[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 38.442872][ T26] audit: type=1800 audit(1556106118.247:25): pid=7720 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 38.478292][ T26] audit: type=1800 audit(1556106118.247:26): pid=7720 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 38.502230][ T26] audit: type=1800 audit(1556106118.257:27): pid=7720 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.144' (ECDSA) to the list of known hosts. 2019/04/24 11:42:06 fuzzer started 2019/04/24 11:42:09 dialing manager at 10.128.0.26:41189 2019/04/24 11:42:09 syscalls: 2278 2019/04/24 11:42:09 code coverage: enabled 2019/04/24 11:42:09 comparison tracing: enabled 2019/04/24 11:42:09 extra coverage: extra coverage is not supported by the kernel 2019/04/24 11:42:09 setuid sandbox: enabled 2019/04/24 11:42:09 namespace sandbox: enabled 2019/04/24 11:42:09 Android sandbox: /sys/fs/selinux/policy does not exist 2019/04/24 11:42:09 fault injection: enabled 2019/04/24 11:42:09 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/04/24 11:42:09 net packet injection: enabled 2019/04/24 11:42:09 net device setup: enabled 11:43:27 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) read(r0, 0x0, 0x0) syzkaller login: [ 127.487774][ T7887] IPVS: ftp: loaded support on port[0] = 21 11:43:27 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') getdents64(r0, &(0x7f0000000180)=""/82, 0x233) getdents64(r0, 0x0, 0x0) [ 127.590475][ T7887] chnl_net:caif_netlink_parms(): no params data found [ 127.643561][ T7887] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.652771][ T7887] bridge0: port 1(bridge_slave_0) entered disabled state [ 127.661110][ T7887] device bridge_slave_0 entered promiscuous mode [ 127.670004][ T7887] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.677438][ T7887] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.687018][ T7887] device bridge_slave_1 entered promiscuous mode [ 127.710791][ T7887] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 127.721197][ T7887] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 127.747069][ T7887] team0: Port device team_slave_0 added [ 127.754332][ T7887] team0: Port device team_slave_1 added [ 127.783399][ T7890] IPVS: ftp: loaded support on port[0] = 21 11:43:27 executing program 2: r0 = gettid() ioctl$int_in(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r1, 0x0, 0x3c8, 0x0) r2 = openat$zero(0xffffffffffffff9c, 0x0, 0x400000, 0x0) futex(0x0, 0x8b, 0x0, 0x0, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='/gro<#\xfbW\xe6\xc6\x0f\x1fKE\xb7M\x99\x9a\x9a\x8c,\xe1[.\xf6\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+\x8d\xed\xa6\\\x1c\xc3\x97\x94\xf6\xe0.+\xe3\x89\xde\x139E\xa3\x85\xbd\x81\xe9\xbd\xee\xee\x03\x00\x00\x00\x00\x00\x00\x00[T\aE\xdfK\x1d\xeeH;\x15v$\xc5\xbcq\x9a\t\x9ej5\t\x00\x00\x009\x8c4\xc4\x88C\xa2B\x8b\x81\v\xea\t\xf0\x8fw\a\f\x15\xe2\xd0q\xbb\r\x17`s\xec\x85>\xcf\xab9(\xf6.\x15\xcd2-\xf2\xc4\xd8\x00a\xd5\xd9\xb5Z\xd7\xb4\xac\x1d_+k\xd6\x8ag\xdceHE\xd5\x1c\x8a\xbd#\xcc\x82\xca\xc2(\xb6\xe1\x99p\x9b\xa3D\xd2\x91\x96\xef\x05\fv\x16\x14\xcc\xea\x9d\x11w\x1e\xb5VG\x9ad\x9a`=^h\x8c8\xc9\"\x1eO\xb5vk\xc9\xcfi\x90\xd7\xd3H\xa1\xb4\xda\v\x17\x95\xf7\x19\x99\x99\x92\xc3\xc0\x8a\x18\xc7\"g\xd7B\x8f\x85\x18\xf3\x02\xa7\xb6\x83\x92\xefY\xef\x85\x92\x10E\x18\xbc\xacy\xd6\xa7Wh\xcd\xd0\xfa\xcc\xde\xeb\xdf\xad\xfd\xb0\xee\xfb\xc2(\x8cj\xd0uj{4\xb2\xe1p\x88u6\x9a;\xaa\x9f+J\x9e\xe3\xcc\xc7O\xad\x84\x8c;\x92~,\x15\xb2\x97\f~\xa0W\x16\x8b\a\x88\xaa\xe4C\xaf\x90\xdf\x7f\xe51\x00/n\xb5f\x1a\x8c+\xea<\xe3N@\x9e\xec\xbe{\x90x\xc6\x95!\xea\x11\xda\xe1I\x1d\xcbY\xe1\x01\xd2d\xae\xd1(>\xa3\xa9\x93\x16\xc6G\x94|', 0x2761, 0x0) r4 = perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xffff, 0x7, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0xc7cd, 0x0, 0x0, 0x0, 0x0, 0xd199, 0x9, 0x9, 0x0, 0x4, 0x0, 0x9, 0x0, 0x0, 0x3f, 0x28, 0xff, 0x400, 0x6d1, 0x0, 0x0, 0x80000000, 0x3, 0x400, 0x7, 0xe2aa, 0x0, 0x101, 0x0, @perf_config_ext={0x0, 0x8000}, 0x1, 0x0, 0x2e9e, 0x6, 0xfcd, 0x9, 0x9}, r0, 0xf, 0xffffffffffffffff, 0x1) write$cgroup_pid(r3, &(0x7f0000000080), 0xfffffe38) fcntl$getownex(r3, 0x10, &(0x7f00000000c0)) write$P9_RSYMLINK(r3, &(0x7f0000000100)={0x14, 0x11, 0x1, {0x40, 0x1, 0x4}}, 0x14) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000180)) ioctl$EVIOCGUNIQ(r2, 0x80404508, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, &(0x7f0000000440)={0x7, 0x6, 0x4, 0x1, 0x3, 0x2f}) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x660c, 0x0) open(&(0x7f0000000280)='./bus\x00', 0x2202, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f0000000340), &(0x7f0000000140)=0x14) [ 127.859091][ T7887] device hsr_slave_0 entered promiscuous mode [ 127.897630][ T7887] device hsr_slave_1 entered promiscuous mode [ 128.009578][ T7887] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.016890][ T7887] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.024743][ T7887] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.028520][ T7892] IPVS: ftp: loaded support on port[0] = 21 [ 128.031867][ T7887] bridge0: port 1(bridge_slave_0) entered forwarding state 11:43:27 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000001c0)=""/246) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000180)=0x10001) [ 128.184868][ T7887] 8021q: adding VLAN 0 to HW filter on device bond0 [ 128.224550][ T7887] 8021q: adding VLAN 0 to HW filter on device team0 [ 128.233891][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 128.250806][ T22] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.277347][ T22] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.297469][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 128.320526][ T7890] chnl_net:caif_netlink_parms(): no params data found [ 128.348922][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 128.355819][ T7897] IPVS: ftp: loaded support on port[0] = 21 [ 128.357609][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.369994][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.379272][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 128.388050][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.395135][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state 11:43:28 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) perf_event_open(&(0x7f000000a000)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xa000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='nfs\x00', 0x0, &(0x7f000000a000)) [ 128.519916][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 128.529261][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 128.541588][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 128.583390][ T7887] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 128.595595][ T7887] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 128.606380][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 128.618800][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 128.640088][ T7892] chnl_net:caif_netlink_parms(): no params data found [ 128.695036][ T7890] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.705111][ T7890] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.723168][ T7890] device bridge_slave_0 entered promiscuous mode [ 128.748271][ T7900] IPVS: ftp: loaded support on port[0] = 21 [ 128.770948][ T7887] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 128.778491][ T7890] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.785548][ T7890] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.797233][ T7890] device bridge_slave_1 entered promiscuous mode 11:43:28 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000017c0)=ANY=[@ANYBLOB="d4"]) [ 128.920663][ T7892] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.931411][ T7892] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.940102][ T7892] device bridge_slave_0 entered promiscuous mode [ 128.951161][ T7892] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.958777][ T7892] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.970827][ T7892] device bridge_slave_1 entered promiscuous mode [ 129.023207][ T7890] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 129.061689][ T7890] bond0: Enslaving bond_slave_1 as an active interface with an up link 11:43:28 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) read(r0, 0x0, 0x0) [ 129.070701][ T7897] chnl_net:caif_netlink_parms(): no params data found [ 129.089037][ T7906] IPVS: ftp: loaded support on port[0] = 21 [ 129.111107][ T7892] bond0: Enslaving bond_slave_0 as an active interface with an up link 11:43:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/icmp6\x00') pread64(r1, 0x0, 0x0, 0x0) [ 129.135207][ T7890] team0: Port device team_slave_0 added [ 129.165209][ T7892] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.190433][ T7890] team0: Port device team_slave_1 added 11:43:29 executing program 0: [ 129.255476][ T7900] chnl_net:caif_netlink_parms(): no params data found 11:43:29 executing program 0: 11:43:29 executing program 0: [ 129.316590][ T7892] team0: Port device team_slave_0 added 11:43:29 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e22}, 0x10) 11:43:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x2, 0x0) ioctl$BLKROTATIONAL(r0, 0x127e, &(0x7f0000000000)) [ 129.389499][ T7890] device hsr_slave_0 entered promiscuous mode [ 129.417374][ T7890] device hsr_slave_1 entered promiscuous mode [ 129.475202][ T7892] team0: Port device team_slave_1 added [ 129.514997][ T7897] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.522856][ T7897] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.531126][ T7897] device bridge_slave_0 entered promiscuous mode [ 129.540027][ T7897] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.549983][ T7897] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.560160][ T7897] device bridge_slave_1 entered promiscuous mode [ 129.628195][ T7892] device hsr_slave_0 entered promiscuous mode [ 129.666435][ T7892] device hsr_slave_1 entered promiscuous mode [ 129.749928][ T7897] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 129.774384][ T7897] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.784607][ T7900] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.792590][ T7900] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.800726][ T7900] device bridge_slave_0 entered promiscuous mode [ 129.844905][ T7900] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.854017][ T7900] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.862313][ T7900] device bridge_slave_1 entered promiscuous mode [ 129.905150][ T7900] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 129.917638][ T7900] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.928016][ T7897] team0: Port device team_slave_0 added [ 129.935137][ T7897] team0: Port device team_slave_1 added [ 129.975241][ T7900] team0: Port device team_slave_0 added [ 130.018227][ T7897] device hsr_slave_0 entered promiscuous mode [ 130.056663][ T7897] device hsr_slave_1 entered promiscuous mode [ 130.146137][ T7900] team0: Port device team_slave_1 added [ 130.152299][ T7906] chnl_net:caif_netlink_parms(): no params data found [ 130.247994][ T7900] device hsr_slave_0 entered promiscuous mode [ 130.286391][ T7900] device hsr_slave_1 entered promiscuous mode [ 130.377587][ T7897] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.393307][ T7900] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.400421][ T7900] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.407799][ T7900] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.414882][ T7900] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.427337][ T7906] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.434379][ T7906] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.444287][ T7906] device bridge_slave_0 entered promiscuous mode [ 130.454069][ T7906] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.461519][ T7906] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.469313][ T7906] device bridge_slave_1 entered promiscuous mode [ 130.484374][ T7892] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.492475][ T7897] 8021q: adding VLAN 0 to HW filter on device team0 [ 130.508976][ T7890] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.526774][ T22] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.534267][ T22] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.542158][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 130.554951][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 130.562729][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 130.591545][ T7892] 8021q: adding VLAN 0 to HW filter on device team0 [ 130.600224][ T7906] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 130.610031][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 130.620927][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 130.629433][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.636488][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.644573][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 130.652719][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 130.661757][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 130.681985][ T7906] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 130.708468][ T7906] team0: Port device team_slave_0 added [ 130.717385][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 130.725042][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 130.732916][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 130.741659][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 130.750219][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.757359][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.764969][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 130.778233][ T7890] 8021q: adding VLAN 0 to HW filter on device team0 [ 130.788312][ T7906] team0: Port device team_slave_1 added [ 130.803067][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 130.812807][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 130.821632][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 130.830180][ T7928] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.837323][ T7928] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.844764][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 130.853277][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 130.918874][ T7906] device hsr_slave_0 entered promiscuous mode [ 130.966596][ T7906] device hsr_slave_1 entered promiscuous mode [ 131.024386][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 131.032515][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 131.040612][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 131.049507][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 131.058463][ T7928] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.065509][ T7928] bridge0: port 1(bridge_slave_0) entered forwarding state [ 131.073210][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 131.082015][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.090376][ T7928] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.097466][ T7928] bridge0: port 2(bridge_slave_1) entered forwarding state [ 131.104884][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 131.113479][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 131.122131][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 131.130460][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 131.138829][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 131.147073][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 131.157000][ T7928] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 131.168764][ T7900] 8021q: adding VLAN 0 to HW filter on device bond0 [ 131.197155][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 131.205683][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.214617][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.221728][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 131.230228][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 131.239144][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 131.247783][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 131.256279][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 131.264514][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 131.272954][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 131.281218][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 131.289603][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 131.298133][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 131.315848][ T7900] 8021q: adding VLAN 0 to HW filter on device team0 [ 131.342208][ T7897] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 131.350355][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 131.358914][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 131.371603][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 131.381037][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 131.389721][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 131.398708][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 131.407324][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 131.415563][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 131.423980][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 131.432262][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 131.449077][ T7890] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 131.471831][ T7892] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 131.483559][ T7892] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 131.495713][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 131.504086][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 131.512924][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 131.521369][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.528477][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 131.536040][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 131.544775][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 131.555523][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 131.563743][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 131.572127][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 131.592755][ T7897] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 131.613916][ T7890] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 131.625677][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 131.639205][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.647968][ T7895] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.655002][ T7895] bridge0: port 2(bridge_slave_1) entered forwarding state [ 131.700393][ T7892] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 131.713920][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 131.737680][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 11:43:31 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='ns\x00') getdents64(r0, &(0x7f0000000180)=""/82, 0x233) getdents64(r0, 0x0, 0x0) [ 131.753824][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 131.762545][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 131.808208][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 131.841554][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 131.865499][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 131.874598][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 131.883458][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 131.893003][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 131.902195][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 131.918511][ T7906] 8021q: adding VLAN 0 to HW filter on device bond0 [ 131.975262][ T7900] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 132.009065][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 132.026325][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 132.043828][ T7900] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 132.067461][ T7906] 8021q: adding VLAN 0 to HW filter on device team0 [ 132.106664][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 132.119158][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 132.143305][ T7895] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.150508][ T7895] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.179508][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 132.189724][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 132.198910][ T7895] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.206030][ T7895] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.214226][ T7895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 132.252809][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 132.275507][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 11:43:32 executing program 2: r0 = gettid() ioctl$int_in(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r1, 0x0, 0x3c8, 0x0) r2 = openat$zero(0xffffffffffffff9c, 0x0, 0x400000, 0x0) futex(0x0, 0x8b, 0x0, 0x0, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='/gro<#\xfbW\xe6\xc6\x0f\x1fKE\xb7M\x99\x9a\x9a\x8c,\xe1[.\xf6\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+\x8d\xed\xa6\\\x1c\xc3\x97\x94\xf6\xe0.+\xe3\x89\xde\x139E\xa3\x85\xbd\x81\xe9\xbd\xee\xee\x03\x00\x00\x00\x00\x00\x00\x00[T\aE\xdfK\x1d\xeeH;\x15v$\xc5\xbcq\x9a\t\x9ej5\t\x00\x00\x009\x8c4\xc4\x88C\xa2B\x8b\x81\v\xea\t\xf0\x8fw\a\f\x15\xe2\xd0q\xbb\r\x17`s\xec\x85>\xcf\xab9(\xf6.\x15\xcd2-\xf2\xc4\xd8\x00a\xd5\xd9\xb5Z\xd7\xb4\xac\x1d_+k\xd6\x8ag\xdceHE\xd5\x1c\x8a\xbd#\xcc\x82\xca\xc2(\xb6\xe1\x99p\x9b\xa3D\xd2\x91\x96\xef\x05\fv\x16\x14\xcc\xea\x9d\x11w\x1e\xb5VG\x9ad\x9a`=^h\x8c8\xc9\"\x1eO\xb5vk\xc9\xcfi\x90\xd7\xd3H\xa1\xb4\xda\v\x17\x95\xf7\x19\x99\x99\x92\xc3\xc0\x8a\x18\xc7\"g\xd7B\x8f\x85\x18\xf3\x02\xa7\xb6\x83\x92\xefY\xef\x85\x92\x10E\x18\xbc\xacy\xd6\xa7Wh\xcd\xd0\xfa\xcc\xde\xeb\xdf\xad\xfd\xb0\xee\xfb\xc2(\x8cj\xd0uj{4\xb2\xe1p\x88u6\x9a;\xaa\x9f+J\x9e\xe3\xcc\xc7O\xad\x84\x8c;\x92~,\x15\xb2\x97\f~\xa0W\x16\x8b\a\x88\xaa\xe4C\xaf\x90\xdf\x7f\xe51\x00/n\xb5f\x1a\x8c+\xea<\xe3N@\x9e\xec\xbe{\x90x\xc6\x95!\xea\x11\xda\xe1I\x1d\xcbY\xe1\x01\xd2d\xae\xd1(>\xa3\xa9\x93\x16\xc6G\x94|', 0x2761, 0x0) r4 = perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xffff, 0x7, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0xc7cd, 0x0, 0x0, 0x0, 0x0, 0xd199, 0x9, 0x9, 0x0, 0x4, 0x0, 0x9, 0x0, 0x0, 0x3f, 0x28, 0xff, 0x400, 0x6d1, 0x0, 0x0, 0x80000000, 0x3, 0x400, 0x7, 0xe2aa, 0x0, 0x101, 0x0, @perf_config_ext={0x0, 0x8000}, 0x1, 0x0, 0x2e9e, 0x6, 0xfcd, 0x9, 0x9}, r0, 0xf, 0xffffffffffffffff, 0x1) write$cgroup_pid(r3, &(0x7f0000000080), 0xfffffe38) fcntl$getownex(r3, 0x10, &(0x7f00000000c0)) write$P9_RSYMLINK(r3, &(0x7f0000000100)={0x14, 0x11, 0x1, {0x40, 0x1, 0x4}}, 0x14) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000180)) ioctl$EVIOCGUNIQ(r2, 0x80404508, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x4058534c, &(0x7f0000000440)={0x7, 0x6, 0x4, 0x1, 0x3, 0x2f}) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x660c, 0x0) open(&(0x7f0000000280)='./bus\x00', 0x2202, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f0000000340), &(0x7f0000000140)=0x14) 11:43:32 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, &(0x7f0000000000)={'filter\x00'}, 0x0) [ 132.301885][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 132.323009][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 132.361109][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 132.385177][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 132.394081][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 132.413552][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 132.432715][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 132.458089][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 132.467053][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 132.479469][ T7906] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 132.534583][ T7906] 8021q: adding VLAN 0 to HW filter on device batadv0 11:43:33 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) perf_event_open(&(0x7f000000a000)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xa000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='nfs\x00', 0x0, &(0x7f000000a000)) [ 133.165031][ T7970] FS-Cache: Duplicate cookie detected [ 133.170533][ T7970] FS-Cache: O-cookie c=00000000ef8f0fc1 [p=00000000caadebd8 fl=212 nc=0 na=0] [ 133.179703][ T7970] FS-Cache: O-cookie d= (null) n= (null) [ 133.186995][ T7970] FS-Cache: O-key=[10] '0200020000a07f000008' [ 133.193102][ T7970] FS-Cache: N-cookie c=000000001fd3073b [p=00000000caadebd8 fl=2 nc=0 na=1] [ 133.201832][ T7970] FS-Cache: N-cookie d=00000000c13836ac n=0000000082c66c9c [ 133.209073][ T7970] FS-Cache: N-key=[10] '0200020000a07f000008' 11:43:33 executing program 3: 11:43:33 executing program 1: 11:43:33 executing program 0: 11:43:33 executing program 2: 11:43:33 executing program 5: 11:43:33 executing program 1: 11:43:33 executing program 2: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r0, r1) 11:43:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xced423) clone(0x40100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) lseek(r1, 0xfffffffffffffffc, 0x1) write$P9_RLOCK(r1, 0x0, 0x256) 11:43:33 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @local}, 0x10) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0x10, 0x1, 0xff}], 0x10}, 0x0) 11:43:33 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x800000003, 0x1f16e32e) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) 11:43:33 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000002f40)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/user\x00') 11:43:33 executing program 4: perf_event_open(&(0x7f0000000580)={0x2, 0x70, 0x5c64, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) connect$unix(r0, 0x0, 0x0) writev(r0, &(0x7f00000004c0)=[{&(0x7f0000000400)="1e", 0x1}], 0x1) 11:43:33 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @local}, 0x10) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:33 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x70, 0x5c64, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x43732e5398416f1b}) dup3(r1, r0, 0x0) 11:43:33 executing program 1: perf_event_open(&(0x7f0000000580)={0x2, 0x70, 0x5c64, 0x2, 0x0, 0x0, 0x0, 0x0, 0x10008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) lchown(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) 11:43:33 executing program 0: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x800000003, 0x1f16e32e) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) 11:43:33 executing program 3: memfd_create(0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4000001, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) read(r2, &(0x7f0000000200)=""/250, 0x50c7e3e3) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x2000000000000010, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x2000005) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, 0x0, 0x0) 11:43:34 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @local}, 0x10) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:34 executing program 1: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4000001, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) read(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) fstat(0xffffffffffffffff, &(0x7f0000000440)) ioctl$int_out(r3, 0x5462, &(0x7f0000000700)) sendfile(r0, r0, 0x0, 0x2000005) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, 0x0, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) 11:43:34 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f319bc070") socket(0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f0000000040)=0x8ad) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f000074fffc)=0x3, 0x348) mmap(&(0x7f0000ff4000/0xa000)=nil, 0xa000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000080)=0x40000412, 0x4) ioctl$LOOP_GET_STATUS64(r2, 0x4c05, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) getsockopt$sock_int(r2, 0x1, 0x23, &(0x7f00000000c0), &(0x7f0000000100)=0x4) setns(0xffffffffffffffff, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0x7) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$TIOCLINUX7(0xffffffffffffffff, 0x541c, 0x0) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, 0x0) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) sendfile(r2, r3, 0x0, 0x8000fffffffe) 11:43:34 executing program 0: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x29, 0x5, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') 11:43:34 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @local}, 0x10) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x70, 0x5c64, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x43732e5398416f1b}) dup3(r1, r0, 0x0) [ 134.379828][ T8044] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 11:43:34 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @local}, 0x10) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) [ 134.431899][ T8045] device nr0 entered promiscuous mode 11:43:34 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) dup(r0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:34 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) dup(r0) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:34 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:34 executing program 4: socket$kcm(0x2, 0x1000000000000805, 0x84) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x1e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='/group.stat\x00', 0x2761, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000007c0)='./cgroup/syz1\x00', 0x200002, 0x0) r0 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x1c, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x588}, 0x3c) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x890c, &(0x7f0000000000)={r0}) 11:43:34 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:34 executing program 2: sendmsg(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:34 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x26e1, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, 0x0) close(r0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000000)={r0, 0x0, &(0x7f0000000540)=""/4096}, 0x18) close(r0) 11:43:34 executing program 4: openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x8) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) ftruncate(r0, 0x2081fc) r1 = socket$inet6(0xa, 0x400000000001, 0x0) connect(0xffffffffffffffff, 0x0, 0x0) r2 = dup(r1) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000600)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, 0x0, 0xffffffffffffffcd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) syz_genetlink_get_family_id$ipvs(0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0xe0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x11, &(0x7f0000000080)=0x1, 0x4) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000200)={0x1, &(0x7f0000000040)=[{0x80000000006, 0x0, 0x0, 0x1004}]}, 0x8) sendfile(r1, r3, 0x0, 0x8000fffffffe) 11:43:34 executing program 1: r0 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x588}, 0x3c) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x890c, &(0x7f0000000000)) 11:43:34 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000080)={0x4}) 11:43:35 executing program 2: sendmsg(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) [ 135.169738][ T8087] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 11:43:35 executing program 1: socket$kcm(0x2, 0x1000000000000805, 0x84) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x1e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='/group.stat\x00', 0x2761, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000007c0)='./cgroup/syz1\x00', 0x200002, 0x0) r0 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x588}, 0x3c) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x890c, &(0x7f0000000000)={r0}) 11:43:35 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:35 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x26e1, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, 0x0) close(r0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000000)={r0, 0x0, &(0x7f0000000540)=""/4096}, 0x18) close(r0) 11:43:35 executing program 2: sendmsg(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:35 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'vet\x00\x00\x00\x00\x1e\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) ioctl$TUNSETTXFILTER(r0, 0x400454c8, 0x0) 11:43:35 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:35 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:35 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x2a0ffffffff, 'pids'}]}, 0x6) 11:43:35 executing program 4: socket$kcm(0xa, 0x3, 0x11) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='cgroup.stat\x00', 0x0, 0x0) r0 = getpid() perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x7eac8638, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xc5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x4030582a, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000480)='/gro<#\xfbW\xe6\xc6\x0f\x1fKE\xb7M\x99\x9a\x9a\x8c,\xe1[&\xe5\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ}\xb7\xf3\xfe\xf6\xe0.+\xe3\x89\xde\x139E\xa3\x85\xbd\x81\xe9\xbd\xee\xee\x03\x00\x00\x00\x00\x00\x00\x00[T\aE\xdfK\x1d\xeeH;\x15v$\xc5\xbcq\x9a\t\x9ej5\t\x00\x00\x009\x8c4', 0x2761, 0x0) write$cgroup_pid(r1, &(0x7f0000000100), 0xda4fff08) socket$kcm(0x29, 0x0, 0x0) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)='cgroup.subtree_control\x00', 0x2, 0x0) 11:43:35 executing program 0: socket$kcm(0x2, 0x0, 0x84) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x1e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() bpf$PROG_LOAD(0x5, &(0x7f0000caefb8)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) r0 = socket$kcm(0x2, 0x805, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000001600)={&(0x7f0000000480)=@in={0x2, 0x0, @dev}, 0x80, &(0x7f0000001340)=[{&(0x7f0000000080)="e5", 0x1}], 0x1}, 0x0) 11:43:35 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:35 executing program 5: r0 = memfd_create(&(0x7f00000001c0)='!lo-)\xff:/!\x00', 0x0) write$binfmt_script(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="01"], 0x1) execveat(r0, &(0x7f0000000200)='\x00', 0x0, 0x0, 0x1000) 11:43:35 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:35 executing program 1: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000001c0)=""/246) 11:43:35 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socketpair(0x11, 0x3, 0x0, 0x0) 11:43:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:35 executing program 2: r0 = socket$inet(0x2, 0x0, 0x0) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:35 executing program 1: syz_emit_ethernet(0x42, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x7, 0x3, 0x0, [{}, {}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = memfd_create(&(0x7f00000000c0)='-B\xd5NI\xc5j\xbappp\xf0\b\x84\xa2m\x00:)\x00\xbb\x8d\xac\xacva}knh#\xcb)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8bCc\xad\x89\x9ck\xde\xc5\xe96\xddU\xa9=\xcdJx\xaa\x8f~\xb9\x00a\xa9\xb2\x04K\x98\x93?\x88Q\xf7\xd6\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xab\xb6\xa5$4\xd6\xfe7\x0f\xe7\xd9$\xce \xabN\xae\xc9\xbd\x05g@\xe1\'s\x0e\x90\xf2\xcdr\xb8(', 0x0) write$eventfd(r1, &(0x7f0000000140)=0xffffffffffffffff, 0x8) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000000)={0x0, 0x2710}, 0x10) 11:43:36 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5310, &(0x7f00000000c0)={{0x0, 0xbf}}) 11:43:36 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000017c0)=ANY=[]) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000003c0)=0x1) 11:43:36 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:36 executing program 2: socket$inet(0x2, 0x1, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:36 executing program 1: syz_emit_ethernet(0x42, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x7, 0x3, 0x0, [{}, {}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:36 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000080)) 11:43:36 executing program 1: syz_emit_ethernet(0x42, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x7, 0x3, 0x0, [{}, {}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:36 executing program 2: socket$inet(0x2, 0x1, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:36 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x0) 11:43:36 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:36 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(r0) 11:43:36 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) r0 = epoll_create1(0x0) close(r0) syz_open_procfs(0x0, &(0x7f0000000100)='mounts\x00') poll(&(0x7f00000000c0)=[{r0}], 0x1, 0x10080c) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000013c0)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', 0x0, 0x209020, 0x0) 11:43:36 executing program 1: syz_emit_ethernet(0x42, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x7, 0x3, 0x0, [{}, {}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:36 executing program 2: socket$inet(0x2, 0x1, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=[{0xfffffffffffffd73}], 0x10}, 0x0) 11:43:36 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:36 executing program 0: r0 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ppoll(&(0x7f0000000180)=[{r0}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:36 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) 11:43:36 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(r0) 11:43:36 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:36 executing program 5: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) r0 = epoll_create1(0x0) close(r0) syz_open_procfs(0x0, &(0x7f0000000100)='mounts\x00') poll(&(0x7f00000000c0)=[{r0}], 0x1, 0x10080c) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, 0x0) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000013c0)='ramfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./file0\x00', 0x0, 0x209020, 0x0) 11:43:36 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) sendmsg(r0, 0x0, 0x0) 11:43:36 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(r0) 11:43:36 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) 11:43:36 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) sendmsg(r0, 0x0, 0x0) 11:43:36 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(r0) 11:43:36 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:36 executing program 5: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'veth0\x00', &(0x7f0000000000)=@ethtool_wolinfo={0x5, 0x0, 0x0, "55efadb855a4"}}) 11:43:37 executing program 0: r0 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ppoll(&(0x7f0000000180)=[{r0}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:37 executing program 1: syz_emit_ethernet(0x0, 0x0, 0x0) 11:43:37 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) sendmsg(r0, 0x0, 0x0) 11:43:37 executing program 4: r0 = timerfd_create(0x0, 0x0) close(r0) 11:43:37 executing program 3: connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:37 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_END_FF_UPLOAD(r0, 0x406855c9, &(0x7f0000003500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @ramp}, {0x0, 0x0, 0x0, {}, {}, @ramp}}) 11:43:37 executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0x36, 0x0, &(0x7f0000000140)="e460cdfbef24080000000a9386dd6a00000000072ceb3014cd3ec8a755c1e1380081ffad000000e8d500000001000000140000050024", 0x0}, 0x28) 11:43:37 executing program 3: connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:37 executing program 1: syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:37 executing program 4: r0 = timerfd_create(0x0, 0x0) close(r0) 11:43:37 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0}, 0x0) 11:43:37 executing program 1: syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:38 executing program 0: r0 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ppoll(&(0x7f0000000180)=[{r0}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:38 executing program 3: connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:38 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x1, 0x0) ioctl$VIDIOC_G_FREQUENCY(0xffffffffffffffff, 0xc02c5638, 0x0) 11:43:38 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0}, 0x0) 11:43:38 executing program 4: r0 = timerfd_create(0x0, 0x0) close(r0) 11:43:38 executing program 1: syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:38 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0}, 0x0) 11:43:38 executing program 4: timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(0xffffffffffffffff) 11:43:38 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:38 executing program 1: syz_emit_ethernet(0x42, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x0, 0x3, 0x0, [{}, {}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:38 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)}, 0x0) 11:43:38 executing program 1: syz_emit_ethernet(0x42, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x0, 0x3, 0x0, [{}, {}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:39 executing program 0: r0 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ppoll(&(0x7f0000000180)=[{r0}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:39 executing program 4: timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(0xffffffffffffffff) 11:43:39 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:39 executing program 5: getrandom(&(0x7f0000000040)=""/15, 0xf, 0x2) 11:43:39 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)}, 0x0) 11:43:39 executing program 1: syz_emit_ethernet(0x42, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x0, 0x3, 0x0, [{}, {}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:39 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)}, 0x0) 11:43:39 executing program 4: timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(0xffffffffffffffff) 11:43:39 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:39 executing program 5: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) r1 = open(&(0x7f00000000c0)='./bus\x00', 0x0, 0x0) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) ftruncate(r2, 0x8200) r3 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x1000) fallocate(r2, 0x11, 0x0, 0x107fff) sendfile(r0, r1, 0x0, 0x8000fffffffe) 11:43:39 executing program 1: syz_emit_ethernet(0x42, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x7, 0x0, 0x0, [{}, {}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:39 executing program 1: syz_emit_ethernet(0x42, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x7, 0x0, 0x0, [{}, {}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:40 executing program 0: ppoll(&(0x7f0000000180)=[{}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:40 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f00000002c0), 0xd9, 0x20008800) 11:43:40 executing program 1: syz_emit_ethernet(0x42, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x18, 0x7, 0x0, 0x0, [{}, {}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:40 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:40 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(r0) 11:43:40 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x14, 0x7, 0x3, 0x0, [{}, {}, {[@empty=0x1100]}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:40 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{&(0x7f00000002c0)=@in={0x2, 0x4e21, @broadcast}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000000700000083070417f93c0800cf4baeab7d5acb200ecc2eb1910067ec"], 0x28}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:40 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(r0) 11:43:40 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:40 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x14, 0x7, 0x3, 0x0, [{}, {}, {[@empty=0x1100]}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:40 executing program 5: r0 = creat(&(0x7f00000001c0)='./file1\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000040)='threaded\x00', 0xfffffd9f) write$binfmt_elf64(r0, 0x0, 0x0) creat(&(0x7f0000000080)='./file1\x00', 0x0) fallocate(r0, 0x3, 0x0, 0xfff9) 11:43:40 executing program 2: clone(0x82102001df9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x0) 11:43:40 executing program 2: clone(0x82102001df9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x0) 11:43:40 executing program 0: ppoll(&(0x7f0000000180)=[{}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:40 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(r0) 11:43:40 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:40 executing program 2: clone(0x82102001df9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x0) 11:43:40 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x14, 0x7, 0x3, 0x0, [{}, {}, {[@empty=0x1100]}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:40 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCCONS(r1, 0x541d) dup2(r1, r0) 11:43:41 executing program 2: clone(0x82102001df9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x0) 11:43:41 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:41 executing program 1: syz_emit_ethernet(0x3a, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0x9, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x10, 0x7, 0x3, 0x0, [{}, {}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:41 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(r0) 11:43:41 executing program 2: exit(0x0) 11:43:41 executing program 5: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x100000000000001) dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, 0x0) write$sndseq(r0, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0xfffffffd, @tick, {}, {}, @connect}], 0xffffff76) 11:43:41 executing program 0: ppoll(&(0x7f0000000180)=[{}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:41 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(r0) 11:43:41 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:41 executing program 1: syz_emit_ethernet(0x3a, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0x9, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x10, 0x7, 0x3, 0x0, [{}, {}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:41 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='setgroups\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") close(r0) 11:43:41 executing program 5: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000340)=""/132) 11:43:41 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(r0) 11:43:41 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:41 executing program 1: syz_emit_ethernet(0x3a, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0x9, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x10, 0x7, 0x3, 0x0, [{}, {}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:42 executing program 2: exit(0x0) 11:43:42 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:42 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, 0x0, 0x0) close(r0) 11:43:42 executing program 0: r0 = syz_open_dev$radio(0x0, 0x3, 0x2) ppoll(&(0x7f0000000180)=[{r0}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:42 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x14, 0x7, 0x3, 0x0, [{}, {}, {}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:42 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, 0x0, 0x0) close(r0) 11:43:42 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:42 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{&(0x7f00000002c0)=@in={0x2, 0x4e21, @broadcast}, 0x80, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000700f8ff83070417f93c0800"], 0x18}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:42 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, 0x0, 0x0) close(r0) 11:43:42 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x14, 0x7, 0x3, 0x0, [{}, {}, {}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:42 executing program 5: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000180)='/dev/urandom\x00', 0x0, 0x0) r1 = memfd_create(0x0, 0x2) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x8000000}) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x9, 0x10, r1, 0x0) r2 = syz_open_procfs(0x0, 0x0) write$FUSE_LK(r2, &(0x7f0000000200)={0x28, 0x0, 0x1, {{0x0, 0xffffffffffffff01, 0x3}}}, 0x28) ioctl$KVM_NMI(r2, 0xae9a) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, &(0x7f0000000180)={0x34, 0x0, &(0x7f0000000140)}) sysfs$3(0x3) perf_event_open(&(0x7f000001d000)={0x0, 0x36b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) umount2(0x0, 0x5) ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f0000000100)=ANY=[@ANYBLOB="ffff004000005c"]) 11:43:42 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:42 executing program 2: exit(0x0) 11:43:42 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(0xffffffffffffffff) 11:43:42 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:43 executing program 0: r0 = syz_open_dev$radio(0x0, 0x3, 0x2) ppoll(&(0x7f0000000180)=[{r0}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:43 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x14, 0x7, 0x3, 0x0, [{}, {}, {}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:43 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sched_setaffinity(0x0, 0xa65be6d3, &(0x7f0000000140)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r0, r1) r2 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) recvfrom$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) write$binfmt_elf32(r2, &(0x7f0000000340)={{0x7f, 0x45, 0x4c, 0x46, 0x7, 0x1f, 0x557a2914, 0x0, 0xfff, 0x3, 0x6, 0x0, 0x77, 0x38, 0x0, 0x400, 0x3, 0x20, 0x2, 0x0, 0x0, 0x4}, [{0x7, 0xfff, 0x4, 0x0, 0x2, 0x0, 0x5, 0x5}], "25353317b0e7e624b83f59daf337d9c3694ceae008b355dcc773df43e72a5478c9cb06b6cae99482020c9c4b46dcfb150a768c70741f6deb6c"}, 0x91) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) syz_genetlink_get_family_id$net_dm(0x0) ioctl$RNDZAPENTCNT(0xffffffffffffffff, 0x5204, &(0x7f0000000240)) 11:43:43 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(0xffffffffffffffff) 11:43:43 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:43 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x14, 0x7, 0x3, 0x0, [{}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:43 executing program 4: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0) close(0xffffffffffffffff) 11:43:43 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:43 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, 0x0) 11:43:43 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x0) 11:43:43 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x14, 0x7, 0x3, 0x0, [{}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_tables_targets\x00') preadv(r1, &(0x7f00000002c0)=[{0x0}, {&(0x7f0000000140)=""/198, 0xc6}], 0x2, 0x0) 11:43:44 executing program 0: r0 = syz_open_dev$radio(0x0, 0x3, 0x2) ppoll(&(0x7f0000000180)=[{r0}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:44 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80), 0x0, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:44 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x2000000004, 0xa64d84f6778e975e) write$evdev(r0, &(0x7f0000057fa0), 0xfffffeac) memfd_create(0x0, 0x0) 11:43:44 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x14, 0x7, 0x3, 0x0, [{}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:44 executing program 5: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x2000000004, 0xa64d84f6778e975e) write$evdev(r0, &(0x7f0000057fa0), 0xfffffeac) r1 = memfd_create(0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="01"], 0x1) 11:43:44 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x14, 0x7, 0x3, 0x0, [{}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:44 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80), 0x0, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:44 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x14, 0x7, 0x3, 0x0, [{}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:44 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0xa, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x14, 0x7, 0x3, 0x0, [{}, {[@empty=0x1100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:44 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x0) 11:43:44 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80), 0x0, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:44 executing program 1: madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00002f5ff8)) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mremap(&(0x7f000030e000/0x4000)=nil, 0x4000, 0x2000, 0x0, &(0x7f00003a6000/0x2000)=nil) 11:43:45 executing program 0: r0 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0xffffffffffffffff, 0x2) ppoll(&(0x7f0000000180)=[{r0}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:45 executing program 1: memfd_create(0x0, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'syz'}, &(0x7f0000000100), 0x3cc, 0xfffffffffffffffe) 11:43:45 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:45 executing program 4: r0 = syz_open_dev$vivid(&(0x7f0000000240)='/dev/video#\x00', 0x2, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r0, 0xc0405665, &(0x7f0000000280)) 11:43:45 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x0, 0x0) perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5, 0x0, 0x0, 0x4c8, 0xfffffffffffff801, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3bb, 0x2, 0x0, 0xffffffff, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x4, 0x6, 0x0, 0x2c, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x7, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x3, 0x182) socket$inet_udplite(0x2, 0x2, 0x88) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc) creat(0x0, 0x48) gettid() write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0x100000000) sendfile(r0, r0, &(0x7f0000000000), 0x2000005) [ 145.520807][ T8667] encrypted_key: insufficient parameters specified 11:43:45 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:45 executing program 4: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) vmsplice(r0, 0x0, 0x0, 0x0) [ 145.564063][ T8672] encrypted_key: insufficient parameters specified 11:43:45 executing program 1: msgsnd(0x0, &(0x7f00000000c0), 0x8, 0x0) 11:43:45 executing program 4: r0 = socket(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0xb, &(0x7f0000000040), 0x4) 11:43:45 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x0) 11:43:45 executing program 5: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x7, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0x100000000) sendfile(r0, r0, &(0x7f0000000000), 0x2000005) 11:43:45 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:46 executing program 0: r0 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0xffffffffffffffff, 0x2) ppoll(&(0x7f0000000180)=[{r0}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:46 executing program 1: r0 = socket$unix(0x1, 0x3, 0x0) bind$unix(r0, 0x0, 0x0) 11:43:46 executing program 4: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0x0) sendfile(r0, r0, &(0x7f0000000000), 0x2000005) 11:43:46 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[]}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) 11:43:46 executing program 1: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000080)={0x0, 0x7530}, 0x10) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000008, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet_tcp_int(r1, 0x6, 0x2000000000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000380)=0x1, 0x4) write$P9_RREADDIR(r1, 0x0, 0x0) 11:43:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) [ 146.371222][ T8704] binder: 8703:8704 transaction failed 29189/-22, size 24-8 line 2995 [ 146.379733][ T8704] binder: 8703:8704 ioctl c0306201 20000440 returned -14 [ 146.399013][ T3480] binder: undelivered TRANSACTION_ERROR: 29189 11:43:46 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[]}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) [ 146.523739][ T8721] binder: 8720:8721 transaction failed 29189/-22, size 24-8 line 2995 [ 146.532369][ T8721] binder: 8720:8721 ioctl c0306201 20000440 returned -14 11:43:46 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000100)) write$binfmt_aout(r0, &(0x7f00000002c0)=ANY=[], 0xae9d808f) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x7}) [ 146.572639][ T3480] binder: undelivered TRANSACTION_ERROR: 29189 [ 146.584289][ T8725] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 11:43:46 executing program 4: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0x0) sendfile(r0, r0, &(0x7f0000000000), 0x2000005) 11:43:46 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[]}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:46 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x3f, 0x2101) write$9p(r0, &(0x7f00000000c0)="ef172249eebd4ab2c38f3ac455582028a0679d34290efc1a2dd5263543714dcbad9dc2600707881d5901b7ce5841e6915028906dfe3efba01c57b7fb34c0d1a9e92cf1c4b8deba02beb90ca9395109d60d60ccf5806946c81557a736df12200f3945c05a9eeef00a155483d8e7c5f5499295da5563abf932d6492022b044ece8c062451dcc0053dd11ff05fd5ec6c90ef85d4955f2775f76cfc996d14fe9ccc6ae5b4b6c6ddcd67eae2a1a97bdd46c26628942d2cd1c5948dc84f36c3995dd385ca32a5ecf9e1287502990cc7888ec916375808d1b1dd06578f9c40c3c83869dab448828ad073de4fb700a3d580f", 0xee) write$P9_RAUTH(r0, &(0x7f0000000080)={0x14}, 0x14) 11:43:47 executing program 0: r0 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0xffffffffffffffff, 0x2) ppoll(&(0x7f0000000180)=[{r0}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:47 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0x0) sendfile(r0, r0, &(0x7f0000000000), 0x2000005) 11:43:47 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000140)={0x0, 0x0, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x0, 0x0, 0x0, r2, 0x4}) 11:43:47 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:47 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpgid(0xffffffffffffffff) migrate_pages(r0, 0x7ffe, 0x0, &(0x7f0000000000)=0x1ffffffffff) r1 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x40, 0x0) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, 0x0) recvmsg$kcm(r1, 0x0, 0x0) 11:43:47 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:47 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23}, 0x1c) listen(r0, 0x3) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x14) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6e, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) 11:43:47 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000740)='memory.events\x00', 0x0, 0x0) openat$cgroup_type(r0, 0x0, 0x2, 0x0) socket$kcm(0x29, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002840)=[{&(0x7f0000001840)="0bfa1b96bbe3f068d361ea4e693dc80d8e0ec62869bc1fc4ebaf2dcfbdb4c33a2f26b2844d75adeb615d6ce23f21c8edafcdd9787d73552838c14b04653556908d04e89de026506b828ecadaa33d9d0de08d283a272ed537d02c628f5cfb8becf8a1d7260b5ca008be01fbf9716447a1196e1c268f67cf786ede7a9ccd48eeda407ef9c2c2005bb9df0b6a945c7be17e92c7f703e1eb501d09523d726a09dc7a37a43ef7c028c12d09da3208f5c409a54169d54b9008c3226358a79186e91a0332901ef37cb6f7d37443af8b51b9141344bcbbe316d0d5eb92024e3ca6a07ef4f1e69c501d39b884eee1688e9b43406556eca24984b5aaf539f15ea54e1223da2ac33466efc423063678dd31d325d3c264fe71226add90cc00a2c0fa8dc209a74c86afd62a2624baf595c861ddf69bbc009fea0953e716aeb3711c7dbbb2be4ed8bbfcc60bd34a9f90965c2cbf13aa2fd3f6905cfd02061c5f1e5bb97e5e4a9e774f767966ad4f433c0bf1564261499d46bca0d4e898568f543615b5ac51461ce7e623190b4e1dbb168a880c97f203c74f0b3319f51bb032e31761b3c7d048ed5904a60d0ec1ca57b50798bc74293435dcb6eb3dce73e66537ca7e071166031a693b80add10d3f943570ffac0a60cef51c3430a3f980236aed04d1847a663304e9d2733b5b252881188d2f8d82a2a7ca879a337e616668c5dad043fded1bf8a599b7b835456a212d5b877546e6cfcf85dbc46bb0119fc8a9c58a1c09337428ff26cfef8c4bc0d9155360680a8b231d0354925624def370aafd61cf53fa7d4b896c90f836a55bbe3af544d2d90c429dcd089fda391cbad1841c44ee4147ee20b52aee8c4c40ed6bda7d496dc5f6466bd8ac3e77df3686713bf269dbae0b059c78c4f940ee4a9683b8ecc01855d6753ef6e9c05fa08c6077557d628fee41ee8390cc37a91340468732c0adf205f064de297b823fcd3be3f99a831796f4b800152cd7b3ddf79a6f7ba56732c3ef6b59081c8985620f15a186ae73b00dcdf4f93a0e7315f7f3a45539037657982eff5be5c5cbe1d55427ac4232d356009a975f1ddf6ec691f3a72294719f0dd839c1f7c13a0e6f02493e098d84850319fb2f01d30116fab7e86608723dec75156ec347886dbce2b2065c20ac6c18a19c0eaa09170feaf0e2745d96785e8c65ef6b963be2a1750fda7dec4f50f82c54e920ec301cc7903d06c9fe40c108fdf975c1661bb084b49c10f62ad0b96c7c3e44fa8700edb75e5c14a2065a4066d0bacab9a4a6c29c18af0294d560443729083dd40795c416b1e6876b73d7ff07ebd98e4e02ec1e56875c94a6154662e6511c6771633b035678f1fba57b8b2735a6756dd956029d5ce87787c68ff1fecfdb7de77040b275ef03ad9e6e5d325d9c39fbbca5bff7c0891aa62fed0e54871d1bd70b60fe48493eca71eee316f103f7396c1374c3cb94f9965a0460678e88cc3c1e15ea9fc4122a758e1dd4577e9dc2f584af235bfdf6ef36479db1688a725f41bef98fd4f64b713f2f1e0e2b85a2c5fa482f1eb052d49fa91d6f43dbc65c532fd062dd878fe17c592e451fe70d7cac80a19acff0bbb5f88cfced1769c7e987921903a9358e1ad653a4285cb704e60dcce449cf1ea5034149b581f39676043dc7a00ec536f02f2f2c10e6a7ef949a3a7bfbe24a17a462cdb68b20a426455b1c4bda1ad63d22a2484513a9d5948120e02fbee15db7ce14af94f0d1312becc6199f812379def27a62552965d15c13a9ea8ff4d2bee57fa85fb0624d2aced487dafec8eafd9442888cc1c3ba6f33958748ca0eddfcc5dd71c4c0093f2ac70f8b870ed061cb74d9f86bad73529ecfe233effeff0d8043a7e19cafd89e3275dd2c107202", 0x53a}, {0x0}], 0x2}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000280)={'nr0\x01\x00', 0x4005}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x400, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r2 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r1, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 11:43:47 executing program 5: syz_emit_ethernet(0x1, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa8b1bac7f727b86dd6083d94dc5a10a00fe8000000000000000000000000000bb00000000000000000000ffffe00000010000907800000000000000000000000085287f7cc104ddb262c11b99463bbe23"], 0x0) 11:43:47 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:47 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0x0) sendfile(r0, r0, &(0x7f0000000000), 0x2000005) 11:43:47 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x501e}) r1 = socket$kcm(0x29, 0x80000000000005, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, '\x03\x86\xdd'}]}, 0xfdef) [ 147.679637][ T8780] device nr0 entered promiscuous mode [ 147.940649][ T8794] device nr0 entered promiscuous mode [ 148.136040][ T8798] device nr0 entered promiscuous mode 11:43:48 executing program 0: syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ppoll(0x0, 0x0, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:48 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000"], 0x6}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:48 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x1, 0x0) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f00000000c0)={0x0, 0x5, 0x7fffffff}) 11:43:48 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0x0) sendfile(r0, r0, &(0x7f0000000000), 0x2000005) 11:43:48 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000"], 0x6}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) [ 148.364926][ T8794] device nr0 entered promiscuous mode 11:43:48 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f319bd070") r1 = io_uring_setup(0x14a, &(0x7f0000000180)) io_uring_enter(r1, 0x0, 0xb0, 0x3, 0x0, 0x0) 11:43:48 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000"], 0x6}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:48 executing program 4: syz_emit_ethernet(0x3a, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0x9, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x10, 0x7, 0x3, 0x0, [{}, {}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:48 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0x0) 11:43:48 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000"], 0x9}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 148.776707][ T8837] binder: 8830:8837 ioctl c0306201 20000440 returned -14 [ 148.785695][ T8837] binder: 8830:8837 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 148.814655][ T7928] binder: release 8830:8837 transaction 4 out, still active [ 148.815299][ T8837] binder: 8830:8837 ioctl c0306201 20000440 returned -14 [ 148.829652][ T7928] binder: unexpected work type, 4, not freed [ 148.835802][ T7928] binder: undelivered TRANSACTION_COMPLETE [ 148.850493][ T7928] binder: release 8830:8837 transaction 8 out, still active 11:43:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) [ 148.878625][ T7928] binder: unexpected work type, 4, not freed [ 148.884657][ T7928] binder: undelivered TRANSACTION_COMPLETE [ 148.914466][ T7928] binder: send failed reply for transaction 4, target dead [ 148.923801][ T7928] binder: send failed reply for transaction 8, target dead [ 148.942203][ T8842] binder: 8841:8842 transaction failed 29189/-22, size 24-8 line 2995 [ 148.950928][ T8842] binder: 8841:8842 ioctl c0306201 20000440 returned -14 [ 148.959765][ T3480] binder: undelivered TRANSACTION_ERROR: 29189 [ 148.968474][ T8843] binder: 8841:8843 transaction failed 29189/-22, size 24-8 line 2995 [ 148.976875][ T8843] binder: 8841:8843 ioctl c0306201 20000440 returned -14 [ 148.984343][ T7928] binder: undelivered TRANSACTION_ERROR: 29189 11:43:48 executing program 0: syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ppoll(0x0, 0x0, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:48 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$RTC_EPOCH_SET(0xffffffffffffffff, 0x4008700e, 0x0) 11:43:48 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000"], 0x9}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:48 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000016000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000100)={[0x0, 0x0, 0x3, 0x0, 0x0, 0x2000, 0xfd], 0x1f004, 0x483}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) [ 149.144969][ T8852] binder: 8851:8852 ioctl c0306201 20000440 returned -14 [ 149.199382][ T8852] binder: 8851:8852 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 149.260760][ T3480] binder: release 8851:8852 transaction 14 out, still active [ 149.293955][ T3480] binder: unexpected work type, 4, not freed [ 149.304817][ T3480] binder: undelivered TRANSACTION_COMPLETE [ 149.330675][ T3480] binder: send failed reply for transaction 14, target dead 11:43:49 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f319bd070") r1 = io_uring_setup(0x14a, &(0x7f0000000180)) io_uring_enter(r1, 0x0, 0xb0, 0x3, 0x0, 0x0) 11:43:49 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000"], 0x9}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:49 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) 11:43:49 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x9, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x0, 0x4e}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) 11:43:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000200)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000000940)=""/4096, 0x1000}], 0x1) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xfffffffffffffffe}) [ 149.450613][ T8872] binder: 8870:8872 ioctl c0306201 20000440 returned -14 11:43:49 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) [ 149.493183][ T8872] binder: 8870:8872 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 149.577103][ T7928] binder: release 8870:8872 transaction 19 out, still active [ 149.585748][ T7928] binder: unexpected work type, 4, not freed [ 149.600603][ T7928] binder: undelivered TRANSACTION_COMPLETE [ 149.614877][ T7928] binder: send failed reply for transaction 19, target dead 11:43:49 executing program 0: syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ppoll(0x0, 0x0, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:49 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) 11:43:49 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/11], 0xb}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:49 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:49 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/11], 0xb}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) [ 150.068430][ T8890] binder: 8889:8890 ioctl c0306201 20000440 returned -14 [ 150.078867][ T8890] binder: 8889:8890 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 150.091834][ T17] binder: release 8889:8890 transaction 24 out, still active [ 150.106407][ T17] binder: unexpected work type, 4, not freed [ 150.115255][ T17] binder: undelivered TRANSACTION_COMPLETE [ 150.160793][ T17] binder: send failed reply for transaction 24, target dead 11:43:50 executing program 1: syz_emit_ethernet(0x3a, &(0x7f0000000080)={@local, @link_local, [], {@ipv4={0x800, {{0x9, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @local, {[@timestamp={0x44, 0x10, 0x7, 0x0, 0x0, [{}, {}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1}}}}}, 0x0) 11:43:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:50 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) 11:43:50 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/11], 0xb}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:50 executing program 5: r0 = memfd_create(&(0x7f00000000c0)='/proc/thread-self/attR/current\x00\x96\x15\xce\xea\xa5\x02\t\xce\xb1\xf8\xa6-:x%\xb9\xb3\x9b\xa4\xa3b\xc2\x91\x14\x83N\x7f\x8f,b\x04:\xdf\xefQ\xe0\xee 2\xe3\xe5$\xd6\xc9\xfbL\"\x9c33\x97\\\xb4\x80\xfc\xdf\xc7\xafv\xfa\x10\xe4\xde\xe5\x7f\xce\xbfR\x97\xcb\xed#\xfe.\v\x04\x11\xf6\xf9\x88\xb2d\xf2\xb0\x89\xf3\xb6\xc4\x13o\x06\xecs\x14>s\xf0\xcc\xbe\x14\xe7\xcf{\xd0C\xad\xee\x9cc\xe5M;X\xb6\x9d\xf9\x14\xe0\x8dA\xee\x0f\xaf\xdb\xd6\x10\x1b\xd2o\xc7\xeb-\x92\x8c\xbc\xae\xf0\x17+\x02\x06L\xce{\x1f\t}*s[#\x15\x98\b\x9b\xab\xee+\xfb\xd4\xcask\x03T>\xbaI\xad\x8b\xcc\xf7\xd65=\xa2N=&\x98\xf3\xce\x0e^\xb2s\xc7g\x8d\xd9t\xc5\xe2\xfd\xf2\xb3r\x1cp\xb8&\xd0ez\x8eT*', 0x6) fallocate(r0, 0x0, 0x2000424, 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x0) [ 150.446774][ T8913] binder: 8912:8913 BC_CLEAR_DEATH_NOTIFICATION death notification not active 11:43:50 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:50 executing program 1: r0 = io_uring_setup(0x14a, &(0x7f0000000180)) io_uring_enter(r0, 0x0, 0xb0, 0x3, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_FILES(r0, 0x3, 0x0, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffa0) 11:43:50 executing program 0: syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ppoll(&(0x7f0000000180), 0x0, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f319bd070") semctl$SEM_STAT(0x0, 0x0, 0x12, 0x0) 11:43:50 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) 11:43:50 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup2(r1, r0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f319bd070") ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x4, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="10630840"], 0x0, 0x0, 0x0}) [ 150.995903][ T8932] binder: 8931:8932 BC_CLEAR_DEATH_NOTIFICATION death notification not active 11:43:50 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x810) 11:43:50 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) eventfd2(0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) [ 151.094355][ T8945] binder: 8943:8945 BC_CLEAR_DEATH_NOTIFICATION death notification not active 11:43:51 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, 0x0, 0x0, 0x810) 11:43:51 executing program 5: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x1) write$FUSE_NOTIFY_INVAL_INODE(r0, 0x0, 0x0) [ 151.163398][ T8953] binder: 8950:8953 BC_DEAD_BINDER_DONE 0000000000000000 not found 11:43:51 executing program 1: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x1) write$FUSE_NOTIFY_INVAL_INODE(r0, &(0x7f0000000080)={0x28, 0x2, 0x0, {0x0, 0x4b4ff27e}}, 0x28) 11:43:51 executing program 0: syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ppoll(&(0x7f0000000180), 0x0, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:51 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) 11:43:51 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x1}}, 0x0) 11:43:51 executing program 1: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='sysfs\x00', 0x0, 0x0) listxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=""/33, 0x21) 11:43:51 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, 0x0, 0x0, 0x810) 11:43:51 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, 0x0, 0x0, 0x810) 11:43:51 executing program 5: mkdir(&(0x7f0000001380)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='sysfs\x00', 0x0, 0x0) chmod(&(0x7f0000000080)='./file0\x00', 0x0) [ 151.875978][ T8980] binder: 8973:8980 transaction failed 29189/-22, size 24-8 line 2995 [ 151.895351][ T8980] binder: 8973:8980 ioctl c0306201 20000440 returned -14 [ 151.917225][ T8980] binder: 8973:8980 IncRefs 0 refcount change on invalid ref 0 ret -22 11:43:51 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="11dc86055e0bceec7be070") r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000002c0)='\x00'/10, 0x0) write$binfmt_elf32(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="7f454c4600000000000000000000000003000300000000000000000038e8ff0000000000000000000000200001"], 0x2d) execveat(r2, &(0x7f0000000080)='\x00', 0x0, 0x0, 0x1000) ftruncate(r1, 0x0) 11:43:51 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) [ 151.936757][ T8980] binder: 8973:8980 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 151.946315][ T17] binder: undelivered TRANSACTION_ERROR: 29189 11:43:51 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) [ 152.051009][ T9000] binder: 8999:9000 transaction failed 29189/-22, size 24-8 line 2995 11:43:51 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000100)="11dc86055e0bceec7be070") r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000100)={0x4}) [ 152.119132][ T9000] binder: 8999:9000 ioctl c0306201 20000440 returned -14 [ 152.119589][ T9008] binder: 8999:9008 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 152.170507][ T9008] binder: 8999:9008 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 152.213983][ T17] binder: undelivered TRANSACTION_ERROR: 29189 11:43:52 executing program 0: syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ppoll(&(0x7f0000000180), 0x0, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:52 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x0) 11:43:52 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) 11:43:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:52 executing program 5: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x5c65, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x4, 0x4c032, 0xffffffffffffffff, 0x0) 11:43:52 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="11dc86055e0bceec7be070") r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000002c0)='\x00'/10, 0x0) write$binfmt_elf32(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="7f454c4600000000000000000000000003000300000000000000000038e8ff0000000000000000000000200001"], 0x2d) execveat(r2, &(0x7f0000000080)='\x00', 0x0, 0x0, 0x1000) ftruncate(r1, 0x0) [ 152.781511][ T9024] binder: 9023:9024 transaction failed 29189/-22, size 24-8 line 2995 [ 152.830690][ T9036] binder: 9023:9036 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 152.841322][ T9024] binder: 9023:9024 ioctl c0306201 20000440 returned -14 11:43:52 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, 0xffffffffffffffff) 11:43:52 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x0) [ 152.875579][ T9036] binder: 9023:9036 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 152.919480][ T12] binder: undelivered TRANSACTION_ERROR: 29189 11:43:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:52 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, 0xffffffffffffffff) [ 153.115249][ T9047] binder_alloc: 9046: binder_alloc_buf, no vma [ 153.141200][ T9047] binder: 9046:9047 transaction failed 29189/-3, size 24-8 line 3148 11:43:53 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1800"/12], 0xc}}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000000440), 0x7be86bbb7a0f557, 0x0) 11:43:53 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, 0xffffffffffffffff) [ 153.174128][ T9047] binder: 9046:9047 ioctl c0306201 20000440 returned -14 [ 153.192618][ T9052] binder: 9046:9052 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 153.276280][ T17] binder: undelivered TRANSACTION_ERROR: 29189 11:43:53 executing program 0: syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ppoll(&(0x7f0000000180)=[{}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:53 executing program 5: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x5c65, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x4, 0x4c032, 0xffffffffffffffff, 0x0) 11:43:53 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r0, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r0) 11:43:53 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="11dc86055e0bceec7be070") r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000002c0)='\x00'/10, 0x0) write$binfmt_elf32(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="7f454c4600000000000000000000000003000300000000000000000038e8ff0000000000000000000000200001"], 0x2d) execveat(r2, &(0x7f0000000080)='\x00', 0x0, 0x0, 0x1000) ftruncate(r1, 0x0) 11:43:53 executing program 3: perf_event_open(&(0x7f0000000580)={0x2, 0x70, 0x5c64, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net\x00', 0x200002, 0x0) fchdir(r0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) lseek(r1, 0x0, 0x3) 11:43:53 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r0, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r0) [ 153.673581][ T9066] binder_alloc: 9065: binder_alloc_buf, no vma [ 153.693762][ T9066] binder: 9065:9066 transaction failed 29189/-3, size 24-8 line 3148 11:43:53 executing program 3: r0 = socket(0xa, 0x2, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfec7be070") connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[0xfeffffff], [], @loopback}}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000240)=0x7fe, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040), 0x4) [ 153.783528][ T9066] binder: 9065:9066 ioctl c0306201 20000440 returned -14 [ 153.823900][ T9085] binder: 9065:9085 BC_CLEAR_DEATH_NOTIFICATION death notification not active 11:43:53 executing program 3: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000000)=0x100, 0x4) sendto$inet(r0, &(0x7f0000000640)="96", 0x1, 0x0, 0x0, 0x0) sendmsg$unix(r1, &(0x7f0000001a00)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000006c0)="89", 0x1}], 0x1}, 0x4048800) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000266ffc), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000440), 0x164) 11:43:53 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r0, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r0) [ 153.870770][ T17] binder: undelivered TRANSACTION_ERROR: 29189 11:43:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:53 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = memfd_create(&(0x7f00000000c0)='-B\xd5NI\xc5j\xbappp\xf0\b\x84\xa2m\x00:)\x00\xbb\x8d\xac\xacva}knh#\xcb)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8bCc\xad\x89\x9ck\xde\xc5\xe96\xddU\xa9=\xcdJx\xaa\x8f~\xb9\x00a\xa9\xb2\x04K\x98\x93?\x88Q\xf7\xd6\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xab\xb6\xa5$4\xd6\xfe7\x0f\xe7\xd9$\xce \xabN\xae\xc9\xbd\x05g@\xe1\'s\x0e\x90\xf2\xcdr\xb8(', 0x0) write$eventfd(r1, &(0x7f0000000140), 0x8) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000000)={0x0, 0x2710}, 0x10) [ 154.008614][ T9099] binder_alloc: 9098: binder_alloc_buf, no vma [ 154.030539][ T9099] binder: 9098:9099 transaction failed 29189/-3, size 24-8 line 3148 [ 154.053521][ T9099] binder: 9098:9099 ioctl c0306201 20000440 returned -14 [ 154.065753][ T9102] binder: 9098:9102 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 154.118725][ T17] binder: undelivered TRANSACTION_ERROR: 29189 11:43:54 executing program 0: syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) ppoll(&(0x7f0000000180)=[{}], 0x1, 0x0, &(0x7f0000000200)={0x379}, 0x8) 11:43:54 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) 11:43:54 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='memory.events\x00', 0x7a05, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000740)='memory.events\x00\xe7\xce]tcS>\x93-\t/5\xc7\xf7\xd09&\xa3B\xf1\x06\x00\x00~\xb3\x9a\x0esV\x7f6\xba\xf2\xa0\xab\xfa\x1f+\xf8=\"\x1e\x1f\xe7\x8e\xa42\xe2H\xfe\x9f\x92\x9a5\x90G\xbd\x93\x80\x8c\xa3\xcbB\x91K\xa3\xda\xd5\xab\xeb\xd2?G\xaeNN\xd0\xf7\x81,9?\\\x12m\xef\xdci\x8a\x87.)\xab\xadwD\xfa\xef\xd9\xad\x18\x01\x97\x89\xb2\x05d\"\xbaQ\xf3G\x14`\xe9\xe1\xe3\xe8\xcd\x18\x84\x91\x87\xe9h\xac^)5\x94\\\xe0\b\xd4\x83Q\xee\x15q@\xe1\xc2\xdd\xc7\xb8\xfc\x7f4nh\xec\x88\xe9A\x8d\xf4\xac,\t\xfbR\xfbp!\x1a\x86\x1dN\x81\xac\xa8\x98\a,\n\x9dd\x04S\"\x0f\xb5\x1c6\xe1\xb2', 0x7a05, 0x1700) pwrite64(r2, &(0x7f0000000200)="4ebefa1e923f1e018b6e53bf4815b78e1f2ef9212b93090c1ff6b35c208d50aef3fd759f995b53dd37c58cf8332b8a6b66575478e02ef0145bf122ba2e2c53a7ec45e375683475a6495f8d7b7a088f5e32dc266569074319bf8c8d3d8007cc92e2ba0d9082c41b63e330f353a3f675a98d2e74a08e38400f7f5eb113a0e25fd90115d57a7acdcab1128cf4f9c719f3f29d460c507f8a2a6594d259217d32eae9be93c6ed17a67ae2e7e689a31fa8449da12fd62bf423cff702b09e6ee1ff0e698b8bb517819eb712ba2b34b54b28b79d9399d920d5a5507e8a85f37060dfe3051f06f8d7cc9b068495ee5d5fcce85410bcd9f91d1f198353ce94b2e03370e43875c1a035bb88fd26fbb5b1252e2056d6b67e2b2f424051a40ad9170e76a81a6ca4f149ff643db76f8f2c1aa8024a6279952027489bbad6479e47ea5ba9e47d8136df398665f6cdfd15e93cfbf2ce1151afe9321ed63fe7100e704b232646fc1e0e936b90cceaaa70225ce71640e10316d2cc637355eddb3c4e16ff1635fa4e65a66eb5ab2cbf9d6f063e05f0e46fcc14bf31eedfb9f33c215fc14946cc6f7493924442e939f71ac4bd3e35e78857f9624c663f3669a47a7146e3249ee3eaaf681f371d515af5b934f9252c7ac2a164bf318fc2b194ee087b2b28ed5e4618c0906fc3f32c43a3b9e08a2e0d509f65a7de909e8c3c535f1d8cb9c236716e5ad709", 0x200, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0xfffffcbe) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000000000, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") 11:43:54 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="11dc86055e0bceec7be070") r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000002c0)='\x00'/10, 0x0) write$binfmt_elf32(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="7f454c4600000000000000000000000003000300000000000000000038e8ff0000000000000000000000200001"], 0x2d) execveat(r2, &(0x7f0000000080)='\x00', 0x0, 0x0, 0x1000) ftruncate(r1, 0x0) 11:43:54 executing program 5: syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, &(0x7f0000000100)={0xffffffffffffffff, 0x1}) 11:43:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='memory.events\x00', 0x7a05, 0x1700) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x3200) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0xfffffcbe) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000000000, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") 11:43:54 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) sendto$inet(r0, 0x0, 0x3c4, 0x400200007fe, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) [ 154.634241][ T9115] binder: 9113:9115 transaction failed 29189/-22, size 24-8 line 2995 [ 154.652207][ T9115] binder: 9113:9115 ioctl c0306201 20000440 returned -14 11:43:54 executing program 2: perf_event_open$cgroup(&(0x7f00000009c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x0, 0x9, 0x0, 0x0, 0x1}, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x1) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) [ 154.703167][ T17] binder: undelivered TRANSACTION_ERROR: 29189 11:43:54 executing program 5: r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000100)=@req3={0x7ff, 0x7, 0x0, 0x3}, 0x1c) sendmmsg(r0, &(0x7f0000000000)=[{{&(0x7f0000000680)=@tipc=@name, 0x80, 0x0}}], 0x1, 0x0) 11:43:54 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffd49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x18, 0x0, &(0x7f00000006c0)=[@increfs, @clear_death], 0x0, 0x0, 0x0}) 11:43:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x21000008912, &(0x7f0000000080)="0adc1f123c123f319bd070") r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet(0x2, 0x2000000080002, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x2, 0x1d8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200005c0], 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000001100000000000000000076657468315f746f5f7465616d000000736974302000000000000400000000006272696467653000000000000000000076657468305f746f5f627269646765000180c2000000000000000000aaaaaaaaaa0000000000000000007000000070000000a80000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff01000000110000000000000000007465716c30000000000000000000000073797a5f74757e000000000000000000697036677265300000000000090000007663616e30000000d53fa73b00000000ffffffffffff000000000000aaaaaaaa98aa00000000000000007000000070000000a000000041554449540000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff00000000"]}, 0x228) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000180)=@broute={'broute\x00', 0x20, 0x1, 0x168, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000200], 0x2, 0x0, &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'bcsf0\x00\x00\x00\x00\b\x00', 's\x01\x000\x00\x00\x02\x00\x00\x00\xff\xff\x00', 'vcan0\x00', 'vlan0\x00', @broadcast, [], @empty, [], 0xa0, 0xa0, 0xd8, [@pkttype={'pkttype\x00', 0x8}]}}, @common=@mark={'mark\x00', 0x10, {{0x0, 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}, {0x0, '\x00', 0x1, 0xffffffffffffffff}]}, 0x1a4) [ 154.953202][ T9150] WARNING: CPU: 1 PID: 9150 at net/bridge/netfilter/ebtables.c:2035 compat_copy_entries+0xfe6/0x1360 [ 154.964429][ T9150] Kernel panic - not syncing: panic_on_warn set ... [ 154.971041][ T9150] CPU: 1 PID: 9150 Comm: syz-executor.3 Not tainted 5.1.0-rc6+ #82 [ 154.978940][ T9150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 154.989005][ T9150] Call Trace: [ 154.992310][ T9150] dump_stack+0x172/0x1f0 [ 154.996660][ T9150] ? compat_copy_entries+0xf80/0x1360 [ 155.000719][ T9152] binder: 9147:9152 transaction failed 29189/-22, size 24-8 line 2995 [ 155.002046][ T9150] panic+0x2cb/0x65c [ 155.014146][ T9150] ? __warn_printk+0xf3/0xf3 [ 155.016233][ T9152] binder: 9147:9152 ioctl c0306201 20000440 returned -14 [ 155.018750][ T9150] ? compat_copy_entries+0xfe6/0x1360 [ 155.031139][ T9150] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 155.037399][ T9150] ? __warn.cold+0x5/0x45 [ 155.041754][ T9150] ? compat_copy_entries+0xfe6/0x1360 [ 155.047142][ T9150] __warn.cold+0x20/0x45 [ 155.051395][ T9150] ? compat_copy_entries+0xfe6/0x1360 [ 155.053198][ T3876] kobject: 'loop5' (00000000e3c59a72): kobject_uevent_env [ 155.056779][ T9150] report_bug+0x263/0x2b0 [ 155.056800][ T9150] do_error_trap+0x11b/0x200 [ 155.056817][ T9150] do_invalid_op+0x37/0x50 [ 155.056830][ T9150] ? compat_copy_entries+0xfe6/0x1360 [ 155.056844][ T9150] invalid_op+0x14/0x20 [ 155.056867][ T9150] RIP: 0010:compat_copy_entries+0xfe6/0x1360 [ 155.056881][ T9150] Code: c0 3d 6f fb e9 05 fb ff ff e8 a6 27 37 fb 8b 9d 04 ff ff ff 31 ff 89 de e8 17 29 37 fb 85 db 0f 84 32 fd ff ff e8 8a 27 37 fb <0f> 0b bb ea ff ff ff e9 4f f5 ff ff bb ea ff ff ff e9 37 f5 ff ff [ 155.056888][ T9150] RSP: 0018:ffff888059a2f920 EFLAGS: 00010216 [ 155.064166][ T3876] kobject: 'loop5' (00000000e3c59a72): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 155.068456][ T9150] RAX: 0000000000040000 RBX: 0000000000000004 RCX: ffffc9000c452000 [ 155.068464][ T9150] RDX: 000000000000086b RSI: ffffffff86396566 RDI: 0000000000000005 [ 155.068472][ T9150] RBP: ffff888059a2fa90 R08: ffff888059a200c0 R09: ffffed1042d6ee33 [ 155.068480][ T9150] R10: ffffed1042d6ee32 R11: ffff888216b77197 R12: dffffc0000000000 [ 155.068487][ T9150] R13: 0000000000000000 R14: 0000000000000018 R15: ffff888059a2faf0 [ 155.068515][ T9150] ? compat_copy_entries+0xfe6/0x1360 [ 155.068548][ T9150] ? compat_table_info+0x670/0x670 [ 155.116944][ T12] binder: undelivered TRANSACTION_ERROR: 29189 [ 155.118681][ T9150] ? vmalloc+0x6b/0x90 [ 155.189269][ T9150] ? xt_compat_init_offsets+0x111/0x260 [ 155.194823][ T9150] ? xt_compat_init_offsets+0x1d9/0x260 [ 155.200361][ T9150] compat_do_replace+0x3b3/0x680 [ 155.205287][ T9150] ? refcount_dec_not_one+0x1f0/0x1f0 [ 155.210669][ T9150] ? do_ebt_set_ctl+0x110/0x110 [ 155.215511][ T9150] ? refcount_dec_and_test_checked+0x1b/0x20 [ 155.221490][ T9150] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 155.227725][ T9150] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 155.233954][ T9150] ? ns_capable_common+0x93/0x100 [ 155.238969][ T9150] compat_do_ebt_set_ctl+0x229/0x278 [ 155.244245][ T9150] ? compat_do_replace+0x680/0x680 [ 155.249344][ T9150] ? wait_for_completion+0x440/0x440 [ 155.254630][ T9150] ? mutex_unlock+0xd/0x10 [ 155.259031][ T9150] ? nf_sockopt_find.constprop.0+0x226/0x290 [ 155.264998][ T9150] compat_nf_setsockopt+0x9b/0x140 [ 155.270103][ T9150] ? compat_do_replace+0x680/0x680 [ 155.275206][ T9150] compat_ip_setsockopt+0x106/0x140 [ 155.280403][ T9150] compat_udp_setsockopt+0x68/0xb0 [ 155.285505][ T9150] compat_sock_common_setsockopt+0xb4/0x150 [ 155.291397][ T9150] ? udp_lib_setsockopt+0x9c0/0x9c0 [ 155.296592][ T9150] __compat_sys_setsockopt+0x181/0x380 [ 155.302034][ T9150] ? sock_common_setsockopt+0xe0/0xe0 [ 155.307393][ T9150] ? compat_sock_get_timestampns+0x220/0x220 [ 155.313358][ T9150] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 155.318800][ T9150] ? do_fast_syscall_32+0xd1/0xc98 [ 155.323913][ T9150] ? entry_SYSENTER_compat+0x70/0x7f [ 155.329196][ T9150] ? do_fast_syscall_32+0xd1/0xc98 [ 155.334294][ T9150] __ia32_compat_sys_setsockopt+0xbd/0x150 [ 155.340089][ T9150] do_fast_syscall_32+0x281/0xc98 [ 155.345124][ T9150] entry_SYSENTER_compat+0x70/0x7f [ 155.350219][ T9150] RIP: 0023:0xf7ff7869 [ 155.354288][ T9150] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 155.373897][ T9150] RSP: 002b:00000000f5df30cc EFLAGS: 00000296 ORIG_RAX: 000000000000016e [ 155.382296][ T9150] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000000000 [ 155.390254][ T9150] RDX: 0000000000000080 RSI: 0000000020000040 RDI: 0000000000000228 [ 155.398226][ T9150] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 155.406192][ T9150] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 155.414155][ T9150] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 155.423101][ T9150] Kernel Offset: disabled [ 155.427526][ T9150] Rebooting in 86400 seconds..