: bad access detected [ 78.887551][T11366] page_owner tracks the page as allocated [ 78.889573][T11366] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x3420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 9705, tgid 9702 (syz-executor.2), ts 72962497095, free_ts 72939606018 [ 78.897325][T11366] post_alloc_hook+0x2db/0x350 [ 78.899237][T11366] get_page_from_freelist+0xf41/0x2c00 [ 78.901469][T11366] __alloc_pages+0x1cb/0x4a0 [ 78.903649][T11366] cache_grow_begin+0x9b/0x3b0 [ 78.905618][T11366] cache_alloc_refill+0x27f/0x380 [ 78.907498][T11366] __kmem_cache_alloc_node+0x360/0x3f0 [ 78.909484][T11366] __kmalloc+0x4e/0x190 [ 78.911057][T11366] rfkill_alloc+0xaa/0x2c0 [ 78.912717][T11366] nfc_register_device+0xe6/0x3c0 [ 78.914574][T11366] nci_register_device+0x7cb/0xb50 [ 78.916614][T11366] virtual_ncidev_open+0x14f/0x230 [ 78.918500][T11366] misc_open+0x37a/0x4a0 [ 78.920030][T11366] chrdev_open+0x26a/0x770 [ 78.921800][T11366] do_dentry_open+0x6cc/0x13f0 [ 78.923528][T11366] path_openat+0x1baa/0x2750 [ 78.925180][T11366] do_filp_open+0x1ba/0x410 [ 78.926804][T11366] page last free stack trace: [ 78.928717][T11366] register_dummy_stack+0x66/0xb0 [ 78.930956][T11366] init_page_owner+0x48/0x730 [ 78.932690][T11366] page_ext_init+0x536/0x7a0 [ 78.934379][T11366] mm_core_init+0x643/0x740 [ 78.936011][T11366] [ 78.936871][T11366] Memory state around the buggy address: [ 78.938864][T11366] ffff88801ce11f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.941838][T11366] ffff88801ce11f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 78.944712][T11366] >ffff88801ce12000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.947554][T11366] ^ [ 78.949381][T11366] ffff88801ce12080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.952999][T11366] ffff88801ce12100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 78.956338][T11366] ================================================================== [ 78.966727][T11366] Kernel panic - not syncing: KASAN: panic_on_warn set ... 22:23:15 executing program 2: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$video4linux(&(0x7f0000000040), 0x4, 0x200000) r0 = memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) ioctl$UDMABUF_CREATE(0xffffffffffffffff, 0x40187542, &(0x7f00000000c0)={r0, 0x1, 0x100000000, 0x10000}) mount$binderfs(&(0x7f0000000100), &(0x7f0000000140)='./binderfs\x00', &(0x7f0000000180), 0x2020000, &(0x7f00000001c0)={[{@stats}, {@max={'max', 0x3d, 0x8}}, {@max={'max', 0x3d, 0x4}}, {}, {@stats}, {@max={'max', 0x3d, 0x1}}, {@stats}], [{@seclabel}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/v4l-subdev#\x00'}}, {@smackfsroot}, {@subj_role={'subj_role', 0x3d, '/dev/v4l-subdev#\x00'}}, {@seclabel}, {@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x64, 0x3d, 0x65, 0x34, 0x35, 0x62, 0x30], 0x2d, [0x0, 0x5c, 0x31, 0x34], 0x2d, [0x38, 0x61, 0x38, 0x33], 0x2d, [0x0, 0x32, 0x61, 0x65], 0x2d, [0x63, 0x66, 0x61, 0x37, 0x64, 0x66, 0x66, 0x65]}}}]}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) getpeername$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000380)=0x14) openat$cgroup_subtree(r1, &(0x7f00000003c0), 0x2, 0x0) r3 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r3}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r1, 0x47, '\x00', r2, r1, 0x1, 0x3, 0x3}, 0x48) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f00000007c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl1\x00', r2, 0x2f, 0xf8, 0x3f, 0x2, 0x64, @private0, @remote, 0x700, 0x80, 0x6, 0x7}}) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x9, 0xf, &(0x7f0000000640)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, @map_val={0x18, 0x3, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0x0, 0x1, 0x0, r4}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, @generic={0x7, 0x3, 0x4, 0xcb, 0x3ff}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x1000}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x6}], &(0x7f00000006c0)='GPL\x00', 0x3, 0xc, &(0x7f0000000700)=""/12, 0x41100, 0x5, '\x00', r5, 0x10, r1, 0x8, &(0x7f0000000800)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x4, 0x1, 0x9, 0x8}, 0x10, 0x0, r1, 0x0, &(0x7f0000000880)=[r1, r1, r1]}, 0x80) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_STATS(r6, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x1c, 0x0, 0x410, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000055) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) r8 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r8, 0xc02064a5, &(0x7f0000000bc0)={r7, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) syz_genetlink_get_family_id$tipc(&(0x7f0000000c40), r6) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x100000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000e00)={'ip6tnl0\x00', &(0x7f0000000d80)={'syztnl1\x00', r5, 0x4, 0x3f, 0x40, 0x1f, 0x24, @loopback, @loopback, 0x7, 0x8000, 0x21}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000ec0)={'sit0\x00', &(0x7f0000000e40)={'syztnl0\x00', r5, 0x41, 0x8, 0x9, 0x8, {{0x18, 0x4, 0x2, 0x7, 0x60, 0x68, 0x0, 0x3, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@cipso={0x86, 0x8, 0x3, [{0x5, 0x2}]}, @lsrr={0x83, 0x23, 0x49, [@private=0xa010101, @local, @multicast1, @local, @multicast2, @multicast1, @multicast2, @empty]}, @rr={0x7, 0x1b, 0xb9, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x34}, @private=0xa010100, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @ra={0x94, 0x4, 0x1}]}}}}}) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10048}, 0xc, &(0x7f0000000f80)={&(0x7f0000000f00)={0x4c, 0x0, 0x20, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8, 0x1, r2}, @GTPA_FLOW={0x6}, @GTPA_LINK={0x8, 0x1, r9}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_O_TEI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c010}, 0x40010) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) 22:23:15 executing program 3: openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) memfd_create(&(0x7f0000000080)='/dev/virtual_nci\x00', 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) r1 = geteuid() mount$binderfs(&(0x7f0000000400), &(0x7f0000000440)='./binderfs2\x00', &(0x7f0000000480), 0x42000, &(0x7f00000004c0)={[{@max={'max', 0x3d, 0x1}}, {@stats}, {@stats}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x8000000000000001}}, {@stats}, {@stats}, {@max={'max', 0x3d, 0x7fff}}], [{@obj_role={'obj_role', 0x3d, '%-\'({]'}}, {@audit}, {@euid_gt}, {@fowner_lt={'fowner<', r1}}, {@obj_user={'obj_user', 0x3d, '^'}}]}) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xa, 0x6ecd, 0x8001, 0x1d, 0x1826, r0, 0x47, '\x00', 0x0, r0, 0x1, 0x3, 0x3}, 0x48) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_SETGAMMA(0xffffffffffffffff, 0xc02064a5, &(0x7f0000000bc0)={r2, 0x1, &(0x7f0000000b00)=[0x0], &(0x7f0000000b40)=[0x401, 0x2, 0xff, 0x7, 0x1, 0x2], &(0x7f0000000b80)=[0x8, 0x8001]}) [ 78.969509][T11366] CPU: 1 PID: 11366 Comm: syz-executor.0 Not tainted 6.4.0-rc7-syzkaller-00072-gdad9774deaf1 #0 [ 78.973554][T11366] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 78.976803][T11366] Call Trace: [ 78.978062][T11366] [ 78.979168][T11366] dump_stack_lvl+0xd9/0x150 [ 78.980897][T11366] panic+0x686/0x730 [ 78.982384][T11366] ? panic_smp_self_stop+0xa0/0xa0 [ 78.984292][T11366] ? preempt_schedule_thunk+0x1a/0x20 [ 78.986260][T11366] ? preempt_schedule_common+0x45/0xb0 [ 78.988284][T11366] check_panic_on_warn+0xb1/0xc0 [ 78.990070][T11366] end_report+0xe9/0x120 [ 78.991592][T11366] ? nfc_llcp_find_local+0xcf/0xe0 [ 78.993505][T11366] kasan_report+0xf9/0x130 [ 78.995169][T11366] ? nfc_llcp_find_local+0xcf/0xe0 [ 78.997067][T11366] nfc_llcp_find_local+0xcf/0xe0 [ 78.998898][T11366] nfc_llcp_unregister_device+0x1a/0x260 [ 79.000956][T11366] nfc_unregister_device+0x196/0x330 [ 79.002878][T11366] virtual_ncidev_close+0x52/0xb0 [ 79.004759][T11366] __fput+0x27c/0xa90 [ 79.006222][T11366] ? virtual_nci_open+0x10/0x10 [ 79.008039][T11366] task_work_run+0x16f/0x270 [ 79.009731][T11366] ? task_work_cancel+0x30/0x30 [ 79.011657][T11366] exit_to_user_mode_prepare+0x210/0x240 [ 79.013733][T11366] syscall_exit_to_user_mode+0x1d/0x50 [ 79.015731][T11366] do_syscall_64+0x46/0xb0 [ 79.017380][T11366] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 79.019771][T11366] RIP: 0033:0x7f1d9fa3e12b [ 79.021401][T11366] Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 [ 79.028431][T11366] RSP: 002b:00007ffda8ba0f70 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 79.031520][T11366] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f1d9fa3e12b [ 79.034321][T11366] RDX: 00007f1d9f6014d0 RSI: ffffffffffffffff RDI: 0000000000000003 [ 79.037158][T11366] RBP: 00007f1d9fbad980 R08: 0000000000000000 R09: 00007f1d9f600000 [ 79.039991][T11366] R10: 00007f1d9f6014d8 R11: 0000000000000293 R12: 00000000000132b9 [ 79.042860][T11366] R13: 00007ffda8ba1070 R14: 00007f1d9fbabf80 R15: 0000000000000032 [ 79.045749][T11366] [ 79.047340][T11366] Kernel Offset: disabled [ 79.048897][T11366] Rebooting in 86400 seconds.. KVM: injection failed, MSI lost (Operation not permitted) VM DIAGNOSIS: 22:23:15 Registers: info registers vcpu 0 RAX=0000000000000000 RBX=ffffffff9150fcc8 RCX=ffffffff8163f7a2 RDX=ffffffff90440cc0 RSI=000000000000008b RDI=0000000000000000 RBP=dffffc0000000000 RSP=ffffc90004347bb0 R8 =0000000000000001 R9 =ffffffff9018e212 R10=fffffbfff22a217c R11=000000000001b429 R12=000000000000087f R13=ffffffff904ae548 R14=000000000001b429 R15=ffffffff90440cc0 RIP=ffffffff8163f5d0 RFL=00000802 [-O-----] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88806b600000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b2cf25000 CR3=0000000015ef7000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=000000000000000000306c6e747a7973 XMM02=00007fb118d8a7e000007fb118d8a7c0 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=0000000000000000000000524f525245 XMM07=00000000000000000000000000000000 XMM08=000000000000000000524f5252450040 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=0000000000000032 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff84873925 RDI=ffffffff920c64a0 RBP=ffffffff920c6460 RSP=ffffc9002962f7e0 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=6572617764726148 R12=0000000000000000 R13=0000000000000032 R14=ffffffff848738c0 R15=0000000000000000 RIP=ffffffff8487394f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00005555570df400 ffffffff 00c00000 GS =0000 ffff88806b700000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000555555564708 CR3=000000004e109000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=00007ffde1251a800000003000000018 XMM02=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM03=0000000000ff000000ff000000000000 XMM04=000000000000000000ff000000000000 XMM05=00000000000000000000000000000000 XMM06=00000000000000000000000000000000 XMM07=0000000000000000000000000000ff00 XMM08=ffffffffffffff00ffffffffffff00ff XMM09=8929fd6d051cf04773732683fbac92b4 XMM10=73737373737372a27373737373737373 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 2 RAX=ffffed100d707aa9 RBX=1ffff92001feef60 RCX=0000000000000000 RDX=ffff88801e9b8d40 RSI=ffffffff81784d59 RDI=0000000000000005 RBP=ffffc9000ff77bf8 RSP=ffffc9000ff77ae0 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000001 R11=ffff88806b936ce0 R12=ffff88806b83d540 R13=0000000000000003 R14=0000000000000003 R15=0000000000000001 RIP=ffffffff81784d60 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88806b800000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000555556ac0708 CR3=000000000c571000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=81f8c7e9692afa4489385e57ea094d26 XMM01=85995ddadba27b5f9a66f10ea64f3e9b XMM02=cd284a6cb1fe67546b21f7e918734520 XMM03=b32a970074525e3d349b9db6632a1c49 XMM04=000000000000000000000000000169c0 XMM05=00000000000000000000000000000040 XMM06=c1952e1a000277470000000000000030 XMM07=0001b127c21301bcc2c3a2e6c2b553f6 XMM08=c19ea9da000000300000000000000030 XMM09=000000000000003000007e9f00000030 XMM10=a36744c20af55909c4d8a6feea2c28fc XMM11=36771335ae918e0e93e33d5f11edc928 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=a54ff53a3c6ef372bb67ae856a09e667 XMM15=5be0cd191f83d9ab9b05688c510e527f info registers vcpu 3 RAX=0000000000034361 RBX=0000000000000003 RCX=ffffffff8a0f95a5 RDX=0000000000000000 RSI=0000000000000001 RDI=0000000000000000 RBP=dffffc0000000000 RSP=ffffc9000039fe08 R8 =0000000000000001 R9 =ffff88806b936ceb R10=ffffed100d726d9d R11=0000000000000000 R12=0000000000000003 R13=ffffffff8e79cc50 R14=0000000000000000 R15=0000000000000000 RIP=ffffffff8a0fadbf RFL=00000242 [---Z---] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88806b900000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000001b2cd24000 CR3=0000000048cb4000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=ffffffffffffffffffffffffffffffff XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000 XMM04=000000000000000000000000000000ff XMM05=00000000000000000000000000000000 XMM06=0000000000000000000000524f525245 XMM07=00000000000000000000000000000000 XMM08=000000000000000000524f5252450040 XMM09=00000000000000000000000000000000 XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000