ffff9c, &(0x7f0000000100)='/dev/full\x00', 0x10000000, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000140)={0x0, 0x5}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000001c0)=@assoc_value={r2, 0x1f}, &(0x7f0000000200)=0x8) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:36 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 09:49:36 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f0000000500)={0x0, 0x0, [], {0x4, @bt={0x0, 0x8001, 0x1, 0x2, 0x80000000, 0x40, 0x3, 0x0, 0xffffffffffffff01, 0x4, 0x7, 0x4, 0xffffffff00000001, 0xe6, 0x0, 0x3}}}) socket$inet6(0xa, 0x5, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)=@in={0x2, 0x0, @local}, 0x80, &(0x7f00000000c0)=[{0x0}], 0x1}, 0x0) nanosleep(&(0x7f0000000300), &(0x7f0000000340)) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0) getresgid(&(0x7f0000000280), 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getegid() unshare(0x40000000) 09:49:36 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000020000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:36 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1760.700191][T31104] binder: 31100:31104 got transaction with invalid data ptr [ 1760.780584][T31104] binder: 31100:31104 transaction failed 29201/-14, size 24-0 line 3180 [ 1760.803421][T31103] IPVS: ftp: loaded support on port[0] = 21 [ 1760.818030][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:37 executing program 5: 09:49:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000003f000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:37 executing program 5: [ 1761.140758][T31314] binder: 31313:31314 got transaction with invalid data ptr [ 1761.168332][T31314] binder: 31313:31314 transaction failed 29201/-14, size 24-0 line 3180 [ 1761.218614][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:37 executing program 5: 09:49:37 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), &(0x7f00000002c0)=0xc) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) msgget(0x2, 0x8) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r2, 0x902, 0x70bd29, 0x25dfdbfb, {{}, 0x0, 0xb, 0x0, {0x14, 0x14, 'broadcast-link\x00'}}, ["", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040000) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000240)=0x8, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000220001000060000000000000e9000400"], 0x14}}, 0x0) 09:49:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000048000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:37 executing program 5: [ 1761.612751][T31599] binder: 31556:31599 got transaction with invalid data ptr [ 1761.634567][T31599] binder: 31556:31599 transaction failed 29201/-14, size 24-0 line 3180 [ 1761.659654][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:37 executing program 5: 09:49:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) open(0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f0000000500)={0x0, 0x0, [], {0x4, @bt={0x0, 0x8001, 0x1, 0x2, 0x80000000, 0x40, 0x3, 0x0, 0xffffffffffffff01, 0x4, 0x7, 0x4, 0xffffffff00000001, 0xe6, 0x0, 0x3}}}) socket$inet6(0xa, 0x5, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)=@in={0x2, 0x0, @local}, 0x80, &(0x7f00000000c0)=[{0x0}], 0x1}, 0x0) nanosleep(&(0x7f0000000300), &(0x7f0000000340)) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0) getresgid(&(0x7f0000000280), 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getegid() unshare(0x40000000) 09:49:39 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) r1 = request_key(&(0x7f0000000100)='dns_resolver\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)='/dev/full\x00', 0xfffffffffffffff9) r2 = request_key(&(0x7f00000001c0)='.request_key_auth\x00', &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000000240)='/dev/full\x00', 0xfffffffffffffff9) keyctl$link(0x8, r1, r2) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r3 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0xd840, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x225e, 0x0, @perf_config_ext, 0x10000, 0x0, 0x4, 0x0, 0x3, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140001362208000000000000000072"], 0x14}}, 0x0) 09:49:39 executing program 5: 09:49:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000004c000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:39 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:39 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:39 executing program 5: [ 1763.752111][T31742] binder: 31738:31742 got transaction with invalid data ptr [ 1763.796195][T31742] binder: 31738:31742 transaction failed 29201/-14, size 24-0 line 3180 [ 1763.838332][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000060000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1763.907209][T31747] IPVS: ftp: loaded support on port[0] = 21 09:49:40 executing program 5: [ 1764.022630][T31851] binder: 31850:31851 got transaction with invalid data ptr [ 1764.040035][T31851] binder: 31850:31851 transaction failed 29201/-14, size 24-0 line 3180 09:49:40 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$VIDIOC_ENUM_FREQ_BANDS(r0, 0xc0405665, &(0x7f0000000280)={0x1000, 0x4, 0x10001, 0x24, 0x8001, 0x9, 0x2}) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000000140)={0x9, {{0xa, 0x4e24, 0x1fffe000000, @dev={0xfe, 0x80, [], 0x21}, 0x4}}, {{0xa, 0x4e21, 0x7, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x7}}}, 0x108) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r0, 0xc0385720, &(0x7f0000000100)={0x1, {0x0, 0x989680}, 0x81, 0xdd}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1764.081736][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:40 executing program 5: 09:49:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000068000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1764.357742][T31960] binder: 31959:31960 got transaction with invalid data ptr [ 1764.383883][T31960] binder: 31959:31960 transaction failed 29201/-14, size 24-0 line 3180 [ 1764.416271][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:42 executing program 4: 09:49:42 executing program 5: 09:49:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000006c000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:42 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:42 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:42 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f0000000100)={0x75a, 0x77, "460d8e23b7b19eb71beccb610058e44bfa0d77a2f28a83fc8013f437b1c9a9e10baa8b026abc85b4df385d1682673538490798f622acdaa62c65318d09595b78c9bfd44e5bcdf858a5ab80f83260f5e87e90d75a248d42fd03bc4207e5f02ce2ac476f98c06008e47f7b8a1acce6176ed57e755646a0d3"}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1766.538627][T32177] binder: 32173:32177 got transaction with invalid data ptr 09:49:42 executing program 5: [ 1766.583149][T32177] binder: 32173:32177 transaction failed 29201/-14, size 24-0 line 3180 [ 1766.612914][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:42 executing program 4: inotify_init() r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$lock(r0, 0x26, &(0x7f0000000000)) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000240)=""/148, 0x94}], 0x30, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') preadv(r1, &(0x7f00000004c0)=[{&(0x7f0000000400)=""/159, 0x9f}], 0x1, 0x0) 09:49:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000074000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:42 executing program 5: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000180)='./file0\x00', 0xa400295c) r1 = open(&(0x7f0000fa3000)='./file0\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dc86055e0bceec7be070") dup2(r0, r1) [ 1766.915193][T32387] binder: 32356:32387 got transaction with invalid data ptr [ 1766.929183][T32387] binder: 32356:32387 transaction failed 29201/-14, size 24-0 line 3180 09:49:43 executing program 4: openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000080)='.\x00', 0xfe) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000240)=""/148, 0x94}], 0x30, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') preadv(r1, &(0x7f00000004c0)=[{&(0x7f0000000400)=""/159, 0x9f}], 0x1, 0x0) [ 1766.959603][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000007a000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:43 executing program 4: r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000080)='.\x00', 0xfe) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000240)=""/148, 0x94}], 0x30, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') preadv(r1, &(0x7f00000004c0)=[{&(0x7f0000000400)=""/159, 0x9f}], 0x1, 0x0) [ 1767.287532][T32697] binder: 32694:32697 got transaction with invalid data ptr [ 1767.319264][T32697] binder: 32694:32697 transaction failed 29201/-14, size 24-0 line 3180 [ 1767.336660][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:43 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='attr/prev\x00') write$FUSE_WRITE(r0, 0x0, 0x0) 09:49:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000080000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1767.571509][ T538] binder: 536:538 got transaction with invalid data ptr [ 1767.578533][ T538] binder: 536:538 transaction failed 29201/-14, size 24-0 line 3180 [ 1767.603435][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:44 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:44 executing program 5: syz_execute_func(&(0x7f00000003c0)="c4e379614832074a2be91cb9980f053ef3aec4a37bf0c50141e2e922ebc4a2fd1ceb262fed80660f38463da1637963000000f2d2dec461dc57b1e67d0b2500610051fa0040dbe1491e2f160f41fec53801bd050000001515bec5c54d0f2c718f56676beeee8f2870b63b30319ebb70fe6581f0430f40b267f34cb4baf281f999899999a8271e664105ba16f2ae66410f3a16288842f72bfd660fdf536bd1049999e1430fae27c4a27921f97cb190c447473a5f67f26443db7a0c383bd4d467460f330002a44064d266413a018f0860865120000f30ca30cac442fd21b19b0b0000ef00dd440fbc6dc5c4c2801d9c96c9e8e9362e36f2a79ad0818194d800092ddd8f0b00007b1cffd2c422b59aa9a7a400002e36646466264683b9080000000d5df698b90000002e440fdd0636b2aad9c741afa20f6baf00c4e39978c104c0414c598374fb0a070f001e00007c7c0000a858edc4037d092101f20f1dbe0010000000e5c565970d22045c0bf042111c20474cf92f5c657e002d0800000000db42a7a728f35666450f71e6994401a9bb000042c441574974ecd53131fbc4a2750831c44109f89700008020") 09:49:44 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) lookup_dcookie(0x10000, &(0x7f0000000100)=""/75, 0x4b) openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x301001, 0x0) 09:49:44 executing program 4: clone(0x200900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_procfs(0x0, 0x0) syz_execute_func(&(0x7f0000000c00)="c4e3f9614832074a2be93499980f0531f3aec4a37bf0c50241e2e98f2978cb4b9945982825c42205ba400f1b4f0063f9615f36450fc49cd2faffffff000a0000009200d2cce12164df1c7676dc55b1259d3294c7200000006868008080e285c401ede8c4f3490f2cf1f3440f7e32262d69e0e04cbee5c5c2858c3f8b56c4613fc25d9053c7a386c4213e5377000043d9c401a0150ef04111b900000000c4a1a0c24ccdc781438f34cc460f0f423f0d0f688030000000c422faf5dc16288a6c0fbc7b0f8eafd3d4470048001f8f5ac8c82ea25640b1b166420fe50231660fc402fd1c1ad809d8090f58d1e289e2892ec401785116164a0f3a162d000000004ac34402b7eeeef30f10900ad300003b7d0f36f083825158000007660f38f65e0cc42389793702e88c4200000000ca30ca10106cbb3cbb3c0247bb00005700180d36380d3638af6c0f4c84500099a3a3b62f818194d800d800dd4805640f01eec441057d94628d59000098c4c1f95bb800000020cbffff420f9294c300000021c4422140f7e4c22e2ea17c1002970606e9027e00006640aaf243af8374fb0a07c422b591bc0156a6ea62f2410f2ad8ed36660f38058b976192362665452110660fed3d0500000064f04681a9535c0000e934435f4a4a045c2066a273f0b926f240ab060f0f2ef2ad450ff191e2000000736d4401a9bb000042250101df29430f0f8800000000b464ec0b3161660f382a29880c000000c4427d9a22d7") 09:49:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000fffffdfd000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:44 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:44 executing program 5: syz_execute_func(&(0x7f0000000700)="c4e379614832074a2be91cb9980f05f7a6aae28920aec4a37bf0c50141e2e922ebc4a2c42281a7a56ea74dae1ceb262fc4c6cd97e664d11bc421fa6f3d136c000000f2d2dec461dc57b1e67d0b25c6c583417916d61abed61abedbe1491e2f160f41fe4cbec5c54d0f2c718f56676beeee8f2870b63b309df8f86dc483057f6e3e5340b267f34cb4ba6681f9935499fa6c1fed6c1feda8271ec4647168c4c19dfb96f88e00000f3a16288836e70f8babf27f0000536bd10499660f383ca3300a0000efef768b8b8b27c4a27921f940abd8a1a12ad764cc42dfdb4066bd0ffe383baa32d467460f3300028f6a78106f65030000004074d266413a010f0f30ca30cac442fd21b19b0b0000f267a1c900000000ddc4411171f200c4e3c10c090e6e4f01dcdc6298c9c949f1a79ad0818194d800092ddd8f0b00c4a17ae64295007bf21c1c22ba22baa9a700002e3664644626cc4683b9080000000dc4e27d0ed2b2aad9c741af78470f73dc024c593e40d9f50f001e570000a858edc4037d092101c42119da3cb011000000e5c5c421fb5a1747cc474cf9f2400f118b7b000000c4216f5a0cdac421fd29fa002d08000000009b5d8ea7a7282856fe0564650f1b88000000a0a041574974ecd5c4c1cdc28a0000000000c5a2750831c44109f89700008020") syz_execute_func(&(0x7f0000000000)="f3410f7fd164ff0941c3c4617be66a02660f3a16649c6700c4617b12e5c441dfd04b00c442019dcc0f11d46f") syz_execute_func(&(0x7f0000000280)="c4e379614832074a2be924f593980f053ef3aec4a37bf0c50141e2e90f6839c4437d3934e905262ff34290660f8fc978c65e1b1b63f1707802a60000f2d2c461fb12c736266765f241e109dc55b1e6250000c48251364669fa88008800859ecf491e2f16c2e54c80184cddcd8f56c42239b84900cc42319ebb70fe6581f0430dc0b267f34cb4ba1c585641564105ba16f2aec4018dfafbc423ed6cb83d0000fe7341ff50098f6838ee0a00c4c2799ff28f69609b5687a8e1430fae277cd8d8a1a12ad764b5c1c4213a5fc05fc18d308e8ed4f20f12e40000f440646666413a0f3930ca30ca5b5bc4a1adf289c1cedc065f0221c82b032b030900c4c2801dc481fa1691e4a30000c4a149deac665f00000049e8e9368f684895a3000000803fad467c4700a59ad08181d800f0092d9d8f0b00c4a17ae64295807b1cffd2fb2e36646466264683b9080000000df3423ae2660f18eec4075ec4c2712e51f5014cf7b3ddaccd58c442790e1c44edd48127e4d11249e5a2a992af4c4e0b0ba1389f9f92008000008047910002c1045c0b47cc47ccf92ff265460f940665002d08000000c40208f35824420fae06aa5e0f4401a9bb000042c441cbd1ecd53131fbf30f1b94d8a4ffffff") [ 1768.282538][ T655] binder: 651:655 got transaction with invalid data ptr [ 1768.337774][ T655] binder: 651:655 transaction failed 29201/-14, size 24-0 line 3180 [ 1768.389196][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:44 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) pipe(0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(0xffffffffffffffff, 0x84, 0x65, 0x0, 0x0) listen(r0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) recvfrom$inet6(r1, &(0x7f00000001c0)=""/31, 0xfffffffffffffe3c, 0x100, &(0x7f0000001880), 0x17c) ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) socketpair(0x0, 0x0, 0x0, 0x0) getsockopt$bt_sco_SCO_OPTIONS(0xffffffffffffffff, 0x11, 0x1, 0x0, 0x0) getsockopt$inet6_dccp_int(0xffffffffffffffff, 0x21, 0x0, 0x0, 0x0) 09:49:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000007fffffffefff000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1768.595743][ C0] net_ratelimit: 10 callbacks suppressed [ 1768.595754][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 09:49:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) write$binfmt_script(r1, 0x0, 0x0) [ 1768.740350][ T882] binder: 828:882 got transaction with invalid data ptr [ 1768.766097][ T882] binder: 828:882 transaction failed 29201/-14, size 24-0 line 3180 [ 1768.846730][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000ffffffff000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:45 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000140), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) [ 1769.148034][ T1319] binder: 1236:1319 got transaction with invalid data ptr [ 1769.178449][ T1319] binder: 1236:1319 transaction failed 29201/-14, size 24-0 line 3180 09:49:45 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:45 executing program 4: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x3, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000080085000000170000009500000000000000"], 0x0, 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x0, 0xe, 0x0, &(0x7f0000000200)="2962e37ccce87e6d095ed9adc399", 0x0}, 0x28) [ 1769.224805][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:46 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="143d2edac500"], 0x14}}, 0x0) 09:49:46 executing program 4: 09:49:46 executing program 5: 09:49:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000060ffffffffff000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:46 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:46 executing program 4: [ 1769.903817][ T1574] binder: 1561:1574 got transaction with invalid data ptr 09:49:46 executing program 5: [ 1769.962199][ T1574] binder: 1561:1574 transaction failed 29201/-14, size 24-0 line 3180 09:49:46 executing program 4: [ 1770.030292][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:46 executing program 5: 09:49:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000002000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:46 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:46 executing program 4: 09:49:46 executing program 5: 09:49:46 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) ioctl$TIOCLINUX2(r0, 0x541c, &(0x7f0000000100)={0x2, 0x0, 0x61, 0x3, 0x4, 0x2}) [ 1770.432353][ T1693] binder: 1691:1693 got transaction with invalid data ptr [ 1770.466985][ T1693] binder: 1691:1693 transaction failed 29201/-14, size 24-0 line 3180 09:49:46 executing program 4: 09:49:46 executing program 5: [ 1770.537736][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:47 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:47 executing program 5: 09:49:47 executing program 4: 09:49:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000003000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1770.973819][ T1916] binder: 1912:1916 got transaction with invalid data ptr 09:49:47 executing program 4: 09:49:47 executing program 5: [ 1771.015157][ T1916] binder: 1912:1916 transaction failed 29201/-14, size 24-0 line 3180 [ 1771.062742][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:47 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:47 executing program 4: 09:49:47 executing program 5: 09:49:48 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f0000000100)={'security\x00', 0x4f, "3b2352c303cd57833b278ae36413c6a3ef16ec5ddc3ee201b17f4f6940e768b2fbc8bd846999f5d128485413119a9f8422842268045c669eea9883e8b42e9e24d8d26cf02a27186186e12686c2e92e"}, &(0x7f0000000180)=0x73) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000004000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:48 executing program 4: 09:49:48 executing program 5: 09:49:48 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:48 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_execute_func(&(0x7f00000005c0)="984a2ae92c0b964c0f05bf00000020c4a37bf0c5bf41e2e9c422e9aabb3cdf000464f3460f1b28e00f0f383a9e0200000047d8f182efefa265aa104b2636a00f38091e2fa2631bc421045f4607e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a00efc44149e85c4d31459d6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d8c4821d09230000000fc4634148f70000c27ba066429800cca27a0e0f0e0f712f358f0000000f9f3c6436b266450fc4650000c4e39978c104d9a1e8719e70ddcdcda21a383468004c48e32f5dc441955c54dddf3dc8a3c4c141d9f8cc7d75c4426507af0f0000000f5fd25cf3460f2ad00f664199ff83660f79ca558f0810cf4bc8bdb03a6208cf") ioctl$VIDIOC_S_JPEGCOMP(0xffffffffffffffff, 0x408c563e, &(0x7f00000000c0)={0x0, 0x0, 0x0, "15cc0baf522991eebee3ebb8989e2329a436ebd184e29acda08c45039d9ec0a0698e50247640af2c5edde7f6f1e120fa62c02585415a754256445d33", 0x0, "26fc30d1ac59c80831aa79c57a939ac3b78921b21132655caf4f7a7e4d280def7efda6f01b7a67d8a2385149d5e03e694f804668cdb7b16cc0360fcb", 0x40}) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000080)=0x9, 0xfee8) [ 1772.270155][ T2140] binder: 2138:2140 got transaction with invalid data ptr [ 1772.298391][ T2140] binder: 2138:2140 transaction failed 29201/-14, size 24-0 line 3180 09:49:48 executing program 5: io_setup(0x8000000000e6c, &(0x7f0000000040)) io_setup(0x400000000200, &(0x7f00000001c0)) io_setup(0x1e0, &(0x7f0000000140)) pause() syz_execute_func(&(0x7f0000000d00)="c4e3f9614832f0422be93699980f053ef3aec4a37bf0c50541e2e966b5c9459866430f3a225c750000f36da30000262ff342906646da4e3264470fae966b000000c0c561dc55b1e617c4c2158e260f1844f200627947de3c9145800080fc5a859ecf6cf365df250d000000c421bd14d8e97c810f69e08f4cbec5c4c2858c3f8f56caca6182c61d10660f767df643d9497dbfc086595943c4423d924cb701e7e63cb3d255ece4a2e1970eaa6641d50f1d780716286c6c0fbc7b1f00008f08e4a25600b1c4e205b6ae256c00000909660fdf53090908f3a5851f36f37d0707c7c77b027dbe42eae2897474dcc4f6f6585ffcc2f043fe02660f38de8e85e1f3263b7d26c22f75c6202001d9fac40232fd034c4c0fc4e2210e8d20d28ccc4288870a000000456bbbf7a9efc4c219190c0900c4a38d7838f69b0f4047028f2944928d7100c462298c9ba7000000d80066460fee8ec4a1816575000f4f62006e610bae14ae147adf5342425838ffffc44345690afb4577cb0c0cc463510d5f0035c441a85f31972e660f38df910b000000c4e3510fbcb3e834e63d46260f38c9ba0f000000f345a7c422f941d38374fb0a07c401f1eb27f2a4acecc4a3f16d86c6d0000009f4ec09f4c46169656a450f1ecc0b47cc47cc5c38259f060f0f83b47ef53f0000b1c94401a9bb000042d8fbf13c65ecec31c4515184951ee4f5950f0f8db20c0000bfe4f50f64830aaeac04") [ 1772.343161][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000005000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:48 executing program 4: pause() syz_execute_func(&(0x7f0000000340)="0ffee54a2be93699980f053ef3aec4a37bf0c50341e2e926b5c9f2abc4e521b8c25cb100c401a0148c25000000003581810000262f6947d9f96646da4e32c4c2b9b6b90000000000d2dec461c44299ae40003a1713242500c18181470f9080008047f08fe97c810f69e08f4cbec5c4c2858c3f2d56c4613fc21d9053c7ab86c4213e5377000043d9497d410fa9a642857e00c3c30f3a603d06f0ffff0066400f3a16c01f564105ba16f2aed9fdc4c2f107d8f5eba225adeab413c4c37d096208c2c481fa706b00f9c60008c481b1f39f0d0000005600b150400f381da900e001f0428155fdd2cb0000c6d59134ffffff66dee44343c442f191047b8f49580197feffff7f4080a009210000df3b7d0fc4c1fc2eca00f4260fe88c4200000000a8c461906104f366420fdb7e99337b6b0000912af3430fc4c17829c8c463ad0b5890ca4256f29c3c50007700776466420f3a0b0100d8008fe978cce16ac421f85235e67a0000ef9dbe8f00000f383066410f689b0c0000002b6e0b45d8ade0000000f0f0839200000080a7210aff4968d38bd38bc390ffc367f2460f0146784711af77cb44cb44e42ec4a17c10020f1541220606b2aa246681380010c402c423f963c6000f7e54880d4757c40155f64e06ec68470afceb82e262e3469797c1045c0b04cc5cc40341783b0064450fe242d9c481635a9c70d3813811fa174e484e40c91b41fc1d6fe5431b1b1bd5663ef0430fabb908000000880c0000003422") [ 1772.710085][ T2424] binder: 2423:2424 got transaction with invalid data ptr [ 1772.772021][ T2424] binder: 2423:2424 transaction failed 29201/-14, size 24-0 line 3180 [ 1772.835194][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:49 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:49 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480)=[{&(0x7f00000000c0)=""/132, 0x84}], 0x1, 0x0) 09:49:49 executing program 4: syz_execute_func(&(0x7f0000000000)="f3410f7fd164ff0941c3c4617be66a02660f3a16649c6700c4617b12e5c441dfd04b00c442019dcc0f11d46f") syz_open_procfs(0x0, 0x0) syz_execute_func(&(0x7f0000000f00)="c4e379614832074a2be924f593980f053ef3aec4a37bf0c50141e2e90f6839c4437d3934e905262ff34290660f8fc978c65e1b1b63f1707802a60000f2d2c461fb12c736266765f241e109dc55b1e6250000f4cc82513e46696988008800859ecf491e2f16c2e54c80184cddcd8f56c42239b84900cc42319ebb70fe6581f0430dc0b267f34cb4ba1c585641564105ba16f2aec4018dfafbc423ed6cb83d0000fe7341ff50098f6838ee0a00c4c2799ff28f69609b5687a8e1430fae277cd8d8a1a12ad764b5c1c4213a5fc05fc18d308e8ed4f20f12e40000f440646666413a0f3930ca30ca5b5bc4a1adf289c1cedc065f0221c82b032b0309e20000c4c2801dc481fa1691e4a30000c4a149deac665f00000049e8e9368f684895a3000000803fad467c4700a59ad08181d800f0092d9d8f0b00c4a17ae64295807b1cffd2fb2e36646466264683b9080000000df3423ae2660f18eec4075ec4c2712e51f5014cf7b3ddaccd58c442790e1c44edd48127e4d11249e5a2a992af4c4e0b0ba1389f9f92008000008047910002c1045c0b47cc47ccf92ff265460f940665002d08000000c40208f35824420fae06aa5e0f4401a9bb000042c441cbd1ecd53131fbf30f1b94d8a4ffffff") 09:49:50 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0xfffffffffffffffc, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$KDSETLED(r0, 0x4b32, 0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x534f, 0xfffffffffffffc01, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="1400000022000100006000000000000004000000aa2f580554dab2e054d73c1144d9911183a1c7f439bf31dda35de4693513303eb7528894397f27c413e69972e15d68a45e5b335e2c274bbc8bdf168cbd931dc2ed1f11a979b2e4ee15eb193037aef40898947d83cdd3a136acf257eb875cd398f8e2ec2e182ef7a1724045b745f2efff9256f664d2c4cc8cbecbb3fce750c801fc79e8ad9fa4a1dbaf5f02c92aa9d88c14edd6ac0b118ac8bd8397f89d043fe74240170976327a72a9b27b21cac0afd6f03bb5ec6954b2d444753e5e5429dd878c7d5bc883456a6c907043e117bbfb6355424f0e88836d383a5a200b29ac761b84e3cd9179c75bc441f5403f0392f8bdac82c7ff6fffc8a6a0dd06d01c757bfe59296e9404fba8664fee81b3789bb629831e0c9605bf1fffb0028a41dc8685fbccdb33ab81c0e36e5d3098890e98655fde6ec04cde6ab2d5d5bdd952a3a407cd06ebaaa2611876651217789e382700000000991d31d100b2b18f8db020ff43683835a9633b5c567dfa97861b44ae0150fd21bbd876cf8128514ec01e66f4d92d139e9843aabf4a09448f5cc1b5a0073cd8b05335cd553da5bad7b1c5eccee810241fc30a59e6c73ae32cadd368f7bf95b1332f0eefc7eee81e1a6887ac4c2b9cec68a8966926ed1cf3a78e378826c2d35e780937f75ae74156100ba6b79f6e925690b69a3ee48469c95f3fe8ab5f1aac6956ca37194f2c"], 0x14}}, 0x0) 09:49:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000006000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:50 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) timerfd_gettime(r0, &(0x7f0000000140)) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) fanotify_mark(r0, 0x2, 0x10, r2, &(0x7f00000000c0)='./file0\x00') sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000220400280000c80e00fbff000004000000"], 0x14}}, 0x0) 09:49:50 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:50 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) splice(r0, &(0x7f00000000c0), r1, &(0x7f00000002c0), 0x8, 0x8) ioctl$DRM_IOCTL_GET_STATS(r0, 0x80f86406, &(0x7f0000000100)=""/125) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="bcffffff22000002006000000000000004000000ac20e3beaed03907507e66b552cfb7e9556779c55eb3b29b43c93324908f0c04358069b2ef041d8516766b765cfc3bb6840d92c10cc6ccffffffff00000000ec4feb6bc1386010b21d06ab553016090c15a801bf2949fd5f7d402c0703f03b0b0939de2826ec1ab5bb87bb79793e3483f6e1d815ebdb0b34f0b8e0b9c25d8ffc7b5ba9d204005eed858d2082394b3cf8a5f400cf2916df6208e916b8dd3ae504c2634c7dd6c6b68d96edf54eb8026199e06eca61a5f55bbaa7e06cae5c004e8e7369012cc246d4357a9f79b99825d5b531c74a100036d5e90c7ade9ea0b8d703bb61eba8da0000300020000000000000"], 0x2c2}}, 0x0) 09:49:50 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1774.202924][ T2769] binder: 2767:2769 got transaction with invalid data ptr [ 1774.254053][ T2769] binder: 2767:2769 transaction failed 29201/-14, size 24-0 line 3180 09:49:50 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, 0x0) getdents64(r0, &(0x7f0000000100)=""/4096, 0x1000) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000001180)={0x34, 0x0, &(0x7f0000001140)}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1448, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000001100)='/dev/mISDNtimer\x00', 0x480, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000001200)={0x6, &(0x7f00000011c0)=[{0x1, 0x3f, 0x9, 0x80000000}, {0x10000, 0x6, 0x6, 0x35d}, {0x5, 0xfffffffffffff3e2, 0x3, 0x7f}, {0x0, 0xffffffff80000001, 0xab, 0x3}, {0x0, 0xba, 0x1, 0x2}, {0x5, 0x5, 0xa8df, 0x1c}]}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:50 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1774.310210][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000007000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1774.739427][ T2884] binder: 2883:2884 got transaction with invalid data ptr [ 1774.759150][ T2884] binder: 2883:2884 transaction failed 29201/-14, size 24-0 line 3180 [ 1774.777984][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000a000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:51 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1775.165108][ T3098] binder: 3088:3098 got transaction with invalid data ptr [ 1775.181441][ T3098] binder: 3088:3098 transaction failed 29201/-14, size 24-0 line 3180 [ 1775.202766][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000012000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1775.445975][ T3235] binder: 3234:3235 got transaction with invalid data ptr [ 1775.464988][ T3235] binder: 3234:3235 transaction failed 29201/-14, size 24-0 line 3180 [ 1775.487814][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:52 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={r0, 0x28, &(0x7f00000000c0)}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="1400000022000100006000000000000004000000ef59dd14eb5fa224698ced21b2f7e7a10b971496341ce9931a7561f28b8d859c3ad0f83cd17088f20f3278d87f080b87a03bd02d8b"], 0x14}}, 0x0) 09:49:52 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000018000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:52 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0xa000000) 09:49:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r1, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1776.137040][ T3369] binder: 3365:3369 got transaction with invalid data ptr [ 1776.146352][ T3369] binder: 3365:3369 transaction failed 29201/-14, size 24-0 line 3180 [ 1776.164409][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000048000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r1, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1776.436969][ T3677] binder: 3676:3677 got transaction with invalid data ptr [ 1776.450832][ T3677] binder: 3676:3677 transaction failed 29201/-14, size 24-0 line 3180 [ 1776.468704][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:52 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000004c000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1776.743497][ T3894] binder: 3861:3894 got transaction with invalid data ptr [ 1776.759945][ T3894] binder: 3861:3894 transaction failed 29201/-14, size 24-0 line 3180 [ 1776.793907][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000060000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r1, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:49:53 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1777.072973][ T3999] binder: 3997:3999 got transaction with invalid data ptr [ 1777.102152][ T3999] binder: 3997:3999 transaction failed 29201/-14, size 24-0 line 3180 [ 1777.156047][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:54 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountstats\x00') ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000000180)={0x5, 0x70, 0x20, 0x7, 0x1, 0x8001, 0x0, 0x0, 0x2, 0x7, 0x7ff, 0x29378450, 0x3, 0x8, 0x9, 0x6, 0x8000, 0x7ff, 0x80, 0x4, 0x40, 0x7, 0x8, 0x7ff, 0x7ff, 0x7fff, 0x8, 0x8, 0x0, 0x3, 0x66e4, 0x7fffffff, 0xcfa, 0x200, 0x8, 0x4, 0x21, 0xffff, 0x0, 0x3, 0x5, @perf_bp={&(0x7f0000000140), 0x2}, 0x0, 0x7018, 0x100, 0x7, 0x10000, 0x5, 0x8}) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r2 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e24, 0x4, @remote, 0x3}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000300)={r3, 0x9}, 0x8) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000380)={0x4000000000000000, 0x1f002, 0x3, 0x1, 0x1}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(r2, 0x40e, &(0x7f0000000340)=0x4000000000000000) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="1400e2280000e5d8650249a22ee3f5cd0ed7e7ba8a824ee48bbcf79778c9054f42f6b9ffffb0a7f039f14c4542288caf236955972cc6af1b8d8c58401e6167b4d05f23f9b6ea90babdff0f000000000000ffc1c93072b63fb2927df665706af12bf9938e6e96c2c7f47ef8908e1c811f9b5c56e3b788ab58661133eb7a9acb5cb00a054bd51fea28d65a7289d70abf3b5e75b3c8e508f79c42c4b430166892c68573b8252984865767a9090000000039e1c57e5f6cf0f4b4eb00000000000000418d81a8e2c29c282fc3cd1b708b4cbfaff466a57e5add6d11372012757569cc83168a0bca4d6542261253eaee291371f1a92c9193bd4374a48aad44d9600c26a166f00e68fff7fd8add0dbefed7a6837ac279b8bcff107c5f7cb6210602eb3e368fdc207b71f270a279a327e21b588bb017491f216222badcbf110b6b1463bb76e4ea845216a0359bdd49dd1c64f63293863328128b07282f68eaefcec3f341e383468a46920274f5e2347fbbeba495bc01ee455fdfcbf23b2911f462ac19ce302705df43573e6c5651c847a0737e53eb18f6f71fac03e44af6eba110aa5fbc84ee4d479d09ebec4de923b60116aa38"], 0x14}}, 0x0) 09:49:54 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000068000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:54 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000018000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1778.015243][ T4320] binder: 4314:4320 got transaction with invalid data ptr [ 1778.042685][ T4320] binder: 4314:4320 transaction failed 29201/-14, size 24-0 line 3180 [ 1778.055660][ T4321] binder: BINDER_SET_CONTEXT_MGR already set [ 1778.069324][ T4321] binder: 4316:4321 ioctl 40046207 0 returned -16 [ 1778.083240][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 [ 1778.102920][ T4321] binder: 4316:4321 got transaction with invalid data ptr [ 1778.134604][ T4321] binder: 4316:4321 transaction failed 29201/-14, size 24-0 line 3180 09:49:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000006c000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:54 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000100)={r0, 0x1, 0xfffffffffffff000, 0x10000fffff000}) [ 1778.188782][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:54 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r1, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1778.308598][ T4428] binder: 4426:4428 got transaction with invalid data ptr [ 1778.350568][ T4428] binder: 4426:4428 transaction failed 29201/-14, size 24-0 line 3180 [ 1778.380743][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000074000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1778.624713][ T4622] binder: 4603:4622 got transaction with invalid data ptr [ 1778.655823][ T4622] binder: 4603:4622 transaction failed 29201/-14, size 24-0 line 3180 [ 1778.688550][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000007a000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r1, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1778.970491][ T4845] binder: 4844:4845 got transaction with invalid data ptr [ 1778.979551][ T4845] binder: 4844:4845 transaction failed 29201/-14, size 24-0 line 3180 [ 1778.990432][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:55 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000030000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1779.263197][ T5040] binder: 5001:5040 got transaction with invalid data ptr [ 1779.286527][ T5040] binder: 5001:5040 transaction failed 29201/-14, size 24-0 line 3180 09:49:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r1, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1779.311533][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:55 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000050000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1779.540842][ T5169] binder: 5168:5169 got transaction with invalid data ptr [ 1779.561951][ T5169] binder: 5168:5169 transaction failed 29201/-14, size 24-0 line 3180 09:49:55 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1779.598669][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:49:56 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$bt_hidp(0x1f, 0x3, 0x6) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="14c0a36f31000003000000004f3e0d9186f4206783"], 0x14}}, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000180)=@bpq0='bpq0\x00', 0x10) 09:49:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000060000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:56 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0xe00) [ 1780.207423][ T5377] binder: 5374:5377 got transaction with invalid data ptr [ 1780.225256][ T5377] binder: 5374:5377 transaction failed 29201/-14, size 24-0 line 3180 [ 1780.272259][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:56 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x4009}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8923, &(0x7f0000000040)='nr0\x01:\xf2.\xa3\'>\xf8]\x81$?\xfa\xbf1UM\xbf\xef\xa9\xac\x06x\xf4D3A}?\x00\x8b\x9c[\xdd\x06\xa4%\xf4\x94\xa8>\xb1\xb1\xa2_&') 09:49:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000070000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:56 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) r1 = syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x0, 0x0) ioctl$RTC_WKALM_SET(r1, 0x40247007, &(0x7f0000000040)={0x0, 0x0, {0x0, 0x300}}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_SET_PIT(r0, 0x8048ae66, &(0x7f00000001c0)={[{0x5, 0x1, 0x8, 0x4, 0x5, 0x2, 0x8, 0x2, 0x2, 0x8000000000, 0x9, 0x9, 0x8fc}, {0xfffffffffffffff7, 0x2782, 0xffffffffffffffff, 0x81, 0x100000000, 0xfffffffffffffffb, 0x2, 0x7, 0x8, 0x6, 0x4, 0x3, 0x200}, {0x3, 0x7f, 0x4, 0x8000, 0x5, 0x2, 0x5, 0x9, 0x3, 0x8, 0x8000, 0x51ce86d0, 0x2}], 0x5}) ioctl$KVM_SET_PIT(r0, 0x8048ae66, &(0x7f0000000140)={[{0x5, 0x0, 0x10000, 0x96bc, 0x7, 0x4f, 0x0, 0x2, 0x8000, 0x5, 0x2, 0x6}, {0x0, 0x4b, 0x8, 0x1, 0x80, 0x0, 0x6000000000000, 0x3, 0x1, 0x1, 0x8, 0x1, 0x81}, {0x5, 0x4, 0xffffffffffff8f29, 0x8000, 0xc86, 0x8a, 0x5, 0xff, 0x80000001, 0x4, 0x7, 0x1, 0x9}], 0x7}) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000100)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1780.482587][ T5586] binder: 5585:5586 got transaction with invalid data ptr [ 1780.493025][ T5586] binder: 5585:5586 transaction failed 29201/-14, size 24-0 line 3180 [ 1780.514886][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000a0000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:56 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1780.756378][ T5793] binder: 5792:5793 got transaction with invalid data ptr [ 1780.774656][ T5793] binder: 5792:5793 transaction failed 29201/-14, size 24-0 line 3180 [ 1780.793048][T22742] binder: undelivered TRANSACTION_ERROR: 29201 09:49:57 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x4009}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8923, &(0x7f0000000040)='nr0\x01:\xf2.\xa3\'>\xf8]\x81$?\xfa\xbf1UM\xbf\xef\xa9\xac\x06x\xf4D3A}?\x00\x8b\x9c[\xdd\x06\xa4%\xf4\x94\xa8>\xb1\xb1\xa2_&') 09:49:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000120000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:57 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000180000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:57 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x4009}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8923, &(0x7f0000000040)='nr0\x01:\xf2.\xa3\'>\xf8]\x81$?\xfa\xbf1UM\xbf\xef\xa9\xac\x06x\xf4D3A}?\x00\x8b\x9c[\xdd\x06\xa4%\xf4\x94\xa8>\xb1\xb1\xa2_&') 09:49:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000200000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:57 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x4009}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8923, &(0x7f0000000040)='nr0\x01:\xf2.\xa3\'>\xf8]\x81$?\xfa\xbf1UM\xbf\xef\xa9\xac\x06x\xf4D3A}?\x00\x8b\x9c[\xdd\x06\xa4%\xf4\x94\xa8>\xb1\xb1\xa2_&') 09:49:57 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x4009}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8923, &(0x7f0000000040)='nr0\x01:\xf2.\xa3\'>\xf8]\x81$?\xfa\xbf1UM\xbf\xef\xa9\xac\x06x\xf4D3A}?\x00\x8b\x9c[\xdd\x06\xa4%\xf4\x94\xa8>\xb1\xb1\xa2_&') 09:49:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000003f0000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1781.923911][ T6420] ¿1UM¿ï©¬xôD3A}: renamed from nr0 09:49:58 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0x400000, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, 0x0) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000240)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$CAPI_SET_FLAGS(r0, 0x80044324, &(0x7f00000001c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_AGP_INFO(r0, 0x80386433, &(0x7f0000000100)=""/169) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000400000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:58 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:58 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x4009}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8923, &(0x7f0000000040)='nr0\x01:\xf2.\xa3\'>\xf8]\x81$?\xfa\xbf1UM\xbf\xef\xa9\xac\x06x\xf4D3A}?\x00\x8b\x9c[\xdd\x06\xa4%\xf4\x94\xa8>\xb1\xb1\xa2_&') 09:49:58 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x4009}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8923, &(0x7f0000000040)='nr0\x01:\xf2.\xa3\'>\xf8]\x81$?\xfa\xbf1UM\xbf\xef\xa9\xac\x06x\xf4D3A}?\x00\x8b\x9c[\xdd\x06\xa4%\xf4\x94\xa8>\xb1\xb1\xa2_&') 09:49:58 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000480000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000004c0000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1783.067421][ T7150] binder_transaction: 6 callbacks suppressed [ 1783.067432][ T7150] binder: 7149:7150 got transaction with invalid data ptr [ 1783.105104][ T7150] binder_transaction: 6 callbacks suppressed [ 1783.105124][ T7150] binder: 7149:7150 transaction failed 29201/-14, size 24-0 line 3180 [ 1783.149009][ T4724] binder_release_work: 6 callbacks suppressed [ 1783.149017][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:49:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000600000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:49:59 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x4009}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8923, &(0x7f0000000040)='nr0\x01:\xf2.\xa3\'>\xf8]\x81$?\xfa\xbf1UM\xbf\xef\xa9\xac\x06x\xf4D3A}?\x00\x8b\x9c[\xdd\x06\xa4%\xf4\x94\xa8>\xb1\xb1\xa2_&') [ 1783.438124][ T7359] binder: 7356:7359 got transaction with invalid data ptr [ 1783.457813][ T7359] binder: 7356:7359 transaction failed 29201/-14, size 24-0 line 3180 [ 1783.497315][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:49:59 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:49:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000ff600000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1783.834704][ T7572] binder: 7571:7572 got transaction with invalid data ptr [ 1783.853767][ T7572] binder: 7571:7572 transaction failed 29201/-14, size 24-0 line 3180 [ 1783.872762][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:00 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="00f903b8f9643ffd5bb9140000d12b0001e9ba0100000000000004000002e4ef2f0900000000000000790aa78d45845ede13f5e63d97997f046aadec6d3e4db7e8"], 0x14}}, 0x0) 09:50:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000007a00000000000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:00 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x4009}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8923, &(0x7f0000000040)='nr0\x01:\xf2.\xa3\'>\xf8]\x81$?\xfa\xbf1UM\xbf\xef\xa9\xac\x06x\xf4D3A}?\x00\x8b\x9c[\xdd\x06\xa4%\xf4\x94\xa8>\xb1\xb1\xa2_&') [ 1783.955249][ T7654] binder: BINDER_SET_CONTEXT_MGR already set 09:50:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000680000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1784.001841][ T7654] binder: 7637:7654 ioctl 40046207 0 returned -16 09:50:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000007a00000000000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:00 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1784.182146][ T7923] binder: 7922:7923 got transaction with invalid data ptr [ 1784.204607][ T7923] binder: 7922:7923 transaction failed 29201/-14, size 24-0 line 3180 09:50:00 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000, 0x3000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$IOC_PR_RESERVE(r0, 0x401070c9, &(0x7f0000000100)={0x1, 0x3}) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1784.272050][ T7927] binder: BINDER_SET_CONTEXT_MGR already set [ 1784.307801][ T7927] binder: 7925:7927 ioctl 40046207 0 returned -16 [ 1784.307807][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 [ 1784.351942][ T7927] binder: 7925:7927 got transaction with invalid data ptr [ 1784.376779][ T7927] binder: 7925:7927 transaction failed 29201/-14, size 24-0 line 3180 [ 1784.437133][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000006c0000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:00 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1784.585370][ T8103] binder: 8084:8103 got transaction with invalid data ptr [ 1784.601955][ T8103] binder: 8084:8103 transaction failed 29201/-14, size 24-0 line 3180 [ 1784.625774][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:50:00 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:01 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000740000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1784.933488][ T8246] binder: 8245:8246 got transaction with invalid data ptr [ 1784.956669][ T8246] binder: 8245:8246 transaction failed 29201/-14, size 24-0 line 3180 [ 1785.018179][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000007a0000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:01 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1785.320215][ T8353] binder: 8352:8353 got transaction with invalid data ptr [ 1785.341020][ T8353] binder: 8352:8353 transaction failed 29201/-14, size 24-0 line 3180 [ 1785.370417][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000940000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1785.606899][ T8462] binder: 8461:8462 got transaction with invalid data ptr [ 1785.619113][ T8462] binder: 8461:8462 transaction failed 29201/-14, size 24-0 line 3180 [ 1785.643881][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:01 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000022000e000060000000000000040000000ecf6184eba998e0fdcc7887bad802d7939f531d4ecb3d52820ecf52194fe6b85d"], 0x14}}, 0x0) 09:50:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000004000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:02 executing program 5: openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x4009}) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8923, &(0x7f0000000040)='nr0\x01:\xf2.\xa3\'>\xf8]\x81$?\xfa\xbf1UM\xbf\xef\xa9\xac\x06x\xf4D3A}?\x00\x8b\x9c[\xdd\x06\xa4%\xf4\x94\xa8>\xb1\xb1\xa2_&') [ 1785.926413][ T8667] binder: 8612:8667 got transaction with invalid data ptr [ 1785.950598][ T8667] binder: 8612:8667 transaction failed 29201/-14, size 24-0 line 3180 [ 1785.978074][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:02 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000715000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:02 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0xf, 0x800, 0x9) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000220001000060000000000000040079b3"], 0x14}}, 0x0) 09:50:02 executing program 5: openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x4009}) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socket$kcm(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8923, &(0x7f0000000040)='nr0\x01:\xf2.\xa3\'>\xf8]\x81$?\xfa\xbf1UM\xbf\xef\xa9\xac\x06x\xf4D3A}?\x00\x8b\x9c[\xdd\x06\xa4%\xf4\x94\xa8>\xb1\xb1\xa2_&') 09:50:02 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000d05000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000003f00000000000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:02 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000c07000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:02 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000507100000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000007400000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:03 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0) 09:50:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000009400000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:04 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = dup(r0) sendmsg$nl_generic(r2, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f0000000140)={0x1dc, 0x18, 0x100, 0x70bd2c, 0x25dfdbfd, {0x11}, [@generic="a2ad18b00f95b8739ce9f7ccc9057e8f415370064453f4e3cf237ec305b4f73f332c1c295fdfddb19bfcddf0a4c638fa509e469d027db9d57068e8646444489665205042db805b4a01898f99cecabe275d878d274bbc42a74323b4d7c8ab7b923e163f73cd7ab7a48b55bd590b45970442847bd9d2f2f67e3859c960e847d0eab8a33ef7536c0cdeeae32ae2011ebe688339839e6995681faf52847b1ff2e1bf0ee615d00eeff94ad141692b889c3aacda848e10e11725e5c9ffd60669e7d4e4c0301edb45c0661aa26b337a670d2033e291b16d3e27c46f88f937a77ce69e2fff1eb03e67c6b5d3", @generic="e89cd83b4b02697f50da0aca7e105641089d1bba62337b3dd9951f6d0b41cbb5c6c5ce4b182f38aef9137d9ff19515b9ef3c0f23d7dbb13b21b140f52851b17c99f95851fc7d380b8b137ed8635057bcb749d4edff5ad6b8a0b08f6de26ed1c459187e95d2e1c168ffa6251f010dbb4d70d17c03324b2f1a66a15663cfedc88192ebbe91b92ad89643de7a6725e3d80ca50274dc8c632cfcd7c13db8855c28767f895d47c9ee719ca23751c8c534336af9e94cdc785a75af9805e73b491c402677853c039cf8caf8453e006dc9872d8a4b25fe069b53c00b893528de75f49961"]}, 0x1dc}, 0x1, 0x0, 0x0, 0x40040}, 0x81) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000002200"], 0x14}}, 0x0) 09:50:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000070c000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:04 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:04 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1788.237561][ T9635] binder_transaction: 7 callbacks suppressed [ 1788.237571][ T9635] binder: 9632:9635 got transaction with invalid data ptr [ 1788.308097][ T9635] binder_transaction: 7 callbacks suppressed [ 1788.308118][ T9635] binder: 9632:9635 transaction failed 29201/-14, size 24-0 line 3180 [ 1788.357751][ T7899] binder_release_work: 7 callbacks suppressed [ 1788.357759][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000050d000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1788.543571][ T9744] binder: 9743:9744 got transaction with invalid data ptr [ 1788.599172][ T9744] binder: 9743:9744 transaction failed 29201/-14, size 24-0 line 3180 [ 1788.622448][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:05 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:05 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x7fff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)="c5e54601f523bc2b0222c0c9b16c3b6f2c2ba9cafe547a1328ed448ddbc4d2f3adea3eb37822929bca4fc3cd39c4a7743affe89dfa55478e7e6cd118ef2301cf42b2373ec5c0f5a4f81f44879590bc03481fcf9add7c2ba616cfbdfa4aa2c2fd39581f84fd13a2fcad21d724c070879bceab3a8f9adebe05bece5040fc7c0735a0bbfc1f24f94163b74f1022862b9dfdc9e14dfb0696fe3d37372c15d51ffc1b1f5c821042333954af84e3945838c76738a13902d00f8f5f2bff6968fb71b40718727edcba4151e9ca974a26d89ce8e24ac6cd9163a3f54c91d0e9d9982a95e11d3f2b712961d12decd425b9ab470dd097712df385f635502ed1a4f4c426", 0xfe}], 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000022000100006000fe030000080000e89500"], 0x14}}, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)={{0x1ff, 0x81}, 0x1, 0x300f, 0x7ff, {0x81, 0x1}, 0x9, 0x1}) 09:50:05 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0) 09:50:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000001000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1788.881563][ T9854] binder: 9851:9854 got transaction with invalid data ptr [ 1788.893947][ T9854] binder: 9851:9854 transaction failed 29201/-14, size 24-0 line 3180 [ 1788.942293][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000002000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1789.128517][T10064] binder: 10029:10064 got transaction with invalid data ptr [ 1789.150049][T10064] binder: 10029:10064 transaction failed 29201/-14, size 24-0 line 3180 [ 1789.171300][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000003000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:05 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1789.406953][T10168] binder: 10167:10168 got transaction with invalid data ptr [ 1789.455738][T10168] binder: 10167:10168 transaction failed 29201/-14, size 24-0 line 3180 [ 1789.499221][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:05 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0) 09:50:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000004000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1789.820170][T10281] binder: 10280:10281 got transaction with invalid data ptr [ 1789.835711][T10281] binder: 10280:10281 transaction failed 29201/-14, size 24-0 line 3180 [ 1789.858073][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000005000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:06 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 1790.061536][T10383] binder: 10382:10383 got transaction with invalid data ptr [ 1790.086448][T10383] binder: 10382:10383 transaction failed 29201/-14, size 24-0 line 3180 [ 1790.105494][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:06 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000006000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1790.403950][T10602] binder: 10600:10602 got transaction with invalid data ptr [ 1790.418354][T10602] binder: 10600:10602 transaction failed 29201/-14, size 24-0 line 3180 [ 1790.441812][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:06 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x81, 0x800) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, &(0x7f0000000180)={0x830, {{0xa, 0x4e23, 0x3, @mcast2, 0x7ff}}}, 0x88) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$BLKRAGET(r0, 0x1263, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r1, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f00000000c0)) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ifreq(r2, 0x8937, &(0x7f0000000100)={'syzkaller1\x00', @ifru_ivalue=0x5}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="01004400"], 0x14}, 0x1, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) 09:50:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000007000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:06 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1790.733987][T10710] binder: 10707:10710 got transaction with invalid data ptr [ 1790.756479][T10710] binder: 10707:10710 transaction failed 29201/-14, size 24-0 line 3180 [ 1790.785359][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:07 executing program 5: r0 = getpid() perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0) mount$fuse(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) pivot_root(0x0, &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) socket(0x40000000015, 0x0, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) rt_tgsigqueueinfo(0x0, 0x0, 0x0, 0x0) ptrace(0xffffffffffffffff, 0x0) ptrace$getsig(0x18, r0, 0x0, 0x0) 09:50:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000a000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1791.081806][T10823] binder: 10821:10823 got transaction with invalid data ptr [ 1791.095004][T10823] binder: 10821:10823 transaction failed 29201/-14, size 24-0 line 3180 [ 1791.104913][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000012000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:07 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x0) r1 = dup(r0) ioctl$sock_SIOCBRADDBR(r1, 0x89c9, 0x0) r2 = socket$netlink(0x10, 0x3, 0xd) pselect6(0x40, &(0x7f0000000000)={0x7, 0x6, 0x8001, 0x2, 0x4be, 0x3, 0xfff, 0xadef0b6}, &(0x7f0000000040)={0x9, 0x6a2ade84, 0x1, 0xf8, 0xffffffffffffffc1, 0x5, 0xffffffff, 0x7ff}, &(0x7f0000000080)={0x59, 0x400, 0x7, 0x9, 0x6, 0xc178, 0x3, 0x9f}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={0x8}, 0x8}) write(r2, &(0x7f000058bfe4)="29000000140005b7ff000000040860eb0100100006a40e07fff00fd57f25ffffff0100002a00f3ff09", 0x29) 09:50:07 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x0) r1 = dup(r0) ioctl$sock_SIOCBRADDBR(r1, 0x89c9, 0x0) r2 = socket$netlink(0x10, 0x3, 0xd) pselect6(0x40, &(0x7f0000000000)={0x7, 0x6, 0x8001, 0x2, 0x4be, 0x3, 0xfff, 0xadef0b6}, &(0x7f0000000040)={0x9, 0x6a2ade84, 0x1, 0xf8, 0xffffffffffffffc1, 0x5, 0xffffffff, 0x7ff}, &(0x7f0000000080)={0x59, 0x400, 0x7, 0x9, 0x6, 0xc178, 0x3, 0x9f}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={0x8}, 0x8}) ioctl$EXT4_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000001c0)=0x1) 09:50:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000018000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:07 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x0) r1 = dup(r0) ioctl$sock_SIOCBRADDBR(r1, 0x89c9, 0x0) r2 = socket$netlink(0x10, 0x3, 0xd) pselect6(0x40, &(0x7f0000000000)={0x7, 0x6, 0x8001, 0x2, 0x4be, 0x3, 0xfff, 0xadef0b6}, &(0x7f0000000040)={0x9, 0x6a2ade84, 0x1, 0xf8, 0xffffffffffffffc1, 0x5, 0xffffffff, 0x7ff}, &(0x7f0000000080)={0x59, 0x400, 0x7, 0x9, 0x6, 0xc178, 0x3, 0x9f}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={0x8}, 0x8}) write(r2, &(0x7f000058bfe4)="29000000140005b7ff000000040860eb0100100006a40e07fff00fd57f25ffffff0100002a00f3ff09", 0x29) 09:50:07 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:07 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x143, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_NESTED_STATE(r0, 0x4080aebf, &(0x7f00000002c0)={0x1, 0x0, 0x2080, {0xd000, 0x5000, 0x2}, [], "8b43eecce328cae6d9091d31033b495da398da1603a4e42651e558b86d6116baddda7c31d87196a7a344ea86ab816737dfaea2e41c0426255426ef31f2e369f84963cdb6113ffdeba81dc7637dd37db81d70c09b1e8a2846d6bf912ed3254ed5c43aec584ca2bfa4575e7362047dcbe7171771eff9d09afe71bcfb4feb2df12f8746b027ec18e8738d5c55d2c0867fc927a1f32e8c716e2d590352c366c1080965cf25a2d1db4414a802205a8718b89016d17aec575544c62879911231b39af8e8831cc1ac64b001439b585abba9be33b05750e6727b5afc7006c868b90a27e3922a54284b795d9040f0182c1fa6e1f48cdf62571a91a28302dda0dfc7b9296e512f561af778594eeff073c680e5880dd9cb892b508a1256d283fedfed5117b18d8323ab2410f1e41c95402b4dee7a1edcdccf45f811f13bd40ef82ce3d0e77222c488fe2ba1355f76df12c6622158de291bfc54bff9dfaee85423f00addc9f4ba0eb3f4f8a90d6264ff92148788445a01b416e0e8bea54892bfe6fb88d8a52b78d9ac4a78225cdfa0a7a847b9a63f1ed12883d028bca1a9b8e097f51624f46ba62e66448f6b0f8c8685056883dc5a428b552055ad6d1a31092d4c5cd4856538b7dff2ae9e737c3af4e5011b0f15a910bf36d80a143ed4cd2aa4327d0857e38a0125387b47cf3cec2140e8943b72422563403708d3393a69efbc909134f231cd0073b1d803013d1d2342fadf7ea02553ab9ac93470bdf2f1c300308ec15714e5ac2198ab2ba725aaccfce26bc43b3bbd688231e841da9178e3fa7696532afe1392cff3b332c019b39239b8712e3799469d5231f6ea2f2ab0b79603dd1abff6e42118e7df7d89e0b8b80686262c533a6c8c9424b699ddd05e48bcb8ff759d4321347ee6ee517e65498c7d45927cef0f85d91bbdc84e9f48b0068fd99a2a239e88819fdf941026a74ac7804315c894dc11db67c985cfb8b1e54c17b4d98ed1b21e7d77ae6cf76d1172907c9051daa06c7d5028ceec7f3971eef6ef35ec49014430576f5ec522fdb162298076f20388210b2bf454c4edb6fd95ef73044e55437ba7f588e308e3174de26c101618a9ed83479e7b5f092d48c86597b5542c9319990dd6c85b769920be358d1b5beb377f8bc43dfd080a2685a496b195659b76ec1fcde8bcaa7d629e6ad169fb26953c341f8bf2f5270d45d4431b9033197f2a58a5ea76f46d286f447d1aa02b5c84c2a2cdcfafab43376a90e0b23cb7e573774304c8f0b03f49c78bc1ecf489e705eef0bc20fd04c3deff42ba3a5784a929626462324a6219e86a84febf8f19553cbb8301c8a37ef39e8eefd4909fea704df3918996208e5bc12edc1a15e4df2b3b62d22bb3d39358962a9db5a431767818297fcbe556fc72460fdb1911969e37ee92881f1559da408681c4a76a42c1758d17f7f3c8399139e32ffc42831bf5dc872bb08607fd15de9075fe485610b96dea9d0f253a269129fe7caa82bc4b98d064413c2a5844afd270b56eeee9dabf9864431b098cea75784fd96371c5d79929a10db812830d1fc57eb69d085a8dfa8d5b886e021ffea4cd2a0f82f2665d8b12982050ab51854028dde56235401bd0b91edcd7887af147566fdf903aadaf1e22aaafb2016c4b229981235804a4e66a1f3b30ed034ff0f0b8f69e18f64c730ff6d860fbabff857b5804189434b65593f670fbb26723e08b5e70286ea78d9625109da12efe152a4545f59eff3b63d29ddfa1d9a5f36031ba81a91590e642217708f5073805a50113c5c1e6578c1fa06f3962123111a1b4386f50ac290e6eea86d63e21f309cf2f0217089be1e18f9bcfce6a59ddcf037fac82d6fd8770d8d3a00a478a0a8c7663f57da837ee9879ac80851a65856d81c8a274f56d66d0176950b29bec652634803e396506d7f96139dbe87fe5895f070cf127a9950380756aa41236480bb5a19a5eadfb72d7e8891bb2b7a5b1b95d8219e0b7c2fea497c25c76bbf09e679cc577f9527df58426ec4215ba9896ce80e929f59ffb208d2a6da00d005c6f4f78f64517fefdcae13487808d8f213006e622f3f2a4c84896afd4e1b218b812c88216cf24c3c8010821e3447c9888e0a5f6efc66a8e0c8160eb2fecbaa2ce9196c5f065f59880ebcfca3ec7cba06a59696b4f071afc2f45e4161b38f6abf5e513f9b51fa8d7fe3f81b9ad595bd4c9d0ab892a5d8bc445e5b6f7c66fc70b303d8591a297d742ac73b32ba14e4bb934c755f0e373d63c8d8350002e18e36f17a3849bc75c0828f5b915d013d8dfdec993e02d5fc6ba226961485a1456156314306b905d1cea819da7dd5a902fd88eb0466e45dc32c45c2aa6f5933321ec16f8e2db11a131ec506c30ed8d7282f4dbff0ca7f4863bef492ce06749fd856cb6c750a8518e08ef73559928e7b8682d6888ca726f769a13410d80bc4892129225af71db576b631ccf8a2a7ed7caa59ad1f5909b42745e2693a3593bb6d0026727473be11241125febb2658505d29a0cf5d3bb94e5b5e11deb3799e21c3e4ebda401660569f0ca601f15c4799b6caf2e66a7a74c37da407e19006ce70f50d269f875f7cfc0b46fa38162452019c9634e68e4d630e5c35c1880583d5af54d185740c16dccfbf1f6389722e40f6fa19e51468149b4254f00cc58d51ec784bb99af1d00bc9db05d61ddc2bd4a43d8f5e42580bcf1ff6f0f099ec07f2517b52d313a2019bad2e4a9d1b06d93183e6e40b4a7077c7d505dd944a5e1bed30104f7c33490c76432dc75c575544f03d9c882d96eeb9b50b0b05d7f30980958199e525c7a64b093801309d4480eb4e569456445c938d768cf5e714c1bdece2ec2413341618b6f5c2c60ba6db0a388278027f8e6bcffbd15bcca3c37b15b0b408ff3a5df9a686522348b2acddf1bb618ce699ccbddded4074c285ce26e2967ab734e7c1fc8e779702a6306fe04461a098dcb54cd6af2d91aeebf871ffeaf02c331500683061cf97a9c214ab8f5996c270798bc19b9c19a2ad81b020cf368dc07fb2ba89749472b95426a45f8d7ca9857d874dd166d79eeab46c70ee82623a774410947bcef55bd4182a207e64c4b343251b80479eb6ee86fabb5577f0e3df1e4196d872323beaa001917bae16c9b9bd3a414ddd6a1fd24a89192a32fe7deb6985dee1f983c821b07e10dcd4801ce3fe6b3aacd2beb2aaa1ed95c46cd3173b5a9799d67515cc11bb37a718f5e9c870ebbbb34c3271c60971651b29ca9b7dc83ef707dad649c845066674ad32bab06f43428475bd3482333d791aa263d0eed9b7361607b2ff18c50b05fb88b78b2f953e6823df317f0be7714b39ec12c91a7a056bf5ecdbbf4b12ebb2d30d1e70bb01487c803eb1379d9d88e60510368a42c324e4446e679bdba27a093c8e6632b082c55a268dbd7fef0ee78cd1cabc311d73780662946460fe271bd6cfb37b16a8868c88d0b6c9625d42bee2745ff1f67a4898f289ed15bb9acdbb46a9cac901630220054ba0bd969a5085f266818873a42ba62575fad8df4a1bac159eff481f1a529f97153d34418f9731b77f0176c0981f3569ce0db074b04e57d03822ef63ac48bf318b9510e58d83f6c1053b535405b5a0fc0b2f7f8b7e4c4caf3c67811fe07df5db7f3571b5037d50017c5ca04c4b45f0ed37ba4d637f8b6b3eb9b7f6e4cc3d205b9c6a54468c8f51f0ed104a75780271627b57e54a25f1ba4756d0c72d01ace207db7448abbb2c7ea866968824317f1a47a6de3867bdefb0c1a8b1fe2835b4500b7e012c45892c174c8f0aa558c92b4a0a31f87a4be786019dbd31baf0a2be0c54bbaf7b139e8fd5f7cf31a35606c4c9919948f72b31e4fc71071fef4b8d3cc9127e4b78a1d53d6b3d06da8a0f8f2371e2cfc525520953b4ac96b61ef52d39a93d734761a06e24c018967d81aa599196b02b910c29ad63af6bd7ed664b83db4450fa159c776337490325a013c342ca9a5619fdc75cd02d85884cb3522d1db2fff249e8999f6db8c565c96f55fefb49f3d4bd78b949d6c3fb60ee40dcbd2039b13b8a0a69001e21790103169b0e2016c4ba220170206847b6f909e2fa12e653ce24bebdd9bb53a766c571116c34e54093e9e2b1ce10e0b192f3559951489384b19ecd5412ba9afb58db740c82dcf1fcea76133100351a843212c54695c4ee07836de97367762368c14b89d00ad56aa819f241976eb6367a32b904ddb25e675f3149d05a7084c8badaf1913d9a320eb2210d70e5e754545f46a7cb7d0d4a82547da8608d350460f0d0867742f72c7895300bd1e7b86fd77a0b9fcc01842a30d62a7766f4f3597c6c5623cbc9d3e0841ccdce3e1fd137351e8de2ddfea176d572cfd5f6c78461ad561ffc19c5370658b3e875fd12b7e3ab09de6465018e70418ae11911f1ba48d1187b6a62650164cc65a38f494a8f194e65f1a123f28a4756df58504f42f6fda45f08cc346d370fc8975fd9543e3957f7a046932cf2215ca2eb1c131f5466d18e30c30f4ff5d59c9e9461f9490ab78246062a02936af15f0a124876d077778cc46c851f231fbc0dd75f7a0ec5cecd9d77dda0281c40fd0c724caff5769a3319e2b512995f8cf1e3dd7196e82818b23e64897c73a38f65cff66ecdaf1e9d3b70706babc5b270c5c665dc5ebf90ead92c9a628e9db8224399ea84e9fbbb4cfb56efad71cac17f579aeefa77c3b05e20254e78dd5d33bb05612d4d2f4c19b6c1a674a05b84cd67fe30aa57559f9b1c298db55202b6b228ca543ff1f15bbd6ec326187b1264d1e6bbd811d83b1caa1e1b57ac80844347d8a0954000b6ad94e5b1e2509779175147c5dd01e135624e069fd71b39d7458f968a44b2c89999b1fdcd9710cd16100272e12c96a6cfd98bc89e4da58991b1402ca305d64fcfebf3a20ac5a3bf072d292e791175decc6a884097dfc47b659f021d32a261a58428bc9f8a1134de9311398885e25d163692b744ab13db75a87832a0c595688f00643c3ac35d29cd54e070366c67ccd0d4e0d01ed245f4a28e711c4845b3ddf93a382308610c855bbe086dc307ae4204872b831a0321c12256769873ddceea1034581e30e2e8d0196a7e9addfd14234e5aa031f10b1605bb581701daa2808527ffb62cd0208a7e95d87a09a94532e97ffdc33375ce9aa0140aee665600ecbe3c4fa2019d7797b3f2a4401d2bb934a21dcef4bd661ce700de8a470602ce9b4fd1b72c39d2783d2d3b25f11ab69cd3089b3e86bc79d17890ef217b2180f332b787cfd1cb46017f6610e3f42651917f6b89df093682cb593b95603b2fa365dff0ce2f1bad8f3e3c3edd47a9fc491d0b49c17ee866e5e771c18b71c0036ad538cd793955e72e1639549e74f86e084d5429ca88497ef3bd095353dff85b7185767a0557a55857ab96b289c1a180c8561d0348080006e095d8ea3583ca595adf79faf1fa0dc5c623e5d6e3bba6039a67ab3080f85c60c06f47725c9d1e0df0ade372f0fd694d6d618b81a1810a87c7a1185cd3d7909105fcbafd0d3390ac4d433fc7d37bb9103eccae4811eedc5dcde0efd735f0000031c2b600915fe80b128cd681d169e8ab7f1c81875c6347bf043368e29571524853603d9f3fe1d819d50adcc4f9f6fbe57f9ff9f3b343f351dd59051af29469ffe6adbe0ffa642bdcc6e6e170122763eee8751be0b4bcb182e57067c126307d224d5659761622c730869ddfc3d36b30d6248d083ed7ab7432f4877bef9d52c52e856bbbb2e65fc525110e13a3f9b68bfb79c960c86a80f916d48", "67fefe5e03760122818c3cec37ab7c29760b4af8101daa78d56cd42df4d2c903184b14260ea0f6b8f5bee56d93fc03a40e53497341d9904d74d1d547a586ac457d1cd881fb3662e00129d52cd7b7f11970c0a98f2028216ab159163a3fb95345f0f0ec313609dc0ae9887502b8cdb001b8e0e30e32a92df7b1ffac5f836b024dc719bd9b685124cef7365125184b890e24b9e3278edeed377b9fb716f17f44cc2cd3a61a41a301e0e91ba4962ba17316a94a5f7678e51b0a44a714785fb98ff4f06e4da0bdf75fa7afbc2b44170b04988427a4f9a8a83849c073d8dcd69967af25a17aab7ad1de75042cd0536374ef3af7f2e0b3004d1dc96ea7626b68079ad72f2ed0eb6d305062895a0ac8ca483c974622d6f242c664d69c2150cebceb489418fc7aa96f2c366194d5a2818080a95d9877bdf689a3eade077c9f6a42d698ab28a5438444d70ece4cf988ed9e0d2701bfd3a2523b675ffefa19365b8ea8eb7199712fb3edaecc7aa656efc332df6873e5cc4c4f70947818c549c21b7c6cd5c0877fedea03a9cff6c892dfb73dbb9a11235cf094b3206b3cdea0b3cb369d19c6872eca43f33daec07185638c4aedfd7b87bdd693e525251fcdaef883a42914d316aa4d7ba1d9ef3009c4593d46c7d7a6927b263e68d66d26db2aac6f7ba6355bada9addbfc819b376742102989a3e9061ee3f974ab1a0d13b53a49a5e3b423188096f14a8ee04cc40c2b74d1da8008bc4e6e1d573d2c3b9b2da18862cf465aa09e1846ab57d928c6020f2ab9abb8287e47265fc279f21ab019d805ebf93e7a7f89ea6014b245d24fdb59cdb04c7d153413e85de01b515db6dedd66d11d53628effbe32a5c93d89e18b36056d070bd2627ce36940d19826a1e67b83e396fce281befaf35aef674c6dd7abb655178010e414d0f32fc394f643c79dd9853de900182efbdeeccb16016c65b4cc8b8327b68a8731beea6b15a75f1a87c0a3459d33ed6b74ef0c9cc2300ea743b1b150552bccb4fab87f25ced0a030b523dca948159fc050168f908da4645d2d50c4bb04b45a1591d03bb9e9b916d61f5901a8ce6f16d9c5fe3a18acfaf62f59d0754757cacd62e00c6930aaeb906c21a4d38b6a75f92b9c0eda4f9dd3eb5859e69f6ed3dedfc74311ee539023e939dbec005313684e1fc2d1da9457681edde92b6860e87871716a9d6061d00e41f73dc535b7e6554462e3d4cb116bb3e710e8a631195aeba8b0d5b0746c2d132602dc04c2584f9fea5ff78cd86c08fabb7789fd046440597af97bf07cfed94553e97615f92bb02b398a58553706d162423c508b789265ebc0ebd04e1a532a15fb869b0f5b336e984ffbb7e4ac99388f4eb5094bf382ae1018bab8c35fa014daf657695e2e1e2616b34ca1e4bb29f5c599330f6c6197435a38fbb0e5cab0fbc9830410f98662d4cb3b88dfd4c37868aa2b9c3aaba3efa64af7d3b058e3603dcbc8a527dd759f5b2ae177b05cae4220daf454c55eeb9b6210087451da76b0bcc4af1604c96245a32e8c88741f0e70efc78a2b4a0475a33d19873118377df4a16b1d59278f0f1c8301f90762b52c40ae941b6d6b0fa0b6c0a3a3b2803b11f74c07e189984b757874fa8ac0f781084e95f316352c95b07b81cde610bfb905cb86b913937c75f642debfe365598fa3c2d12921adb727617640e53e21e739718863884020a321a9ccf5f3ea7e1d761757dd0ca0328c09166605d1153264f7b644c0d976c939ede1ef6430cf12ad13b3c7ec82b2a10ebe76ae2e0a2a833fd0a84f1f388d370c94aa4b985c8834d99db1e1b1682f38d19b7cae185e536c47c940d81fc7c4b35cddf1402393b66bc3bcf5a5904c720b56d92dcbca28dedb2f30817d12c00baa78a20833b001d0588be16a04552021dc66c98466fafd431d59b0d8f829069ea9854cad441353f34c2f534f29ef989a77299dd666e75064d914cbe6d62b3e013c123f9a0a2bb9ce3fc05a8aafcb37603b6f38ba485653c1ced2e5d498717e2df2212ce9c3e3cfeda9e2994d5c34a596fdbfe5d5dfbb50304e02b9f173d012205f73ecdf47cc854822f6b24add3c4b9829c7d53b03b89ea4c02f91e3446b030e7d374e626505f0310cbf3d64be3e7b50ffc63d522148de294a032a128c0c406c29b607ea26d9689483d977d67ab26275ddc285270f3658475883f3f1dcf6adeeca472ccfeb4768590a51f36378686e7dcefe505f9f513b4d6e2f235c0a8087a4dc6a84f753e17e7480c0eb597642acf31a16da3a4b8de9fc813e569166cdd82532d5ed2b5832358623f21d2840a255a2d854283b538e0a27a3a513b38df5b73dc2549f3c3291c9c71535c30e06b11f93c69afddbfd1a332e201a370b47737a4e6504d27e5d77e3dc36ede056c460fca977f697d026dd6a0105e05f8eefc752ffbd8cce0158e0b55792032ffa9f08eb808b6e13a29fea6f37c85e08aa96e51dd431743c4daffe425e9b4137e0783881393b13e7c9e333ec00f0c6c409eb77520fcd75bc8031e12c4483daa7ece3b52dee2350187e2a0b178a7cbc4bff3a02f28319ff6c511c0321d764cf9a4bcee897df7ad45e93d5bd5c9bbe0207382352de37b7bbe03fc3cf214efb81e2ea498d3228b29be032265e0c01b350693b79afcfe300aec125d2a8161ed61eef3743cefc11f6ce529b44b785a1ceec32f648086708ffb645695ee74476ea609ab844da67c3939b826a075a70a5f745b74021c7bcc90c69a2318bfeeb8bba01853b61689557b42e8838785bbb0135e6c6d87fcafea52ec3a4dce379d0b7315930897d8762c9285b6334e9a9458e6c5eea0526de0a2892cb091dcd59b9aff822e9b775ce455944692e85a303bf10318116d052f665735b67fcabadb32095e38a13213e910d4fceb24a9c3c81117a463dcc1bbdf6d58c62102f5f4aaf533a802f06283b859a1c4aee3a7009baa8e207f6b2dfb6d2f61416c936c498c5ee695afc66c5769fa2defdf40e0288a2f96c5125936ef78af95bdfba85070c8ef38fdb2a27e3eddc24ada685d5d15c2bef6ea1ca0fcb2ef0bdc759239d3de2ac1190f3c250ab5eb68635064f15e5bb9a35b3a60dbda538cb7e442d1893d64b85cef065e29e2e82cdbbd6e0e6a3eebe75fb6cca1193ec093a8dc72da15ae06baee2def3530e067bd56dd7fa57fff76beea1745c440dbe7e34c4241ec89895c6b2705ac42f6cf0b74671d0c38fa606380188d9ca302e302bef1caa5d16e88cfd87dff6fe11d7da304ea0dd6af338238818b42675421902e99090cbdc9cb4a37df1d8a47e76376b23a97661fb75b2ce4abae71c9888d99d0d595acc91873bea6e4c1944243ed72b18380c3127fe9319f884c6df2f1e06513dc8ae6f53ba753fe3b4e67c46f911772424791dabf739b01323196f4c262a62e5e0603dac12d7f2d47e02543e3c15deb3c5cf389bb7b672fa3f47cf92fafa73fd3ded3df1e68fd9b5dce8303488f706326bf431df0d4bb93458878241cf1e18dd52b0bb85a10c7696d594d18ab948d6ba064b84967f3d9e98f050b1cb2549570fe2dd6c8d40c15edfaf658bd4f7fd5198e6f758bfa1329fef3657689f7b6f8db873107e3a66c03204238d43db506c8f98c047d1d9e54f61e8b98815dcc4ea57a52ff3cfa00fcf1c9d59d0e57fa6cc968a4b59b9273fd19d4cc2804502687c5d492dd1082d04938028046ae03f81404f6c53b29e36bf0cdfed2e5d4ac53a0e29217eac679924a941cd181aa96a434044e24a177c229d56b1c0f52e2db91214ce6dfab1db2ddb57845f675e999e524f66e780fdab2ce783e1ad7d600a4af01bccb1a9d9e601d17c4f38e9a8a2ccf8c07013a01beb31ffe9177cae483a55c8f7ee912cc6d3ec6414574827e763ad69b20bf502ff56415b7369a18643369b9a8476c677cda4a733bd1f4aa98143731bd0a80e9518e4bca3257cf814620b99919d351d162a257153777e25be27bd4a3ea9f25a734af064dd547fa8ff8f57546e3c75c92688747333c6ba0fca977b68ebcb662c1206ee269f063a0a3ecd2c2a8c644acb4f6f7881bfd49750bd1d44746f5933a3bbfe9497d30acb82b0dd35106db16b3f88fd0fb41e4c0a66cc245b5c9d153f77c15b175bd2473159813e8fec834629d47216f319d641d3a39999aca4f17e3877e35bad50e0aaa23e4783f62278f05cc0424d8e3267d1f12dc6c18448211c3404bddb01e495eb74d3fec8d7c0d24afd39c10f6ea5a73ecccb632b8f34663f1c130a4971cb2514287b6197338ad8cb98ec5540ac69184d47e7a4da8272b179373c96af695c5ea6b75f9279133d6d8fcde5fbd209cb4b7cda58e14497949198cfa011480932bc0cacd6ad41688c695787450b2ed0927153eb543cd11a109d44f67c15ab1ef3b0d15eab5f7b63a1b242db490a7e942ee7fde6ea70caa12427defc30c3a72f1ab35fc4cea725bdbfe4fc11a7b33939fa58060fef0ff3b9857dfd4a2c865ad6f5047f34c3eee2002047f5ba6e6b90fb262beee48a2967be36b81ad0752e2b3d33ea738e9623de9b15204fc86548ec88b2e361d2a6a927c27762c75caf72e0834d3f47bf1f8a1187bf574b3db2b12575258dd6b98deea8321a01162d48513e320cfc59ffc1fa90e5a24835ac16c5e5774d22a9748fd9fb3686d93fb319e9006c93ecf9fac548ae25738e7d2be1167cb13bd8addfa00734450bfddea26e01e70409b462f889a11c99608b8029fc67e5346e471354d4be11efd13e744c8944626f2b05dbf47298726db594140b6e49b95352b0d01b072ca2ef7f715a507061ee3b375364f6fa4d7c6333c15dfc135ae8188391328483f56570fc69d75784f2a49e164fd8ae0f7e664827c2f3c771b5facd09bcbe8fff5b6a4bebecad21cc7559b79b2d66f9235856914b9a03e61fe5a6adfc0882c34bb367520b6e53f38464dd845cbdafe38384de383029ce07e5ad8295a19a49ad8c43e66d24d497c2ff0dc881476dbe303acc7e94b6602aeaa05e4457084dcffc985aa635d72080ad9072733657f7c4e8bb12cf1dae7636fff5667732d465de26c186cdf7468fc282e9bc176047274d81de69dff51756fb17647d6f8dab48802e5cb53050009fa7943445d9b059826f8fb66cf29bc79dd761a1c9f0cc88794dc2994c1ae41e2ecb50a11eb315b1f9682fae813fe05c0f3f3f4c436bb986b42ebdd83ee510f4cb91fe0e5c641bd58f3e0832c45ef1d953f01c63b3c337106a3b2ceae09976e56cb96fdc1cd3ee7dda1b6aee7bbe0bfd2ec7f62b4b0a879f99135069edf97bb9299733aac715c1615bcc506b71712637077ffba6bd9ed7dc62cc9ef2773d64b62d74fa8d3f83789921cf0c9c6e4406b5198f052d9009eeac3552495aa28ab44dd1319f19cc9c77427bdb661f76f6bb5526e9e6f67dfb251ab8c96b92e3d5477f76d2e672d6e9c5721b24fdb1d20d8d4f92cc75330f323ded1de0da6f869cfaf62e834368a2b07c8905474228ed9ad298354cbe5a1abc26d303f6ff68b1a279750650f04ba23684b98174120b47718d739b59ad661ed0eeee5fd80937e2c64bde3bb1ad413447756de9adb85ef5d8459c75f58d65f390d263e9e413c743b330304ea07a60c523ef3deb5fadc45c4d4e0bfa7827b8966f269f4ef62396916a3e7d587f38581a8642db03900d9ee5502d3d1626aa8e92e0985393e05046d0e26d900e5f04ee4b5cb427b410dc1d59bf6526a9f5e5af880c8d3458b1ce6806b92ff3623b5c7b8747a51c122e75a1b134d64e50b75084c079997fc53f271a86c901"}) connect$llc(r0, &(0x7f0000002340)={0x1a, 0x30f, 0xb00, 0x100000001, 0x8, 0xb88e, @random="7e7e17153ce0"}, 0x10) getsockopt$inet_buf(r2, 0x0, 0x3d, &(0x7f0000000100)=""/30, &(0x7f0000000140)=0xfffffdb9) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, &(0x7f0000000180)) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$CAPI_MANUFACTURER_CMD(r0, 0xc0104320, &(0x7f0000000280)={0x9109, &(0x7f0000000200)="c19224d0e1cbd3b837fe80ad0cb4aaedc00c5f7b9f7808d38bec0be7d275abe6ab7ba0401c3e9ed96b293d4899dd56c579987410401afbd62e5d9e48cc2100579b97752a5e6ce54ee9a5b7f4adc495b58087fedde15528dc109874f317"}) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000022000100000000000000000007000000"], 0x14}}, 0x0) 09:50:07 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x0) r1 = dup(r0) ioctl$sock_SIOCBRADDBR(r1, 0x89c9, 0x0) r2 = socket$netlink(0x10, 0x3, 0xd) pselect6(0x40, &(0x7f0000000000)={0x7, 0x6, 0x8001, 0x2, 0x4be, 0x3, 0xfff, 0xadef0b6}, &(0x7f0000000040)={0x9, 0x6a2ade84, 0x1, 0xf8, 0xffffffffffffffc1, 0x5, 0xffffffff, 0x7ff}, &(0x7f0000000080)={0x59, 0x400, 0x7, 0x9, 0x6, 0xc178, 0x3, 0x9f}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={0x8}, 0x8}) ioctl$EXT4_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000001c0)=0x1) write(r2, &(0x7f000058bfe4)="29000000140005b7ff000000040860eb0100100006a40e07fff00fd57f25ffffff0100002a00f3ff09", 0x29) 09:50:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000020000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:08 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:08 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:08 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x0) r1 = dup(r0) ioctl$sock_SIOCBRADDBR(r1, 0x89c9, 0x0) r2 = socket$netlink(0x10, 0x3, 0xd) pselect6(0x40, &(0x7f0000000000)={0x7, 0x6, 0x8001, 0x2, 0x4be, 0x3, 0xfff, 0xadef0b6}, &(0x7f0000000040)={0x9, 0x6a2ade84, 0x1, 0xf8, 0xffffffffffffffc1, 0x5, 0xffffffff, 0x7ff}, &(0x7f0000000080)={0x59, 0x400, 0x7, 0x9, 0x6, 0xc178, 0x3, 0x9f}, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000140)={&(0x7f0000000100)={0x8}, 0x8}) write(r2, &(0x7f000058bfe4)="29000000140005b7ff000000040860eb0100100006a40e07fff00fd57f25ffffff0100002a00f3ff09", 0x29) 09:50:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000003f000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000480000000000000000000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000048000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1792.569787][T11997] binder: 11996:11997 got transaction to invalid handle [ 1792.645169][T11999] binder: BINDER_SET_CONTEXT_MGR already set [ 1792.680295][T11999] binder: 11998:11999 ioctl 40046207 0 returned -16 09:50:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000003f000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000004c000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1792.901291][T12115] binder: BINDER_SET_CONTEXT_MGR already set [ 1792.933705][T12115] binder: 12114:12115 ioctl 40046207 0 returned -16 09:50:09 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:09 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) ioctl$KVM_SET_CPUID2(r0, 0x4008ae90, &(0x7f0000000100)={0x3, 0x0, [{0xc000000b, 0x1, 0x2, 0x1, 0x66, 0xc28, 0x850}, {0x4000000f, 0x156e, 0x1, 0x9, 0x8548, 0x6e98f84d, 0x401}, {0x80000000, 0x7fff, 0x0, 0x6, 0x400, 0x0, 0x3}]}) 09:50:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000003f000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000060000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:09 executing program 4: clone(0x200000041fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) msgrcv(0x0, &(0x7f0000000140)={0x0, ""/58}, 0x42, 0x3, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = socket(0x40000000015, 0x5, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(r1, 0x40000005450) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, 0x10) io_uring_enter(0xffffffffffffffff, 0x800, 0x0, 0x2, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000140)) ptrace(0x10, r0) ptrace$getsig(0x18, r0, 0x0, 0x0) 09:50:09 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1793.525318][T12329] binder: BINDER_SET_CONTEXT_MGR already set [ 1793.558276][T12329] binder: 12325:12329 ioctl 40046207 0 returned -16 [ 1793.558436][T12327] binder_transaction: 5 callbacks suppressed [ 1793.558446][T12327] binder: 12324:12327 got transaction with invalid data ptr [ 1793.648355][T12327] binder_transaction: 6 callbacks suppressed [ 1793.648374][T12327] binder: 12324:12327 transaction failed 29201/-14, size 24-0 line 3180 09:50:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000068000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:10 executing program 5: clone(0x200000041fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) msgrcv(0x0, &(0x7f0000000140)={0x0, ""/58}, 0x42, 0x3, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = socket(0x40000000015, 0x5, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(r1, 0x40000005450) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, 0x10) io_uring_enter(0xffffffffffffffff, 0x800, 0x0, 0x2, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000140)) ptrace(0x10, r0) ptrace$getsig(0x18, r0, 0x0, 0x0) [ 1793.760503][ T3269] binder_release_work: 6 callbacks suppressed [ 1793.760512][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:10 executing program 4: clone(0x200000041fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) msgrcv(0x0, &(0x7f0000000140)={0x0, ""/58}, 0x42, 0x3, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = socket(0x40000000015, 0x5, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(r1, 0x40000005450) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, 0x10) io_uring_enter(0xffffffffffffffff, 0x800, 0x0, 0x2, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000140)) ptrace(0x10, r0) ptrace$getsig(0x18, r0, 0x0, 0x0) [ 1793.936967][T12550] binder: 12545:12550 got transaction with invalid data ptr [ 1793.984951][T12550] binder: 12545:12550 transaction failed 29201/-14, size 24-0 line 3180 [ 1794.026691][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:10 executing program 5: clone(0x200000041fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) msgrcv(0x0, &(0x7f0000000140)={0x0, ""/58}, 0x42, 0x3, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = socket(0x40000000015, 0x5, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(r1, 0x40000005450) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, 0x10) io_uring_enter(0xffffffffffffffff, 0x800, 0x0, 0x2, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000140)) ptrace(0x10, r0) ptrace$getsig(0x18, r0, 0x0, 0x0) 09:50:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000006c000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:10 executing program 4: clone(0x200000041fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) msgrcv(0x0, &(0x7f0000000140)={0x0, ""/58}, 0x42, 0x3, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = socket(0x40000000015, 0x5, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(r1, 0x40000005450) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, 0x10) io_uring_enter(0xffffffffffffffff, 0x800, 0x0, 0x2, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000140)) ptrace(0x10, r0) ptrace$getsig(0x18, r0, 0x0, 0x0) [ 1794.399634][T12882] binder: 12868:12882 got transaction with invalid data ptr [ 1794.441919][T12882] binder: 12868:12882 transaction failed 29201/-14, size 24-0 line 3180 [ 1794.476456][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000074000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1794.860118][T13270] binder: 13269:13270 got transaction with invalid data ptr [ 1794.874764][T13270] binder: 13269:13270 transaction failed 29201/-14, size 24-0 line 3180 [ 1794.900028][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:11 executing program 4: socket$unix(0x1, 0x40000000001, 0x0) r0 = socket$netlink(0x10, 0x3, 0x80000000004) write(r0, &(0x7f000058bfe4)="29000000140005b7ff000000040860eb01001001ffa40e07fff00fd57f25ffffff0100002a00f3ff09", 0x29) 09:50:11 executing program 5: clone(0x200000041fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) msgrcv(0x0, &(0x7f0000000140)={0x0, ""/58}, 0x42, 0x3, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = socket(0x40000000015, 0x5, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(r1, 0x40000005450) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, 0x10) io_uring_enter(0xffffffffffffffff, 0x800, 0x0, 0x2, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000140)) ptrace(0x10, r0) ptrace$getsig(0x18, r0, 0x0, 0x0) 09:50:11 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:11 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) request_key(&(0x7f0000000100)='cifs.idmap\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f00000001c0)='/dev/full\x00', 0xfffffffffffffffc) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) pwritev(r1, &(0x7f0000000140)=[{&(0x7f0000000100)}], 0x1, 0x4e) 09:50:11 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000007a000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1795.166609][T13377] binder: 13373:13377 got transaction with invalid data ptr [ 1795.233842][T13377] binder: 13373:13377 transaction failed 29201/-14, size 24-0 line 3180 09:50:11 executing program 4: clone(0x200000041fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) msgrcv(0x0, &(0x7f0000000140)={0x0, ""/58}, 0x42, 0x3, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = socket(0x40000000015, 0x5, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(r1, 0x40000005450) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, 0x10) io_uring_enter(0xffffffffffffffff, 0x800, 0x0, 0x2, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000140)) ptrace(0x10, r0) ptrace$getsig(0x18, r0, 0x0, 0x0) [ 1795.292747][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:11 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}, 0x1, 0xfffffff0}, 0x0) 09:50:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000fffffdfd000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1795.645576][T13683] binder: 13665:13683 got transaction with invalid data ptr [ 1795.687676][T13683] binder: 13665:13683 transaction failed 29201/-14, size 24-0 line 3180 09:50:11 executing program 4: clone(0x200000041fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) msgrcv(0x0, &(0x7f0000000140)={0x0, ""/58}, 0x42, 0x3, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = socket(0x40000000015, 0x5, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(r1, 0x40000005450) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, 0x10) io_uring_enter(0xffffffffffffffff, 0x800, 0x0, 0x2, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000140)) ptrace(0x10, r0) ptrace$getsig(0x18, r0, 0x0, 0x0) [ 1795.736172][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000060ff000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1796.004973][T13847] binder: 13832:13847 got transaction with invalid data ptr [ 1796.027799][T13847] binder: 13832:13847 transaction failed 29201/-14, size 24-0 line 3180 [ 1796.057985][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:12 executing program 4: clone(0x200000041fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) msgrcv(0x0, &(0x7f0000000140)={0x0, ""/58}, 0x42, 0x3, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = socket(0x40000000015, 0x5, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(r1, 0x40000005450) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, 0x10) io_uring_enter(0xffffffffffffffff, 0x800, 0x0, 0x2, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000140)) ptrace(0x10, r0) ptrace$getsig(0x18, r0, 0x0, 0x0) 09:50:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000fdfdffff000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:12 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1796.357091][T14123] binder: 14119:14123 got transaction with invalid data ptr [ 1796.386745][T14123] binder: 14119:14123 transaction failed 29201/-14, size 24-0 line 3180 [ 1796.416019][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:12 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:13 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000100)={r0}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCAX25ADDFWD(r0, 0x89ea, &(0x7f0000000140)={@default, @default}) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000004000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:13 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:13 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1797.257646][T14340] binder: 14337:14340 got transaction with invalid data ptr [ 1797.298257][T14340] binder: 14337:14340 transaction failed 29201/-14, size 24-0 line 3180 [ 1797.345985][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000ffffffffff6000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:13 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1797.531315][T14554] binder: 14553:14554 got transaction with invalid data ptr [ 1797.544390][T14554] binder: 14553:14554 transaction failed 29201/-14, size 24-0 line 3180 [ 1797.557017][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000007400000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:14 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000ffefffffff7f00000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000009400000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:14 executing program 5: clone(0x200000041fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = socket(0x40000000015, 0x5, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(r1, 0x40000005450) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, 0x10) io_uring_enter(0xffffffffffffffff, 0x800, 0x0, 0x2, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000140)) ptrace(0x10, r0) ptrace$getsig(0x18, r0, 0x0, 0x0) 09:50:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000007150000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1798.647929][T14996] binder_transaction: 3 callbacks suppressed [ 1798.647940][T14996] binder: 14995:14996 got transaction with invalid data ptr [ 1798.720158][T14956] RDS: rds_bind could not find a transport for ::ffff:172.30.0.0, load rds_tcp or rds_rdma? [ 1798.731201][T14996] binder_transaction: 3 callbacks suppressed [ 1798.731221][T14996] binder: 14995:14996 transaction failed 29201/-14, size 24-0 line 3180 [ 1798.796040][ T3269] binder_release_work: 3 callbacks suppressed [ 1798.796048][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:15 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1410000022000100dcffd95a2bf26acd00080000000000009693b4752156"], 0x14}}, 0x0) 09:50:15 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:15 executing program 5: clone(0x200000041fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = socket(0x40000000015, 0x5, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(r1, 0x40000005450) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, 0x10) io_uring_enter(0xffffffffffffffff, 0x800, 0x0, 0x2, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000140)) ptrace(0x10, r0) ptrace$getsig(0x18, r0, 0x0, 0x0) 09:50:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000070c0000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1799.196962][T15204] binder: 15202:15204 got transaction with invalid data ptr [ 1799.235298][T15204] binder: 15202:15204 transaction failed 29201/-14, size 24-0 line 3180 [ 1799.289844][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:15 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000050d0000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:15 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) syz_open_dev$radio(&(0x7f0000000340)='/dev/radio#\x00', 0x1, 0x2) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_SOCK_GET(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40040000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x8c, r1, 0x220, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x78, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'ipddp0\x00'}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000000}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @multicast2}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$VIDIOC_G_STD(r0, 0x80085617, &(0x7f0000000100)=0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0) ioctl$VIDIOC_S_STD(r0, 0x40085618, &(0x7f00000001c0)=r2) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1799.548309][T15311] binder: 15310:15311 got transaction with invalid data ptr [ 1799.575226][T15311] binder: 15310:15311 transaction failed 29201/-14, size 24-0 line 3180 [ 1799.614927][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:16 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000010000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1799.854671][T15417] binder: 15416:15417 got transaction with invalid data ptr [ 1799.896045][T15417] binder: 15416:15417 transaction failed 29201/-14, size 24-0 line 3180 [ 1799.927105][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000020000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1800.130932][T15527] binder: 15526:15527 got transaction with invalid data ptr [ 1800.152010][T15527] binder: 15526:15527 transaction failed 29201/-14, size 24-0 line 3180 [ 1800.168679][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000030000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:16 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1800.383665][T15632] binder: 15631:15632 got transaction with invalid data ptr [ 1800.431697][T15632] binder: 15631:15632 transaction failed 29201/-14, size 24-0 line 3180 [ 1800.478612][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000040000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:16 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1800.656271][T15745] binder: 15744:15745 got transaction with invalid data ptr [ 1800.679179][T15745] binder: 15744:15745 transaction failed 29201/-14, size 24-0 line 3180 [ 1800.697617][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:17 executing program 5: clone(0x200000041fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0) mount$fuse(0x20000000, &(0x7f0000000080)='./file0\x00', 0x0, 0x7a00, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000480)='./file0/../file0\x00', &(0x7f00000004c0)='./file0/../file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) msgget$private(0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) r3 = socket(0x40000000015, 0x5, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$void(r1, 0x40000005450) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @initdev}, 0x10) io_uring_enter(0xffffffffffffffff, 0x800, 0x0, 0x2, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000140)) ptrace(0x10, r0) ptrace$getsig(0x18, r0, 0x0, 0x0) 09:50:17 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000050000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:17 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:18 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1801.723910][T15960] binder: 15956:15960 got transaction with invalid data ptr [ 1801.752806][T15960] binder: 15956:15960 transaction failed 29201/-14, size 24-0 line 3180 [ 1801.831292][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000060000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1802.046340][T16065] binder: 16064:16065 got transaction with invalid data ptr [ 1802.068086][T16065] binder: 16064:16065 transaction failed 29201/-14, size 24-0 line 3180 [ 1802.096674][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:18 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000070000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1802.301114][T16167] binder: 16166:16167 got transaction with invalid data ptr [ 1802.346969][T16167] binder: 16166:16167 transaction failed 29201/-14, size 24-0 line 3180 [ 1802.404903][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000a0000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000120000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:19 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x181000, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, 0x0) r1 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x10001) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2000000000000, 0x0, 0x0, 0xfffffffffffffffc, 0x8000000, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000022000100600000000004000000680000"], 0x1}}, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') mq_open(&(0x7f0000000180)='eth1\x00', 0x800, 0x40, &(0x7f00000001c0)={0x3, 0x20, 0x800, 0xc38f08b, 0x9, 0x800, 0xf2, 0xfffffffffffffbff}) sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="30810004", @ANYRES16=r2, @ANYBLOB="000225bd7000fddbdf250c000000600003000800010002000000080004004000000014000600000000000000000000000000000000010800030004000000080001000000000014000600fe80000000000000000000000000001414000600fe8000000000000000000000000000104c000200080006000400000008000800200000000800090040000000080004000300000008000800030000000800040007000000080009001f00000008000b000200000008000300030000002800020008000600ffffff7f14000100ac141429000000004c3b451b1e0000000000000000080008000800000038000100080002008800040008000200ff00000008000800000000000c0006006c626c6300000000080002003c00000008000b007369700008000500080000000800040007000000ec92dd2d55e94712ce72b70cb0fc5f4ea4390e820dded8285cbf1e446f66b8f7e346508ac6c0f3b688bab364b3e5e8c0b776f24d7e59359c9d6398af15c22d0b8b8152f37db2b680ab33af963362b8c994ae4d05b4b09593822fcbb54b660b6d407ad632421abac3b1e2656240251f676b647a2ffbbd0e9ff240647224b403743e74b4f48afbf0e32f675131ec1147b0a48e74"], 0x130}, 0x1, 0x0, 0x0, 0xc041}, 0x11) 09:50:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000180000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000200000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:19 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000003f0000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:19 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1803.778685][T16790] binder_transaction: 4 callbacks suppressed [ 1803.778695][T16790] binder: 16788:16790 got transaction with invalid data ptr [ 1803.857061][T16790] binder_transaction: 4 callbacks suppressed [ 1803.857080][T16790] binder: 16788:16790 transaction failed 29201/-14, size 24-0 line 3180 [ 1803.899009][ T3269] binder_release_work: 4 callbacks suppressed [ 1803.899017][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404005000000000000000000000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000480000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1804.121100][T16897] binder: 16896:16897 got transaction with invalid data ptr [ 1804.136742][T16897] binder: 16896:16897 transaction failed 29201/-14, size 24-0 line 3180 [ 1804.162041][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 [ 1804.200171][T16919] binder: BINDER_SET_CONTEXT_MGR already set [ 1804.218258][T16919] binder: 16908:16919 ioctl 40046207 0 returned -16 [ 1804.867267][T17103] IPVS: ftp: loaded support on port[0] = 21 [ 1805.776428][T17103] chnl_net:caif_netlink_parms(): no params data found [ 1805.898397][T17103] bridge0: port 1(bridge_slave_0) entered blocking state [ 1805.914736][T17103] bridge0: port 1(bridge_slave_0) entered disabled state [ 1805.926298][T17103] device bridge_slave_0 entered promiscuous mode [ 1805.991778][T17103] bridge0: port 2(bridge_slave_1) entered blocking state [ 1806.003603][T17103] bridge0: port 2(bridge_slave_1) entered disabled state [ 1806.016390][T17103] device bridge_slave_1 entered promiscuous mode [ 1806.123123][T17103] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 1806.194045][T17103] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 1806.275727][T17103] team0: Port device team_slave_0 added [ 1806.291474][T17103] team0: Port device team_slave_1 added [ 1806.402650][T17103] device hsr_slave_0 entered promiscuous mode [ 1806.469764][T17103] device hsr_slave_1 entered promiscuous mode [ 1806.618236][T17103] bridge0: port 2(bridge_slave_1) entered blocking state [ 1806.625427][T17103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1806.632894][T17103] bridge0: port 1(bridge_slave_0) entered blocking state [ 1806.640054][T17103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1806.749372][T22745] bridge0: port 1(bridge_slave_0) entered disabled state [ 1806.757778][T22745] bridge0: port 2(bridge_slave_1) entered disabled state [ 1806.941873][T17103] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1806.966679][T22742] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1806.983767][T22742] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1807.047887][T17103] 8021q: adding VLAN 0 to HW filter on device team0 [ 1807.073953][T22742] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1807.092837][T22742] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1807.106629][T22742] bridge0: port 1(bridge_slave_0) entered blocking state [ 1807.114004][T22742] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1807.196821][T22745] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1807.207017][T22745] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1807.227163][T22745] bridge0: port 2(bridge_slave_1) entered blocking state [ 1807.234341][T22745] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1807.249879][T22745] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1807.354843][T22742] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1807.370673][T22742] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1807.387541][T22742] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1807.397533][T22742] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1807.416805][T22742] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1807.479526][T17103] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1807.497750][T17103] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1807.518230][ T7899] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1807.527979][ T7899] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1807.545274][ T7899] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1807.566209][ T7899] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1807.578244][ T7899] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1807.640714][T22742] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1807.725805][T17103] 8021q: adding VLAN 0 to HW filter on device batadv0 09:50:25 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000004c0000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404005000000000000000000000000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:25 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:25 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x200, 0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvfrom$x25(r0, &(0x7f0000001380)=""/73, 0x49, 0x10020, 0x0, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000000c0)={@local, 0x0}, &(0x7f0000001400)=0x14) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000001440)={@remote, @ipv4={[], [], @empty}, @mcast2, 0x9e67, 0x8, 0x60ca, 0x500, 0x1, 0x9, r2}) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000014c0)=ANY=[@ANYBLOB="101200002200010000600000000000000400000040000e00e677aef144f3491b7a31067c8106afafabe12d5dbdb46279ffed0b58f063a1544a659d110eb9728b4f2442764240724688f81f53379b7c37a473230008877772b1d7eaca161ed3c84c0a6deba6c54110e97738acfadc79c8c54c4fb1e59b620d2f8b76be792dfdbdfaa1cbc7ed9852b34fa0b7cac444b3172fa377d4ef3cbe6f7baad276705a469dafdbc76073f81f75fd396783bd29fc8afe57d5996bacbb8e4076db1a16536532749e0bf08e5f42cf565e98a41b9c96437157ee03ec6e0ed35d554144236d489ffdb6443e5aaed90da002a7b99ecbd3bbe3a627095bd4a2197996b07936ee74cfff1f7ad0d296280ccfd863e8d1d1f24897d149d1f166a7afa1e07be331387cfe6d63ba4a13469fd1067942cad16a050c71ce4e13c71c8ef84ec79370ca56697befd30b67a2fa69ab77f4571c50a5d0be44eb3fbdb813fe4d440aefcc1bdfadba77f46f77295e43b4171fff65e697bfc2799ba3248fb52286bab9d9b5a124846a93214b545a0076db01853a21b446b454307ad381136ac69305491e7a50b5933b27e9b26ac9fafcfcc6f32310c749e28a5d94d5b0e90aac866d386dbf8f0d2d228be5d1b828ceba4d0d5c310d29e4b5835a3ccaa55deeaaa02b6dcd7efca5b17d0d6b58d2880358124fe315aead12216b47b398ecd60c38d4fe83310e0ad0b8e502944ab57ef7b6ffada69ebed3b3ea46f9cc2889f3b311ddcdd22107c4b546d2c483a760cfb31bb6d1378f83ac5ced673fdc0693f0990798a280db19bf1a0add41630abb508a778548018b0db2411b4b7223aea96fea4422377b74b7d3beae29ef4987c90ad876b70fc619168ee02d4c0fb2dae7251aa337fe339a316c6319c57229478452ec73d7e834b9c7c1fa15e70ce76bb1f16c0e304d8cd55e632a88f5c67603cba066a161103ced929d1d0a2544ae60241ba1e5c712e4c7ec5dd1b6cd3122d5e699614259814ab23684db5cdf082648dee8b44578c63b59ef08cab07c71f28f7df5fea574646f21e4ae9f1d866d4a29c74d33d6ce83aa2ab25d88d982de3fd30eea0f74bc92277fbc0d61a65250af4fd9f5f5d3d116000cd03371bfdbd4590ef8df524cb6f9696964781ca34abf32917abd24f55fda3e802f8062a02cc1b6fe1e41c9a6a89a4a397ae493d6ee83686c668ff2a4f01cf87ac1fb27111a6aedf4813f97f713fa9b644588c50645fa391b7830b18817978baa4a4f0bdf9bb0c9fded2ec4eca9b140fe6b9b71708a93c03c0ea1e0e5c19e7ca5831e2a7505bb174f0dab5b178624a5a9250433e8cce00534bbdf9eb4e66bff0909714bd88119b3268a835f55fde7124aae831c933069d447649bbce7fc135bff535b0946ef00547ba3df5e8f46fe005c0e35bd1ee1f74474a2e7bb91aabe82e9729a42da446f20b4f3c24a309cc2a6baf1fc40133716b4efbd189696e2f5ffe60fd13b843137216778a7b042e12d470e36b5e9f419179efe6be689f27724c7e865092a99b1b517051a7e16374543efed2d41a2cde8df5aa3d52b7a9ea42ccc58444b9d78d883cd1eeb5e46f25297bab74d75e66d0ae79276e7345175c4e61ba228fbcf98cbc9a199ea2b4b68594f260e56a73c721e78b75ded87365c8e2a8c5abd85a64eb1ed9e7c8d9918662dc2298957c43a76e8286ac0bef8ef7d4f01995d7ce3b35dd81667cf3e945556c3ad851698ea9f98e734f49b4ba5279654308143b6119ce2065ab15999510e93d031cc23c04d70f152d76b056c0fee8fddd3d35fbf38bdb2e558fa101409891ca1e7ac148790a4671ff3d045d094a7114381899218c3b20e455aec9a881e5af0182ca7366bea251a8c5780004f2ded29091c873616016666650ca61cf3698cfe57e746ab960527b007fbdfde524e54e4baef6da24ab51b25ac27b3688de5a03730ccab8866a6f1efc888d3a714e031170853a48bebbe35c14164f58b563a80086f2e4f801b449e1957fe5b1c570f21ab4298cf568eb8486834d576d69eb72edef7d864063f505c94d11a5a050b803e0882263ceb857ed554e0d61deb0056ef0378ea65dfe642eaf9571131e0fff01d6ced4e57d065a3c93b49b131e2ca0f91d047952eeddf27812776c697c0fa7a36d0314cd74f41ebc375ad692679b1c82674b3837cf964f3208a92eb8cb5efb3bd7088a1f0b586d2682581d3195bc82feaa5f855cb38163556e37819a1503645055703732cfb917431141ae1d223e0aebc34270a79956bd420475daa804904aefb37bcd9d0b846d8e06b2027b0d3a09d7ef0a761a95f9e8bc8523b60177080247b822c30b3bb51a12a2227eaf04c4fc42312444f61da40d4b34ed9e0626171e02cf82c3616b58945de50cf6e03769b6d4766ee3285fc98318630488f784b011955d30ac431a851dcc834179f394663517290a03ddd8a616cebe03c734d051f52ccb4ea948d8edab5dab5c2f9ab1c0b4a5877bb135dad77a215e7b3000e1f6a006c20fad4efeb73857633141443245912e164935bd52e147b61ac9e172ae571a14676764de0f9dd1750f8a0fabacb4a4409811d0db788a0266b50efc63ed57a998149b2175d3d2a733ba245d8d588cf97ec49016583ec85e63f32cf3d9907fb6939cd2986059f58bb95528dcb9d1e68ee5748ea40ff5ef16c816848afc17231f4c222519a0eac27faa08edb1493aed4661ea676bbb77aa7eb40793cee2c2ecb8678dca63b195b80fd56cafdde83df73e2acbab1f6e54baf4c56c4ef5201555cd4d0b2b3563258fbf80531a15085a0b64c974e42cb91bdeb464d2694697be344c8c849962d2d4431fea33fa05a3be23914a8d378cf31b31e16022c2cf59b0f8a6aeb66c00b49bd29d6add698df64f95fdb2e3ccf19484e6f194ea5981a648ad0475aadead04282bc022b3b61a5be60dc2cc63bc710a80ad2dababb67b1f6d074de1d2b6961b4028c58387493c00ed3046778a9cbd98d24d4ea6db6d91509215f1fd8d80c7712ed13fe97085944f11c84f4ce2ceeb319f12c0eaa4910fe533e0f1e742ab110c1d2784d35b152eda8173d690af7793413274e7830e593321707dacff792d78bd6984dcaccee35701636a861f24cfced99c4dcc90105c6359a5db02b28859a1c170dfc82edf343e0f963ffbb725c7b0691926f6b7929ac237db653719e397965f27bae37951249a7adcb451f089dfde5070ea79370836b998772f8ef9eedb2c99f9fb794b1707392e4cd9587021dedf053d93575d7c72b6be9292b072c0a050431e887b57da01728bba1685aa9c699cb0cb6cfc1227d08158f53ed6a067c167dd3a2b6eee60414de6d0a2d2256bf415114b411abc239e1b3bbe3c3f0dafd20ffeea267f9447f973ea965f78e33543ab8162918f870394ecfba3efd7dd1e67ce75314abf758ef52921b61f698be9b95016b3741dc4e257791c322b0bfb2bd0ed6723d9a8a1b76bd69bbe79ec719f9f85b785b7f8dfd9b2ccf7811a0e12e1bd2028df17f711c8fd06353034b087413c69a7b08797dea36a205522a57c1ddc4f789b3b98d0ff9543d40d2521c711715f430df9a67eeb1d20176d67951befbafd91641870bfe5e6e62ef78fa54a5a94fe497144eec0d59a1c275e840a16639b6731f484fd13aa67918b10ca076c2566fd696c11d2ed5dc1109920cff6931a340f4c7103eb57301c2d843f8c968963e7f4b4731f2b8b81b13faafeef874198916ca8b0e3e8bbe815a1846ad1abef12ca917684d5ebcb59edc9afbc879ac513c1d257d3bd22c4334d1de0d30976bc4b999f725f125ee65b3bfa14962903f13c328fc4904f78f7a51e1e58665c78928687e979cfa47280840f58cc78b1b0677a025700a498b5a179557e01decfc066e0d1ccfecf3b9ff2aba2d8d23a26321c0322524886df355af2e3d244a1c909361b957f90ab10132bef48d875548ad221404efa1cbc82c6533dde64217ac7edb430af79d72db1d510c0324a3fc4c29267d2b446cfba411d1d9009c81bbd8e7fc14c3b4bc05b2b8ba4a64539d95675f1214fbcfd4c8126f54c4e826b9b75d521e72cfa126fbd6b7d126f66d5c5fb5f0b80684f048eae6e8866a298ea6de7d847f773676071e6443b46286adc6026fd922eafc31ad4850d5133956b605559d30d45518d6e832330b934ec13ce66d611e027140cf16cac7a714d56ac79e0e5490b295d3057911fe15a252b33395a16929b76425897d853e61416c87d833352c82aa39ccdade86346183ca50e4279b5cea7ad8558a0422009fb0571a0dc0a88498fbdf5bc8278fbfaed0a4d4a6cfe76dcc4f461fc82d6c484b8c4e34fa4d8251d3faa636fd4a192647b962cf09b6ba284d5f095fddf92a635b8f6e9bd488f7ff98319b90f2dee7041e8fbb0fa3a1d4e630a9dad9ba3e6fbe3fc7b49ea2946fe884d12a37f0ffb462795e0596e99c8f31af101a22a8b86783e1b63094585cd55a0a96615668885d39d2f5df0beb048e1f1eeab92da995506d357e5bdc9e5ed2a2e59b785ad2c86f657fabef4b60481254076278950d9df971e97e95119980de36c9b440f18c1748bc80602fe865778c06c9a93bab9e90885089d424adcc7943bb271ae40d3cf1cbe3fa17df4921d3fbafd9d4e657f1571a5961a5b79b2ef15832c7ae34714caff548ef056417bb572238c3acbf0758122b864f292185ba2c35aff6f5b8c4b66427b37053cd43c078825e425e15617f0894a4815f4fbaaf27a2b62ebc6d262ecaede46285499b29f82a5b215864c0b47a4bda5acdbdf933eebd6479916231d2c5ef71f1fdbb4225f7dc1d0a99d619cbbbc8e0c7ad3becd901490d0cf31b11c01a9384d4eeb9543855a9fe8187c2a5c2642d6e0aacf67c8da7dc761c33ae6eeaae4708287fe3ae7934c632b4fa97482e9bdadfba4493150417a66473793119bb0973b0430f75026df935cfefd038313976fe3043ea89be8f44f4118640dfb1b2bcf4cc04ec5ad173cee81cdd121716bb8542a0f7336d964e77702c842eedbc40248b25edaf66f4829c53763439ef048816779d5cc46f2cb5c9abb2ea597fc48169114029a1dc541b5b965e7868f072d7603c675a1b41413ba389f4dddba576f5a505087b2bef40063df5284baf33e14a838c310611f72a51ca8c95ba9f575bd17cc35600b42ce8443afaaafea264c81b5b8ab4bfb12a5f80d93e0e3bfd3f316d396834c39245a7d364e5e2109a2a7c44a29329966d1652f90bea7dee14428a8edd3055412f1c17b484a9684cfec5bc991d618d0c1ff70c68ac5a6d87cfdd1e8543e91c4a03de248847e3fe543dc0da7db2934856748e9cd9d1238c556773a4ce5e425340665026a1b997afd12623f675c21e6413fb3f6e8947032a294b60c9f8304670ceb8566ce9de2aebc14be67fcddf61cc788efdc4fa5a399574a382c1007461d31c2b752a7b1bd0d3f7fe8cadd5a442cf755c26041d5409ba9a144d4ea9ce5e17bd794b6858330d1f9da0d427fd7972a57ed9efd31d475a5f9e9be0e7dd253a7d4b3b65785da72099b991f9d15bae7e0a407015080c3f13ca8923cc845c91fdcb527f6c84678f87f27f8fcb82f2e6bcc77621a8a626dbf88a636fe9e52c6c454a5853da3d81c3f8cfe0745ddeb386078b779a93dccc2ed084c319bbbff087dbc5079e8229de2e9bcb5f848b1f437d1f0726e3d9f8ef4410c3c50178acb47ffba0554990a05cf365a8614321c7dc240841d5c728f6e805e706ba7d1c9f831c9f948047aaad59388f0b53a92e0f422cf67925c84f9e9b85b909a606dffc83e585c53ff1c0168003cdead88419842ff9aa30c2ec63a664f1190117e1884a3c19985355b63cd8b7da49d5bf876e1fc277b67af5d0906223de75ad16d10e6a7674ea9e29adc7ab1341d27f4c4e02d46a7a78b0b2852a6900741ebef57e012586245a31f59aefda89765054f32b00219fb7275c32ad9baec5a33210e65c6a70f9e88bc1cff24c98e72c18eeb2af1e1cc677efd17c5f64d267d28d85649a14b43a8503cbe1774fc0c41069cb2fc2bc20870be2657ac64fad881d3c77c99eb6f959acb1e29a6c8bad5cd426215df07dbd4f47a9920e6b9c89ab477054bca4cdafa40c79dfdd7b926e33048039b6bde4aaacb47753135ab3a516db30c7b4522c48417c04ecd8e67e830d4766e15dae162edc3ace8e99e8a48f22514b28e7e3724dea9613130460fca1ea283bd7fd0d5a7dac4f9524c51fba0473211f50674f09e885324b3c7a404ec937f9fd50dc49d740622d2672c1064cd74723cf0f0248cb4d95db27b0a585d14815bc822bd6c9c9f4cf8d1b9e0c2f9330eb684179a9effdcfe5d57e15f3e2d2c2d0b1bb8467e96b8d0a9bbec56adf418cb6899397fc4100f43b0ce1d8c27a886c47165d6b6f63b98f443bf77f5bffd8dbf2eefb4618b185d735e5e64ab73c0f0fbc659421a8df15732804421338000800100057002f6465762f66756c6c000000100057002f6465762f66756c6c00000014001e00fe80000000000000000000000000001100006ad8abb2c1d8058b670177bab1a6c1374bd936994762c51882f294beeb84de2bd109d2502ccf1def1de6d0d9e109e28095105a6f20f618d0051a906bd7431a51dafadea143113aaf639c2019660e614abb10f1da297aebddcebd063978796833c593bc751646f309e0c73521fe24"], 0x1210}}, 0x0) 09:50:25 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1808.897200][T17221] binder: 17215:17221 got transaction with invalid data ptr [ 1808.930426][T17222] binder: BINDER_SET_CONTEXT_MGR already set [ 1808.936498][T17222] binder: 17217:17222 ioctl 40046207 0 returned -16 09:50:25 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) ioctl$SIOCRSGL2CALL(r0, 0x89e5, &(0x7f0000000100)=@bcast) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1808.997372][T17221] binder: 17215:17221 transaction failed 29201/-14, size 24-0 line 3180 [ 1809.020859][T17222] binder: 17217:17222 got transaction to invalid handle [ 1809.028726][T17222] binder: 17217:17222 transaction failed 29201/-22, size 24-0 line 2995 [ 1809.052730][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 [ 1809.084715][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:25 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000600000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1809.385954][T17334] binder: 17333:17334 got transaction with invalid data ptr [ 1809.438158][T17334] binder: 17333:17334 transaction failed 29201/-14, size 24-0 line 3180 [ 1809.479991][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000680000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1809.744583][T17517] binder: 17507:17517 got transaction with invalid data ptr [ 1809.761684][T17517] binder: 17507:17517 transaction failed 29201/-14, size 24-0 line 3180 [ 1809.788051][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:26 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000006c0000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1810.067781][T17645] binder: 17644:17645 got transaction with invalid data ptr [ 1810.097023][T17645] binder: 17644:17645 transaction failed 29201/-14, size 24-0 line 3180 [ 1810.134447][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:26 executing program 5 (fault-call:3 fault-nth:0): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:50:26 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000740000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1810.431671][T17750] binder: 17748:17750 got transaction with invalid data ptr [ 1810.457442][T17750] binder: 17748:17750 transaction failed 29201/-14, size 24-0 line 3180 [ 1810.479287][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000007a0000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:26 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1810.696913][T17055] device bridge_slave_1 left promiscuous mode [ 1810.707833][T17857] binder: 17855:17857 got transaction with invalid data ptr [ 1810.718405][T17055] bridge0: port 2(bridge_slave_1) entered disabled state [ 1810.732657][T17857] binder: 17855:17857 transaction failed 29201/-14, size 24-0 line 3180 [ 1810.750043][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 [ 1810.771341][T17055] device bridge_slave_0 left promiscuous mode [ 1810.788310][T17055] bridge0: port 1(bridge_slave_0) entered disabled state 09:50:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000800000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1811.000885][T17964] binder: 17963:17964 got transaction with invalid data ptr [ 1811.020401][T17964] binder: 17963:17964 transaction failed 29201/-14, size 24-0 line 3180 [ 1811.055805][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 [ 1815.052951][T17055] device hsr_slave_1 left promiscuous mode [ 1815.117521][T17055] device hsr_slave_0 left promiscuous mode [ 1815.185422][T17055] team0 (unregistering): Port device team_slave_1 removed [ 1815.215362][T17055] team0 (unregistering): Port device team_slave_0 removed [ 1815.238515][T17055] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 1815.319047][T17055] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 1815.467500][T17055] bond0 (unregistering): Released all slaves 09:50:32 executing program 1: prctl$PR_GET_FPEMU(0x9, &(0x7f0000000100)) r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000002200efc2531a32fda2089d3421b8120100006000"/33], 0x14}}, 0x0) 09:50:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000fffffdfd0000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x2, 0x0, &(0x7f0000000000)=0x107) 09:50:32 executing program 4 (fault-call:1 fault-nth:0): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) [ 1816.015542][T18170] binder: 18167:18170 got transaction with invalid data ptr [ 1816.029404][T18170] binder: 18167:18170 transaction failed 29201/-14, size 24-0 line 3180 [ 1816.053377][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:32 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x3, 0x0, &(0x7f0000000000)=0x107) 09:50:32 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:50:32 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000007fffffffefff0000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:32 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x3a, 0xcb, &(0x7f0000000180), 0x4) 09:50:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x4, 0x0, &(0x7f0000000000)=0x107) [ 1816.572043][T18295] binder: 18290:18295 got transaction with invalid data ptr [ 1816.617198][T18295] binder: 18290:18295 transaction failed 29201/-14, size 24-0 line 3180 [ 1816.673337][T22742] binder: undelivered TRANSACTION_ERROR: 29201 09:50:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000ffffffff0000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1816.919667][T18402] binder: 18401:18402 got transaction with invalid data ptr [ 1816.946824][T18402] binder: 18401:18402 transaction failed 29201/-14, size 24-0 line 3180 [ 1817.005986][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:33 executing program 1 (fault-call:8 fault-nth:0): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000060ffffffffff0000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:33 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x7, &(0x7f0000000180), 0x4) 09:50:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x5, 0x0, &(0x7f0000000000)=0x107) 09:50:33 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1817.599045][T18587] binder: 18568:18587 got transaction with invalid data ptr [ 1817.631409][T18587] binder: 18568:18587 transaction failed 29201/-14, size 24-0 line 3180 [ 1817.683839][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000020000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1817.768592][T18710] FAULT_INJECTION: forcing a failure. [ 1817.768592][T18710] name failslab, interval 1, probability 0, space 0, times 0 09:50:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x6, 0x0, &(0x7f0000000000)=0x107) [ 1817.921192][T18723] binder: 18722:18723 got transaction with invalid data ptr [ 1817.979180][T18723] binder: 18722:18723 transaction failed 29201/-14, size 24-0 line 3180 [ 1818.006300][T18710] CPU: 0 PID: 18710 Comm: syz-executor.1 Not tainted 5.1.0-rc7+ #98 [ 1818.014351][T18710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1818.024443][T18710] Call Trace: [ 1818.027791][T18710] dump_stack+0x172/0x1f0 [ 1818.032154][T18710] should_fail.cold+0xa/0x15 [ 1818.033150][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 [ 1818.036789][T18710] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 1818.036809][T18710] ? ___might_sleep+0x163/0x280 [ 1818.036825][T18710] __should_failslab+0x121/0x190 [ 1818.036838][T18710] should_failslab+0x9/0x14 [ 1818.036851][T18710] kmem_cache_alloc+0x2b2/0x6f0 [ 1818.036871][T18710] getname_flags+0xd6/0x5b0 [ 1818.036884][T18710] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1818.036898][T18710] getname+0x1a/0x20 [ 1818.036912][T18710] __x64_sys_mq_unlink+0xc2/0x550 [ 1818.036928][T18710] do_syscall_64+0x103/0x610 [ 1818.036946][T18710] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1818.036966][T18710] RIP: 0033:0x2000000a [ 1818.101945][T18710] Code: Bad RIP value. [ 1818.106035][T18710] RSP: 002b:00007fdb20a77bd8 EFLAGS: 00000286 ORIG_RAX: 00000000000000f1 [ 1818.114476][T18710] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 000000002000000a 09:50:34 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:34 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x14, &(0x7f0000000180), 0x4) [ 1818.122471][T18710] RDX: 0000000000000000 RSI: 00000000000000e8 RDI: 0000000000000005 [ 1818.130471][T18710] RBP: 00000000000000e4 R08: 0000000000000005 R09: 0000000000000006 [ 1818.138467][T18710] R10: 0000000000000007 R11: 0000000000000286 R12: 000000000000000b [ 1818.146554][T18710] R13: 000000000000000c R14: 000000000000000d R15: 0000000000000005 09:50:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000030000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1818.436676][T18837] binder: 18835:18837 got transaction with invalid data ptr [ 1818.469085][T18837] binder: 18835:18837 transaction failed 29201/-14, size 24-0 line 3180 [ 1818.478527][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x7, 0x0, &(0x7f0000000000)=0x107) 09:50:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000040000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1818.766279][T18944] binder: 18942:18944 got transaction with invalid data ptr [ 1818.778786][T18944] binder: 18942:18944 transaction failed 29201/-14, size 24-0 line 3180 [ 1818.790118][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:35 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:35 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x15, &(0x7f0000000180), 0x4) 09:50:35 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000050000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1819.204231][T19151] binder: 19148:19151 got transaction with invalid data ptr [ 1819.267391][T19151] binder: 19148:19151 transaction failed 29201/-14, size 24-0 line 3180 [ 1819.313328][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x8, 0x0, &(0x7f0000000000)=0x107) 09:50:35 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x1b, &(0x7f0000000180), 0x4) 09:50:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000060000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:35 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1819.565879][T19266] binder: 19265:19266 got transaction with invalid data ptr [ 1819.588041][T19266] binder: 19265:19266 transaction failed 29201/-14, size 24-0 line 3180 [ 1819.626217][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000070000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1819.954908][T19373] binder: 19372:19373 got transaction with invalid data ptr [ 1819.983696][T19373] binder: 19372:19373 transaction failed 29201/-14, size 24-0 line 3180 [ 1820.011845][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000a0000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:36 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x1c, &(0x7f0000000180), 0x4) 09:50:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x9, 0x0, &(0x7f0000000000)=0x107) 09:50:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000120000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:36 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f00000001c0)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(r2, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x48, r3, 0x200, 0x70bd2c, 0x25dfdbfe, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x1000}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x7, 0x1, 0x8, 0x5dc327be]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x3}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x7}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xffffffffffffffff}]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x20040000) r4 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$NBD_CLEAR_QUE(r4, 0xab05) getsockopt$inet6_int(r4, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:37 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000180000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0xa, 0x0, &(0x7f0000000000)=0x107) 09:50:37 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x24, &(0x7f0000000180), 0x4) 09:50:37 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1821.184042][T19805] binder_transaction: 2 callbacks suppressed [ 1821.184052][T19805] binder: 19800:19805 got transaction with invalid data ptr 09:50:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0xb, 0x0, &(0x7f0000000000)=0x107) 09:50:37 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x2a, &(0x7f0000000180), 0x4) [ 1821.230413][T19805] binder_transaction: 2 callbacks suppressed [ 1821.230432][T19805] binder: 19800:19805 transaction failed 29201/-14, size 24-0 line 3180 [ 1821.305323][ T7899] binder_release_work: 2 callbacks suppressed [ 1821.305332][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000480000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1821.582547][T19922] binder: 19921:19922 got transaction with invalid data ptr [ 1821.598035][T19922] binder: 19921:19922 transaction failed 29201/-14, size 24-0 line 3180 [ 1821.616831][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000004c0000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1821.941668][T20024] binder: 20023:20024 got transaction with invalid data ptr [ 1821.976367][T20024] binder: 20023:20024 transaction failed 29201/-14, size 24-0 line 3180 09:50:38 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x30, &(0x7f0000000180), 0x4) 09:50:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0xc, 0x0, &(0x7f0000000000)=0x107) [ 1822.045938][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) pkey_alloc(0x0, 0x1) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:38 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:38 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000600000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:38 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xc8, &(0x7f0000000180), 0x4) 09:50:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0xd, 0x0, &(0x7f0000000000)=0x107) [ 1822.503945][T20242] binder: 20238:20242 got transaction with invalid data ptr 09:50:38 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xc9, &(0x7f0000000180), 0x4) [ 1822.559525][T20242] binder: 20238:20242 transaction failed 29201/-14, size 24-0 line 3180 09:50:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x10, 0x0, &(0x7f0000000000)=0x107) [ 1822.619524][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000680000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1822.896416][T20362] binder: 20361:20362 got transaction with invalid data ptr [ 1822.936354][T20362] binder: 20361:20362 transaction failed 29201/-14, size 24-0 line 3180 [ 1822.990269][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000006c0000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1823.237943][T20464] binder: 20463:20464 got transaction with invalid data ptr [ 1823.259310][T20464] binder: 20463:20464 transaction failed 29201/-14, size 24-0 line 3180 [ 1823.275040][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:39 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xca, &(0x7f0000000180), 0x4) 09:50:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x11, 0x0, &(0x7f0000000000)=0x107) 09:50:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, &(0x7f0000000180)="0f01c866b9aa0a000066b80000000066ba000000000f30b82d010f00d0ba4300ec0f0018f2f08274e8062ef20f009af1ff0f013b3e65649c640f01cf", 0x3c}], 0x1, 0x9, &(0x7f0000000240), 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$bt_BT_CHANNEL_POLICY(r2, 0x112, 0xa, &(0x7f0000000140)=0x3, 0x4) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000740000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:40 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:40 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcc, &(0x7f0000000180), 0x4) 09:50:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:50:40 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x13, 0x0, &(0x7f0000000000)=0x107) [ 1823.943412][T20694] binder: 20686:20694 got transaction with invalid data ptr 09:50:40 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcd, &(0x7f0000000180), 0x4) [ 1823.985487][T20694] binder: 20686:20694 transaction failed 29201/-14, size 24-0 line 3180 [ 1824.025649][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000007a0000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1824.355726][T20810] binder: 20809:20810 got transaction with invalid data ptr [ 1824.378508][T20810] binder: 20809:20810 transaction failed 29201/-14, size 24-0 line 3180 [ 1824.415266][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000300000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1824.676940][T20912] binder: 20911:20912 got transaction with invalid data ptr [ 1824.712425][T20912] binder: 20911:20912 transaction failed 29201/-14, size 24-0 line 3180 [ 1824.744168][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:41 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcf, &(0x7f0000000180), 0x4) 09:50:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x14, 0x0, &(0x7f0000000000)=0x107) 09:50:41 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x6, 0x2000) r3 = add_key(&(0x7f00000002c0)='id_legacy\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000340)="ea445c32c622fb5389a3c9d4d1cc9c8673707edea648b15adfaed8d213", 0x1d, 0xfffffffffffffffa) add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000240)="92b0a85f08daef36f2f44cab550e1577c899cc155eeab41352a273d1a1bccd1474e3465cfa0ff92f23646a8e522c904e761495f240762a5c86b36a026522288cc2d64409d93e56d2f5c816782cfa", 0x4e, r3) 09:50:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000500000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:41 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x15, 0x0, &(0x7f0000000000)=0x107) 09:50:41 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xd0, &(0x7f0000000180), 0x4) [ 1825.109450][T21130] binder: 21126:21130 got transaction with invalid data ptr [ 1825.129653][T21130] binder: 21126:21130 transaction failed 29201/-14, size 24-0 line 3180 [ 1825.186470][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:41 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000600000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:41 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xd1, &(0x7f0000000180), 0x4) 09:50:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x17, 0x0, &(0x7f0000000000)=0x107) 09:50:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000700000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000a00000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x19, 0x0, &(0x7f0000000000)=0x107) 09:50:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000001200000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:42 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xd2, &(0x7f0000000180), 0x4) 09:50:42 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000140)=[@mss={0x2, 0x7c2d}], 0x1) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote}, 0x1c) fadvise64(r0, 0x0, 0x0, 0x3) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x1a, 0x0, &(0x7f0000000000)=0x107) 09:50:42 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:42 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1826.649448][T21679] binder_transaction: 3 callbacks suppressed [ 1826.649459][T21679] binder: 21671:21679 got transaction with invalid data ptr 09:50:42 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xd3, &(0x7f0000000180), 0x4) 09:50:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x1b, 0x0, &(0x7f0000000000)=0x107) [ 1826.702623][T21679] binder_transaction: 3 callbacks suppressed [ 1826.702641][T21679] binder: 21671:21679 transaction failed 29201/-14, size 24-0 line 3180 [ 1826.721871][ T7899] binder_release_work: 3 callbacks suppressed [ 1826.721915][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000001800000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1827.006608][T21795] binder: 21794:21795 got transaction with invalid data ptr [ 1827.049224][T21795] binder: 21794:21795 transaction failed 29201/-14, size 24-0 line 3180 [ 1827.064074][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000002000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1827.282192][T21897] binder: 21896:21897 got transaction with invalid data ptr [ 1827.295919][T21897] binder: 21896:21897 transaction failed 29201/-14, size 24-0 line 3180 [ 1827.317361][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000003f00000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1827.511384][T22101] binder: 22086:22101 got transaction with invalid data ptr [ 1827.526538][T22101] binder: 22086:22101 transaction failed 29201/-14, size 24-0 line 3180 09:50:43 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xd4, &(0x7f0000000180), 0x4) 09:50:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x1c, 0x0, &(0x7f0000000000)=0x107) [ 1827.565998][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:43 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:44 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x80004e20}, 0xfffffecc) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000004000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1827.845266][T22218] binder: 22216:22218 got transaction with invalid data ptr [ 1827.865690][T22218] binder: 22216:22218 transaction failed 29201/-14, size 24-0 line 3180 09:50:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x1d, 0x0, &(0x7f0000000000)=0x107) [ 1827.894096][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:44 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:44 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180)=0x3f00, 0x4) 09:50:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000004800000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1828.176277][T22338] binder: 22337:22338 got transaction with invalid data ptr [ 1828.198335][T22338] binder: 22337:22338 transaction failed 29201/-14, size 24-0 line 3180 [ 1828.220533][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000004c00000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:44 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000140), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) socket$key(0xf, 0x3, 0x2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) ioctl$VIDIOC_G_FMT(r2, 0xc0d05604, &(0x7f0000000240)={0xa, @pix={0x7fffffff, 0xd03a, 0x0, 0x9, 0xecb, 0x7ff, 0x7, 0x0, 0x1, 0x8, 0x1, 0x7}}) syz_execute_func(&(0x7f0000000340)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e957bb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca5566f745bf0d59b83a00a2f1fbfb766208cf") [ 1828.484465][T22444] binder: 22442:22444 got transaction with invalid data ptr [ 1828.499237][T22444] binder: 22442:22444 transaction failed 29201/-14, size 24-0 line 3180 [ 1828.516067][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000006000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x1e, 0x0, &(0x7f0000000000)=0x107) 09:50:44 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180)=0x4000, 0x4) [ 1828.734865][T22653] binder: 22652:22653 got transaction with invalid data ptr 09:50:45 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1828.778615][T22653] binder: 22652:22653 transaction failed 29201/-14, size 24-0 line 3180 [ 1828.894043][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000ff6000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x21, 0x0, &(0x7f0000000000)=0x107) 09:50:45 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180)=0x1000000, 0x4) [ 1829.160445][T22772] binder: 22771:22772 got transaction with invalid data ptr [ 1829.176974][T22772] binder: 22771:22772 transaction failed 29201/-14, size 24-0 line 3180 [ 1829.224502][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:45 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:45 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(r0, 0x1, &(0x7f0000000140)="463303d2805df76611cc97acf97979768a8a1e4cbd44b1bed2a7e30a658f0370ab211ac3de077367fd8ab8e05fdecdd32c486830f9c7b457fadedee967e2ea72e7bca1e9afdc8a87870cbec17de3a3d848a706687edbbad817438d65512d771d8d6c04922ae69e30d818b6c8cf2a08f039d065a91f0a710765a525aa86c0c6db06f1496b14d36d2479a0422e9c299c9194244c520d9195c6ddb4e09085ed2ed7f33a2f0fb11319af90e07929078fd511aba644d3269fd317bce6") setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000006800000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1829.494837][T22888] binder: 22886:22888 got transaction with invalid data ptr [ 1829.527451][T22888] binder: 22886:22888 transaction failed 29201/-14, size 24-0 line 3180 [ 1829.569306][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000006c00000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x22, 0x0, &(0x7f0000000000)=0x107) 09:50:46 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180)=0x3f000000, 0x4) 09:50:46 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000007400000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x23, 0x0, &(0x7f0000000000)=0x107) 09:50:46 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180)=0x40000000, 0x4) 09:50:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000007a00000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:46 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:46 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180)=0x100000000000000, 0x4) 09:50:47 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) getsockopt$bt_l2cap_L2CAP_CONNINFO(r2, 0x6, 0x2, &(0x7f0000000000), &(0x7f0000000040)=0x6) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) fstatfs(r0, &(0x7f0000000100)=""/222) syz_execute_func(&(0x7f00000004c0)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fdc481ef10ea262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af48f3000000005fd25cf3460f2ad0f30f5ea5a9a50000c4829d92445d05660f79ca553131b83a00a2f1fbfb766208cf") 09:50:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000009400000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x24, 0x0, &(0x7f0000000000)=0x107) 09:50:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000040000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:47 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180)=0x3f00000000000000, 0x4) 09:50:47 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000080)=0x2, 0x4) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:50:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000007150000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:47 executing program 5: unlink(&(0x7f0000000040)='./file0\x00') r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x100, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e21, 0xfffffffffffffc00, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}}, [0x9, 0x0, 0x3, 0x6ca, 0x1, 0xfff, 0x40, 0x4b7, 0x2, 0x5, 0x2, 0x7fff, 0x0, 0x2, 0x7]}, &(0x7f0000000200)=0x100) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000240)={0x80000001, 0x4, 0x8001, 0x6, 0x100000001, 0x80000001, 0x3f, 0x1ff, r2}, &(0x7f0000000280)=0x20) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") iopl(0xfffffffffffffff9) r3 = dup(r0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000080)=[@mss={0x2, 0xff}, @window={0x3, 0x1, 0x2}, @sack_perm, @mss={0x2, 0x7ff}, @window={0x3, 0x7}], 0x5) getsockopt$inet_buf(r4, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:50:47 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180)=0x4000000000000000, 0x4) 09:50:48 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000d050000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1831.842951][T23872] binder_transaction: 6 callbacks suppressed [ 1831.842962][T23872] binder: 23871:23872 got transaction with invalid data ptr [ 1831.892759][T23872] binder_transaction: 6 callbacks suppressed [ 1831.892779][T23872] binder: 23871:23872 transaction failed 29201/-14, size 24-0 line 3180 [ 1831.918366][ T7899] binder_release_work: 6 callbacks suppressed [ 1831.918375][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:48 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x200000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x7fff, 0x200100) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000280)={0x1, 0xc0011b7b, &(0x7f00000000c0)="5360806cd5fbeb12584fd6a75b0ecc1f2a44a62be3a177e2a91470e93b5b9ffbbe7310206321dfffef8b6dcb7c969af7600e4e9ed32a5fc6524e3d2da4e62dcc5c3f0de7bff87213bd71e29d8a8116493d8cc00c8282a383df76c1e3c214d9a91e8f9accb1c32e2f856713eb14354854ea48b111bdcc54bbf8df32befb205ca1aa8c727a96840291c8a00b34f7836b941d5dce17e57fbb7cb8e7340d64608080b907419af7769f1e30eed4", &(0x7f0000000180)="db355596e03a5d0d4216546857b7aecc444d9eedc3f828a80cecec59cbff6d32a7d2910bbee30dca825a2baabdae3590f05d6c469b78a0fde6e10e22340c151fe7d530338cb6635795234bbf9879dc1cb1928531ce2a4e3ce0b435df44b8966b27653fb7719aaa7cce2cf4b7135b7bebd632d15bd394cbdc3cd217d096cf4fc5ee053cb6d75768b6f1a37a8c49ad58ca0b2b70a3843a450ea0a8041a78ba65c31ae5c191c6308d9b919c0fc450f05cc6ee8d61024f49880d92910d83e582c8ec7afb9cc882962f9ddf5ae4fbe1f8463f680d546b7763988d1abe4d09672bbbf2b18297fd85f2abd31dc042a810702dad4e1f55459b6e327d628b20a57d59f7", 0xab, 0xff}) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) 09:50:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000c070000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1832.288218][T23988] binder: 23986:23988 got transaction with invalid data ptr [ 1832.304125][T23988] binder: 23986:23988 transaction failed 29201/-14, size 24-0 line 3180 [ 1832.335046][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000005071000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:48 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180)=0xffffffff00000000, 0x4) [ 1832.541549][T24198] binder: 24197:24198 got transaction with invalid data ptr [ 1832.581156][T24198] binder: 24197:24198 transaction failed 29201/-14, size 24-0 line 3180 [ 1832.608297][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:48 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) fcntl$setpipe(r0, 0x407, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x4000, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000001c0)={0x0, 0x401, 0x5, [0x5, 0x6, 0x1, 0x6, 0x7]}, &(0x7f0000000200)=0x12) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000000240)={r3, @in={{0x2, 0x4e20, @broadcast}}}, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r2, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e20, 0x100000001, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x7fff}, @in={0x2, 0x4e24, @loopback}, @in={0x2, 0x4e23, @multicast1}, @in6={0xa, 0x4e22, 0x2, @mcast2, 0x7682}, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e23, 0x200, @rand_addr="f9e323170ab7a3e96174569c2d9fe6d4", 0xffffffffffffffe1}, @in6={0xa, 0x4e23, 0x86, @loopback, 0x2}, @in={0x2, 0x4e21, @local}, @in6={0xa, 0x4e20, 0x6, @mcast1, 0x3}, @in6={0xa, 0x4e20, 0x1, @mcast2, 0x2}], 0xe8) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000180)) ioctl$CAPI_GET_ERRCODE(r2, 0x80024321, &(0x7f0000000300)) 09:50:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000074000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:49 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x3) 09:50:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x6, &(0x7f0000000000)="0000000001000000000000") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x80, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x3c, &(0x7f0000000080)=[@in={0x2, 0x4e22, @rand_addr=0x1000}, @in6={0xa, 0x4e24, 0x7f5b, @mcast1, 0xef}, @in={0x2, 0x4e23, @broadcast}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000140)={0x0, 0x200, 0x400, 0x3, r3}, &(0x7f0000000180)=0x10) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1832.911641][T24312] binder: 24310:24312 got transaction with invalid data ptr [ 1832.940966][T24312] binder: 24310:24312 transaction failed 29201/-14, size 24-0 line 3180 09:50:49 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1833.060496][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$EBT_SO_GET_INIT_ENTRIES(r0, 0x0, 0x83, &(0x7f00000001c0)={'broute\x00', 0x0, 0x4, 0x7f, [], 0xa, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000140)=""/127}, &(0x7f0000000000)=0x78) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") socket$inet(0x2, 0x4000000000000001, 0x0) 09:50:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r1, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e22, @local}}, 0x10000, 0x8}, &(0x7f0000000240)=0x90) getsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000280)=@assoc_value={r3, 0x8}, &(0x7f00000002c0)=0x8) clone(0x20120800, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") write(r1, &(0x7f0000000300)="dec0cc1322ece41ad2b02a5198272a7da837bc6f22ee8382f7dc7514ae6d6971d8b83fca78f70be28df7e5a55e25e977ba823c70d27f5b91b7f13651dc424d49be01fc140af893e46dc22c41a57c0b1e82a4460f7e0c9bc900c903040adb09c2a1d554b66bb00d8b8b6f62d0706282c0f1388c8db0022498e72c8530f8cc248376a08fba75f635d8b81a31375bbd2450da7f3ad3cc836129fa05c12baff1bb2e9fd6162634c7b380f6fe0a06ef2897091b93418ff1321c5c4701dc2e92aa0309bb385640c915ce1abc174cd7731bb8f19a1228245e1e4be84a19c943e0c8b5e6", 0xe0) 09:50:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000094000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x480040, 0x0) getsockname$netlink(r1, &(0x7f00000000c0), &(0x7f0000000100)=0xc) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000040)={@multicast1, @loopback}, 0xc) 09:50:50 executing program 4: r0 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x80000001, 0x40142) ioctl$TIOCGICOUNT(r0, 0x545d, 0x0) io_uring_setup(0xac5, &(0x7f0000000040)={0x0, 0x0, 0x6, 0x2, 0x36b}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r1, 0x29, 0xcb, &(0x7f0000000180), 0x4) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000000)={@dev={0xfe, 0x80, [], 0x19}, 0x3, 0x0, 0xff, 0xe, 0x0, 0x5f2}, 0x20) 09:50:50 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1834.084226][T24542] binder: 24537:24542 got transaction with invalid data ptr [ 1834.125156][T24542] binder: 24537:24542 transaction failed 29201/-14, size 24-0 line 3180 [ 1834.176741][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:50 executing program 1: r0 = syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x1, 0x2) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000180)={0x401, 0x4, 0x7}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r1, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340), 0x0) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") r4 = getgid() fstat(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000001c0), &(0x7f00000002c0)=0x0, &(0x7f0000000300)) setresgid(r4, r5, r6) 09:50:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket$inet(0x2, 0x3, 0x3) setsockopt$IP_VS_SO_SET_DEL(r0, 0x0, 0x484, &(0x7f0000000040)={0x8, @remote, 0x4e20, 0x4, 'lblc\x00', 0x23, 0x6, 0xa}, 0x2c) 09:50:50 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f0000000080), 0x4) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x10000000200001, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x1) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f00000001c0), &(0x7f0000000140)=0xfffffdc1) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300f70071eb4c719013504b3df95f416b98978566e5485c17a78223e8782ee26756ba0b9ff3b1bfff6e4c6db4f202c8277d73c5668d1bcf38657dec0744451a2ddccefa15df49dd148f85fe0af49b49a361d2000e46b00000b4f2a08dcfa62807b91744e82a61d01cf39f221301ca47c2cf893950c90ca6d0b783567ddb51b6c58caac407d234d60fccd21b438e3eba4182127b08238f3a70581e803f357973c5e19fe8f74ee03c1f9db136f26570b0010f5dfdb6b15388cf906a0467937d2036e83a54458e3f065003e038c80672adb4893fd4daa9a90ea8f7a600696f08d5f3d1fe0bada07be820c9bba209b2992c09dc59b3dd18ec1d39fec98fa8af1328fd7babeda6580ed460c3df0b10da1689210234fa942f64ea4b0d72e8baac234551f48cb830bc2a4314f9913b4d5f5d51adc42b6373d466047294d88b30290618271c3d00662adb9651a3644aeaa772774ba93cad860009a16b7ec32ac8d8632d90ac5fcac3c63180b1ee81044a50c67b86b9f36d93ecd5e19c6a74088d8172f2aba0ab2c08007a67294724874a2e74c51ab48d42710adbf975212175870794a35f4416fe7a8e7237aa475ac2ff369715efd71eafe695051695207f8edb1fd034a738bafdf03190e9b917d705ed8a5ae460e4178635405341f3ededb7df00000000000000"]) setsockopt$RDS_CONG_MONITOR(r1, 0x114, 0x6, &(0x7f00000000c0)=0x1, 0x4) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:50:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000070c0000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:50 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) readahead(r0, 0x3a6, 0xffffffff) ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000000240)=""/205) clone(0x2000000002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1834.489291][T24762] IPVS: set_ctl: invalid protocol: 8 172.20.20.187:20000 [ 1834.507042][T24764] binder: 24761:24764 got transaction with invalid data ptr [ 1834.554212][T24764] binder: 24761:24764 transaction failed 29201/-14, size 24-0 line 3180 [ 1834.594892][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000050d0000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1834.871100][T24875] binder: 24874:24875 got transaction with invalid data ptr [ 1834.889270][T24875] binder: 24874:24875 transaction failed 29201/-14, size 24-0 line 3180 [ 1834.915210][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 [ 1835.031924][T24756] IPVS: set_ctl: invalid protocol: 8 172.20.20.187:20000 09:50:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000010000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:51 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x3, 0x8000) ioctl$KVM_SET_MSRS(r1, 0x4008ae89, &(0x7f00000011c0)={0x4, 0x0, [{0xb22, 0x0, 0x5}, {0xc0011022, 0x0, 0x2}, {0xabf, 0x0, 0x800000000000000}, {0x9f2, 0x0, 0x3}]}) prctl$PR_GET_KEEPCAPS(0x7) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x38, 0x4, @thr={&(0x7f0000000000)="6742cb5a452292d1112816dbadda57297c0fd5bd9fe842c3c0417568b7e591a43616b0e4657a55bed2d2eb71949eafac832248c3418318748cdc79cc0fc83157482f5e46ff77edd832b62d91ffe1a05613ece592ff96fd9ef6c54a647ea34a81cfd2b6700164679b7568a4d725d3c508ec10ad5d4cf08cb74b94062ce36766a884336b79c4f33e5d4c8345a3fb34c67245e0643e5dfc71fb106669cfed1b6c6cb26f65ac22b0db9cf3b364", &(0x7f00000001c0)="50eb75bbe6f1b4a364c23b673f5de278659f1a90fafa21f329eb3bcdf4fffda4fda31beb282df1c7d14acdaf9ff959a3212ffc89b5f77d5ee2d691ef9b7f14a310605083f31eb27974275e5ccc31906de49158e0de5159bb0e8b2ffdfac8e9038e705d006fd5379ed6ae82a7e2f33704c17646f7c447e15d7c82bad0e8b7cd9f9b5ae1132e9c029f781e4e7b82fe9992195a99297b5797a247f77f9cb78f5631cb6552dd5ec2304b8460c0ec6250d751d52d0e44a91096138f8fd94325a7b62b6875e442a71c7473f93f27a591aaef4cef0209533a88f39d94f102353b78a32f11a2550a33741a2f710288155ba9d18be1253c08a795be0febf2ff5ab72f4b74d45fd9455c3a8ebf1a4fa58035d7dd9743fb177dbc6159ddeb88498596b423fd2cf2e28c9bd5f496154b60c2d488a25ce813c097799a649c0e2c0ccde5360f487a3fdfe31fbb0e127f61646d0f6bb4bbdcca5e41b484076b914b2d4be72716f051fb188d2031924da8fb420f5cec8f9ab909e889e1d9a9cbba31c5ad711b10fe6dce0b078de7d4735f2c17e9e1ab8f65e8ac9f4b3c693b4f532bdcd71449e2c17bf163f7b2375a7530c90928bbff7bbddc32a81e38a3e5c31c9589d7c8102a2f7a523ce40148f8d9d750d14facdd8d48cf9e8c94270c96c932cc11121726489ff9722452167c0b0c1220cd7b024b41d58659d1b35033ec0707a4b8b5a65b8a71e1f411229ba62bbcade2b849bf35d395f5a33190b65e9ff55b8fb749585aaaa2a0300bc4db0851e695361c4fb2791b89a5b1254e055fc933f461cea666cfbd68ce2ef424d5d697d6971f92759dd3527bb52daf4590426beaaf7215c957fb0e04a65186443269286c2dccb36ca9ca9f7b906b8b12884224bc38e3c9360e5a918c3dd5f410b7d3a07b1588e164a7cbbe322e6957c1ff0a46b649f11cb268f64f9fc6382f936aeee2af76b288a909a4b6c653d4d142490cf3680160c603f1a5020a2e3a3217f36f42bc719f3d6bcbff14eca5c149012be3a5755b9121b907797c29a3b1b2bb3029ac0fe880479311b1b961fa939ca0a9ae1e520492bd840a587c0c3bd9373076817e7168c8911b057dac609ef038ba3331babb4c8626ddf176613b0bdae6d8ad2bd29935823549f347a699a4aa83464dcfa5e6d7986c58c856a82c2bfabb59c31f8e3b357c762950375b9e8e0b369cba94e582c8977a49a5e84726da8f720c7f1e01853955f24aa0359351ffbecf42a58c4713f477524921cdc7cc6e72f726e87cd9390799a69dbfb0b67aa0fd6c6eab1c6fafa72255c69bb61338710d4d777c0e1dc518ae5e2b1e1cb12b6a2479e417715a74fba4fd6fd01f9407c16c61f273dc599b64436f23f0803fbb1316c414f09d3afced364daf86dbfe81bab0c9d7e8005705a2737a036596df65d543fcee246c78ff3bc4575bdcf37335535e8b4fd803244f1c0dba79838615593fe3f76fd45c449b07f19f5a2b30ad27b2dbd43a022b0a910b1dd6d2ba7ebf30da976e0de544f5046546954c703be79f0cc9fc9ac259dbb707a5136ea30a2b2f86fdae0c8caf2796dfee321d84daa83d929f2dd243e551926580e03a7f797e3dca0c20296a1f145c15f19e4aa44ad733810b83ab4bf772dd4a11c704c23d576c7d93c1fd86b1b0cd9bd63f0c6d7c1984a89421424442f207cf3a97f299ed31c9652152ddb9e7f8cd372d78b6272c20587cf169ac4d40de8840af10a739709b25734d7fea349898927f2d7a7e7d820c7c9108267be791195085cf9bf47a450e2ceb1272c9e12fb6a1f6bf25e2f9b436a69e04d666dd071cefb2c36e610092b9c70924a0d45bcb6c25b0e311ac1e8590439472fbebdf1618b63b455d6b5a401d52e8fcdc001ea8a166222dd7dd4c37a762e18c539f369154dd84acdaa6fd2a9de133a969a649e0ace049c52a1ec720176609bd2d258d0b218f5f710a379b313b472dcb5a6003fda19d198b5ed2b0e0b58918b1e4ce543cb949df4a3b91924be47bde0551d07af0de4a75b669905b6b69836739ec841c14ece54a11008f43c91aa78fdf31dcd72ac5ba9e49843ddbe1140c59d82dd2fcbb6d3222297718ebba7e20164c340f399553d2ff92f93275003d09986b7467670dd1a02c25cb392e33fcad79fe76d1975741c072db9537aa8e7d7f3a388aeed7fff4ce4f55eb44ffabe0a1cb18e8eed8377b1893af323e80949a7b336b1613b0b567d0692006012c5d41a4595886ec88191306ed88f4e34758c2d703b1d3c50075ad44da9c303c742b9c7ca5de7b770caf918fa1dc08b79a715ff03fbef941a96e30c8ed043eada4dc7a564a002d0181d2a62880ffcb36684858ee2202055d8c0e8eadbbef5d19506f118f2086beca1249401e907597abcd79ebf145da9f142956a8e6f089250d9a869af0801646793443abccd47d2e846aeb06ad47bdb174c128bd2a3b7f8303b6591fdf18790297f111188223c0741b63c2eeff2c99f77f07ac729de4c797bc6fcc6dba9c5968fa1917db6c766b3239b648b8a5419b40bb14895f10fa0acd2f25dc57e3a18c1643d6d0cc2bfbc80b127020035c9234c4362eb6bfbbc7a4576cae1cba0ec8b2554bab4948e7fee39e848439dad3ad80d36e7ea16a98d5887c6e285585adea757ab5f4b716a403ff7f29f1aad23a817b44587f289f43530f3d084a54386915e092550c1593e0abffb05c3335200ec846ec0c189989e16edd6a2576859a41ebff0324052d75b1da92cda950f8d1f31c7326f55b6726c4cb6b1b95d66b5b1e9bae80e8f5d536f2ab1aa7ec2db1eda4adae3bd48455d30a3edeb5cab6a6333478a21db57263c6d6b59a5134e46be23790fd4756d4ab5af7cd5e520766483ecc047e6a7170e5f6e7544d57f227d94fd5f489dd850f06fc267e76fb7503d0ef4885737718e5da44fe597f48a91139e9b0bcce5e12ff4302ee5573e0f6ccee411aa9c744fecb8189bf4ec0d7cc6deb25527a3c1abc587de9740cc91dcdb880e654d124516bc6bf62dc736bc027fca6d4bfe6746352b5e88666f9ee447fd4d14c9d526a6a1d90fa4133f3864ebe9de5cf6bd42cf4430a74e6fd00b201ddba75da79674f3275252b9f766962c1b17e385d9df2bfc4049ab3714f4e0acf41d5ed7577d197eb32a4ecf7c8a1d422b606355c9bdc94f02a56259e24f6e9c84cc9a70838a4dbb0bca62b7e54090a141d120e9555377effaac4001081c613b3a2a3f6fb03be4fc75aa014c9eb6c640a2081513983a7a49293c818cbe7707a5af279c2c9d0eb3a0211c9bad3d1a3adfb6661097e370536e83941a2047f7ddd83ff023119022abe66502417c625afca8e44b9baee6db3a0474baa3d1f6d86e67c4699dba6c2abe33633d334ea60e03e03d315702628f012df66f425cf5de6419be504548a764cfcb83a228113822e0500b49fd72edfd217a098d34fb608d84af2fdda57f3971e29789f8c535be4e19e368516944888fa3abdb0178fc375ffe6d0ea0603e647136d75b8bcb058754fcd34c0eca727f6f216f06a5b44304ad8dedc6c0a3e9e727b6fe9fc40ea054923a746fc82e9b6d17e91e7c856300cec3174308ba2ac4f80543ba205d73ab2ea1493bd039a75e91777e44423c1c7d9945688f9e08bdc70d432278d8769ff0b7601186688a46766777e270e86679cc511af5877b20d943ef6d923ec5a9c0779ba1acf11676be568aaff71153afb7e0f938301d1f58cf887f2eb1e12b731a12574baded8a41fe8b09b4b89694639d05a68d7dcb406a405b8ab9c672ac540382329dc2feaac1fed054644ab0fb77d247069f50ffccca2e0f2d7a616156b1a5d0e04c9af175fe800aa6ed438e5d11d75c868aefe6bee06fde91aac4ca5846f796c36e0bf0dcd91dbc2ccbc77c02aa143175263934c089138457a605c3480659c7723d0279c7a51d9aa739e6fb2f47126e806fb248400725d631d20b0060df3f6a7764ef325aec4ff4a4240193f3cb8498900f5e3d593f110ecbbaf6317e810b98f7a68783f0015e7774c692252e3ad07230160ca653030ac9f0b522ee4b5b1e5f0cf1bc47589c0a2ea7674d8cdb05bad8940cecd72b55d66e827f9c7ccb54fc5697cf78e225247c67b2e977eb1dad0fd8895ee15d05266e8b99cd54e9b32010ca1fe16d3431510223cbee284a16b6845b8a1065f2eedde38ef2f05abfb33cf444a1f338454b587904da577ed62c0a93aca95eb46f5b03a8fc255520b6bb90508d6a8a7b1d2815e2c26d92c8cb29aa93fd753787ba511211b510fc975b1e3acb5c546576348ece0c018179201f508cf1ba54f6ec32476d24571c89c160f3f47cc0bc9a431aa9b95bbe55d57de611d9db66ba65c1fde2bb2aa475eb0b5d2fced11bed9cd29a3c13a1806dfd29fcd722d4004685845e5493eb459f3bc521f92ceb35047a9a6c6e719e67e1d9c39f63ae5bed222434b4f183610233fb117dda5ea0d979dd48bd10d2b477e600c3deb8e7c295abf05f16ead2fb79bae5624061bd9db748aae559e75b9cd6038c3e4d502cec61e51568d8550aa4e1916e1cede3e73e200d27118c799d247e3efa11be6f7b2ded7ce210479e1ad0e8339c38aa59361ceae8574c3ea1599eb2a0edebb51a5896070ad855bb8768617d7c2415751f3d3cd68b4826328c4ff266295bad92d2f081c1ebb565330eaccd297be2da86c0f65de206efe85220d777cb4450182e72cb51034bac7101fb0987fd591a9fd62d19709ed4b666aec6f07757703d571e0733f0563216d1a3235fa8093673c061f320fa463d490f5c03623e927f8626f4790b9b6b94c6c2da738457d039fcea346e9308c34201669fa131781536358f15396ee740d8d80a91ec21d17022dc32326fb470ca3c23844f18495a70404d0a808b322fdddd4541385ce2159d8b266a79a86e8bf953a15cc1746f394c58defae7f39ebfc22cea0e4cd25ffbb6edcb76dd035bd1c5acf5c4357c0a7293d1ab775647591e9649d9b441651fe5387005c79ed52b22b5e8780c871c899c3d5ba46e2c2ba388b6f6f14b05006fdee566841b60cfc73523c513faa09b87b1a780fac8f68164a2f740bb4f4365d9d39d206506d3bed358bb9dc6c99917edcbf58011e5c980c106e5d66c70b7b0e8b5884407986548c28044bbb85b50613f512972668320eef4eb4f3d197b46c937c94b2c40f72ae8f5dc57f5e7e16c83df32ada5b7d30c0e3a09c339140f495acbe5fdf04192aed41a7ad4edbb6246b59db24f7d5cc9196533b4b75fc081d8d3039ef9ac057ef3bd6677345867b1bfb9fb4a07675eb5de27f45bae1d98665e44d5716d376a5cc536a47839af75a71f1f86c7d1b7a1aa2fb4d5e17db60c1caf1867742d7933fbe913e51067412f339b9cf1e5e8b4be4317cbc18d17db51405191b17b2d9b7882421369c395ee187db49234de0def78327adbedb4b215d55b98bb6c7fe543c995223cae4f9b5e8cf9f09d048c748b1c2a112c54da6383e3724101896b48199586f4f6bda7823dfc9efd07a35eeee3e19a6b55ca947c0a20fb6a0d3e68dd1c4ced54173ce6e22f257bac2e31030dab346f79f639f917f476f9ec661bcc9bc8458e00158ed8ee89afc2d639c213563b475fa9e2c460acfbcf6e95965d96e8c34dbecc4a6f89e2005f1c854b11960e7fd2f9e80f48d20bfb1b42254401cb73f45183147130c7adbf7428079fcceaa7a2b67f96342de55101ba178340f106fabdf9e409d435a02da14a4b34f862e7b46a83c4771b33c2edbc8267908db28f710f2f37eb8647bae0b93812b4c0cafdc40c8"}}, &(0x7f0000000100)=0x0) socket$inet_tcp(0x2, 0x1, 0x0) timer_getoverrun(r2) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:50:51 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:50:51 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1835.247352][T25086] binder: 25083:25086 got transaction with invalid data ptr 09:50:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1002008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x805, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000040)={{{@in=@local, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000140)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000180)={{{@in=@multicast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000280)=0xe8) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, @in6=@empty, 0x4e20, 0x0, 0x4e23, 0x1, 0xa, 0x0, 0x80, 0x3f, r2, r3}, {0x3, 0x800, 0xb88e, 0x4, 0x1, 0x3f, 0x3, 0x2}, {0x3, 0x5, 0x3, 0x3}, 0x6, 0x6e6bb9, 0x3, 0x1, 0x2, 0x1}, {{@in6=@mcast2, 0x4d5, 0x6c}, 0x2, @in=@multicast2, 0x3502, 0x0, 0x0, 0x70000000000, 0x200, 0xca1a, 0x1}}, 0xe8) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1835.314906][T25086] binder: 25083:25086 transaction failed 29201/-14, size 24-0 line 3180 [ 1835.345166][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:51 executing program 4: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 09:50:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000020000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000040)=0x5, 0x4) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x5, 0x8000000000006) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:50:51 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000280), 0x4) r1 = syz_open_dev$adsp(&(0x7f0000000180)='/dev/adsp#\x00', 0x100, 0x80) ioctl$NBD_SET_FLAGS(r1, 0xab0a, 0x8) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000000c0), &(0x7f0000000100)=0x0, &(0x7f0000000140)) syz_open_dev$usb(&(0x7f00000002c0)='/dev/bus/usb/00#/00#\x00', 0x8000003825029d, 0x8002) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r2, r3, r4) [ 1835.648992][T25210] binder: 25208:25210 got transaction with invalid data ptr [ 1835.677791][T25210] binder: 25208:25210 transaction failed 29201/-14, size 24-0 line 3180 09:50:51 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1835.727745][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e00, 0x6, @rand_addr, 0xffffffffffffffff}, 0xffffffffffffff6b) setxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f0000000000)) syz_execute_func(&(0x7f0000000240)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000030000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1836.211583][T25437] binder: 25426:25437 got transaction with invalid data ptr [ 1836.228847][T25437] binder: 25426:25437 transaction failed 29201/-14, size 24-0 line 3180 [ 1836.282124][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x8b, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:52 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xc8, &(0x7f0000000040), 0x4) r1 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x100000000, 0x20000) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000140)) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x111000, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) ioctl$ASHMEM_GET_SIZE(r2, 0x7704, 0x0) getsockopt$nfc_llcp(r2, 0x118, 0x3, &(0x7f0000000080)=""/67, 0x43) 09:50:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getsockopt$inet_mreq(r0, 0x0, 0x24, &(0x7f0000000040)={@rand_addr, @multicast2}, &(0x7f0000000080)=0x8) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e22, @empty}}, [0x101, 0x3f, 0xb3a, 0x1, 0xfffffffffffffa15, 0x3edc, 0x6e, 0x8001, 0x4, 0x6, 0x2, 0x7f, 0x8f3, 0x10000, 0x6]}, &(0x7f00000001c0)=0x100) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000200)={r2, 0xe3}, &(0x7f0000000240)=0x8) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) 09:50:52 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000040000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:53 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ipx\x00') accept$alg(r1, 0x0, 0x0) 09:50:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000050000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:53 executing program 5: timer_create(0x7, &(0x7f0000000180)={0x0, 0x8, 0x3, @thr={&(0x7f0000000040)="1336c0929a6cc6b2ba9e89ec6a1a5b4961e8a9dfce27dea1fa4bdcbe8b0a09acf8bb6c069187c5c287aa695f4f681b542110df9abfad0efac223f67967f9cabf8f318eba6ebb7f5e015ae9cb7b7498872af98dbbe67dd163a336cdc3e99c01710a3541d4a2f3018c8d94d0d7c78aad0a1644e537d8725507e270fe3471dcad5dbd4c6d393ce62aed5e00e417958d2ac32f86d26cdd73257b0dd87be9542991f593dc17efd2c8e75ce7cd520fa25925189a836a0bcc1cc9220f96e527f3ca496da64fb1f77834ab", &(0x7f0000000140)="23fdfaad67341d63c1b83b78449cd9938930f7e21c79371a5b2ef9e254d56ebb7b4cbc5ad7bfae"}}, &(0x7f00000001c0)=0x0) timer_gettime(r0, &(0x7f0000000200)) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000240)={'filter\x00', 0x4}, 0x68) 09:50:53 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1836.930987][T25862] binder_transaction: 1 callbacks suppressed [ 1836.933510][T25862] binder: 25856:25862 got transaction with invalid data ptr 09:50:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x34, r3, 0xb00, 0x70bd2c, 0x25dfdbfd, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0xb, 0x4, @udp='udp:syz0\x00'}}}, ["", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x40) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1836.974703][T25862] binder_transaction: 1 callbacks suppressed [ 1836.974737][T25862] binder: 25856:25862 transaction failed 29201/-14, size 24-0 line 3180 [ 1836.996332][ T3269] binder_release_work: 1 callbacks suppressed [ 1836.996341][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) io_uring_register$IORING_UNREGISTER_FILES(r1, 0x3, 0x0, 0x0) 09:50:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000060000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1837.265164][T26079] binder: 26076:26079 got transaction with invalid data ptr [ 1837.282439][T26079] binder: 26076:26079 transaction failed 29201/-14, size 24-0 line 3180 [ 1837.308576][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000070000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1837.527251][T26246] binder: 26226:26246 got transaction with invalid data ptr 09:50:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x420001, 0x0) bind$x25(r2, &(0x7f0000000080)={0x9, @remote={[], 0x1}}, 0x12) 09:50:53 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000040)={@loopback, @ipv4={[], [], @multicast1}, @mcast1, 0x88, 0x3, 0xfff, 0x0, 0x7fffffff, 0x2040000, r1}) [ 1837.584823][T26246] binder: 26226:26246 transaction failed 29201/-14, size 24-0 line 3180 [ 1837.605482][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:54 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000a0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1837.894713][T26487] binder: 26474:26487 got transaction with invalid data ptr [ 1837.907792][T26487] binder: 26474:26487 transaction failed 29201/-14, size 24-0 line 3180 [ 1837.924413][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:54 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) write$P9_RXATTRWALK(r0, &(0x7f0000000000)={0xf, 0x1f, 0x2, 0x4}, 0xf) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:50:54 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x100, 0x40000) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000080)) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1837.980374][T26071] cgroup: fork rejected by pids controller in /syz1 09:50:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000120000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:54 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1838.235804][T26753] binder: 26725:26753 got transaction with invalid data ptr 09:50:54 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) r1 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x80, 0x2a000) write$P9_RREAD(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="370042bc826ef20058c40b7e9390d117921e72723c5360e645f1deefc58ba4c21e324dc7596a954e8b7199f0be8d"], 0x37) connect$inet6(r0, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1838.289130][T26753] binder: 26725:26753 transaction failed 29201/-14, size 24-0 line 3180 [ 1838.341086][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000180000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1838.652174][T26920] binder: 26919:26920 got transaction with invalid data ptr [ 1838.679845][T26920] binder: 26919:26920 transaction failed 29201/-14, size 24-0 line 3180 [ 1838.709515][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:54 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x1000, 0x100) socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f0000000040), 0x4) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f319bd070") r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000380)={&(0x7f00000001c0)={0x198, r4, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x70, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NODE={0x40, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffffffffffff7}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x401}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x200}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4628}]}, @TIPC_NLA_LINK={0x44, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffffffff0001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x59}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xbd6}]}, @TIPC_NLA_NODE={0x2c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xdea}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffffffffffc01}]}, @TIPC_NLA_NET={0x38, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x10000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7e3b}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xb600000}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}]}]}, 0x198}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) ioctl$VHOST_SET_FEATURES(r3, 0x80044dfd, &(0x7f00000000c0)) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:50:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) socket$inet_icmp_raw(0x2, 0x3, 0x1) 09:50:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000200000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x80) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getsockopt$inet_buf(0xffffffffffffffff, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:50:55 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1839.011730][T27164] binder: 27147:27164 got transaction with invalid data ptr [ 1839.048240][T27164] binder: 27147:27164 transaction failed 29201/-14, size 24-0 line 3180 [ 1839.121183][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000003f0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:55 executing program 5: r0 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0xffffffff, 0x80000) ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000000100)={0x7, 0xd7}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_tcp_int(r2, 0x6, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) socket$inet_udplite(0x2, 0x2, 0x88) 09:50:55 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1839.422395][T27352] binder: 27349:27352 got transaction with invalid data ptr [ 1839.454024][T27352] binder: 27349:27352 transaction failed 29201/-14, size 24-0 line 3180 [ 1839.504528][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000480000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1839.711997][T27459] binder: 27458:27459 got transaction with invalid data ptr [ 1839.752467][T27459] binder: 27458:27459 transaction failed 29201/-14, size 24-0 line 3180 [ 1839.809172][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x80000000800, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000004c0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:56 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0xffffffffffffffc4) syz_init_net_socket$nfc_llcp(0x27, 0x0, 0x1) 09:50:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket(0x1, 0x3, 0x9) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000040)={@empty, 0x7, 0x0, 0xff, 0x0, 0x8, 0x2}, &(0x7f0000000080)=0x20) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1840.092576][T27663] binder: 27659:27663 got transaction with invalid data ptr [ 1840.118397][T27663] binder: 27659:27663 transaction failed 29201/-14, size 24-0 line 3180 [ 1840.178641][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:56 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x10100, 0x52) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f0000000040)={0x8, 0xbbeb, 0x40, 0x6}, 0x10) 09:50:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000600000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x501201, 0x0) ioctl$CAPI_GET_MANUFACTURER(r1, 0xc0044306, &(0x7f00000000c0)=0x2) syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:50:56 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000680000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:56 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x8, 0x202000) ioctl$DRM_IOCTL_RES_CTX(r1, 0xc0106426, &(0x7f0000000200)={0x8, &(0x7f00000001c0)=[{}, {0x0}, {}, {}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f0000000240)={r2, 0xa2fcfde298096222}) getsockopt$MISDN_TIME_STAMP(r1, 0x0, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) getsockname(r3, &(0x7f0000000000)=@can, &(0x7f0000000280)=0x80) 09:50:57 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x2, 0x2) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) sendmsg$rds(r1, &(0x7f0000000540)={&(0x7f0000000080)={0x2, 0x4e22, @local}, 0x10, &(0x7f0000000480)=[{&(0x7f00000000c0)=""/177, 0xb1}, {&(0x7f0000000180)=""/170, 0xaa}, {&(0x7f0000000240)=""/2, 0x2}, {&(0x7f0000000280)=""/80, 0x50}, {&(0x7f0000000300)=""/201, 0xc9}, {&(0x7f0000000400)=""/123, 0x7b}], 0x6, &(0x7f0000000500)=[@rdma_dest={0x18, 0x114, 0x2, {0x7, 0x7}}], 0x18, 0x4000000}, 0x1) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:50:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r2, 0x110, 0x5, &(0x7f0000000000)=[0x0, 0x1], 0x2) syz_execute_func(&(0x7f0000000c40)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd98262e2e66450f7d64c60865f2ad038239e953d3d7fdd7fd65f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000006c0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000740000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000007a0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:57 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000140), 0x4) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100)='SEG6\x00') r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x60d00, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000080)={0x4, &(0x7f0000000040)=[{}, {}, {}, {}]}) setsockopt$RDS_FREE_MR(r1, 0x114, 0x3, &(0x7f0000000180)={{0x20, 0x2}, 0x20}, 0x10) 09:50:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000040)={0x0, @multicast2, @initdev}, &(0x7f0000000080)=0xc) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000001c0)=0x0) r2 = getpgrp(r1) fcntl$lock(r0, 0x27, &(0x7f0000000180)={0x2, 0x4, 0x3, 0x2, r2}) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r3, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) r4 = dup3(r0, r3, 0x80000) ioctl$TIOCMBIS(r4, 0x5416, &(0x7f0000000200)=0x7f) getresuid(&(0x7f0000000ec0), &(0x7f0000000f00), &(0x7f0000000f40)=0x0) r6 = getegid() getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000f80)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@initdev}}, &(0x7f0000001080)=0xe8) stat(&(0x7f00000010c0)='./file0\x00', &(0x7f0000001100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000001180)='./file0\x00', &(0x7f00000011c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r11 = geteuid() r12 = semget(0x3, 0x1, 0x406) semctl$GETNCNT(r12, 0x3, 0xe, &(0x7f0000002080)=""/196) getresgid(&(0x7f00000012c0), &(0x7f0000001300), &(0x7f0000001340)=0x0) r14 = getuid() getgroups(0x1, &(0x7f0000001380)=[0x0]) r16 = geteuid() r17 = getegid() sendmmsg$unix(r4, &(0x7f0000001f40)=[{&(0x7f0000000240)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000000800)=[{&(0x7f00000002c0)="331d7864c31cb493d47dc6917a7a53daa2017497afd759a84dad8edce11c08a6d59148b295a0e000b19a0d1240ad98a002c92b51996442c62561ce785e6789e09ce7861049105c097b07783dbb1e256b3547666e875ee1d15065a28d9f1b6f18db4dfdbebe28bbde3215e62d88b4935717ae1a74a8", 0x75}, {&(0x7f0000000340)="f62b6e2915f1dd48a96874ed5aaf2a2ebb76086bebacab9ebba563b927e592fb1d5e1be4f2aca8bc80a1d8fcb0a1485b0b42fcb4ac0b5e5176d352fb8bf9c4562e5e9826f4eacdbbca", 0x49}, {&(0x7f00000003c0)="9702db1f35f88722f0fd8061f91b996ac08fe3a9910b6ef8fac56b661f0020ce637dc6f2e3fb4e5223da2d439a69ea042966b7a4b45677f62feee337dc789e603cae722530762abd7f25cd12580bf613e003c66f0fa48d729e29eac0ce1a0890cdbc9555d20614c3e7ab4f18e9a8e0d38b036de1bc9984f4c9ea9429fb47c2d67d5d1e6ad68842a9cb316e8e5faf61b01207360ee540b2d979bd45cebcdff12fafc1d95632ccbfe4ca4a8cf358e187", 0xaf}, {&(0x7f0000000480)="d4504350d824b948ebc51bcd6116a1145cc4e0af873dd23889d66fe35078d1ee68fb6c500f139de6005d72aa85e1915e6b57faf64130eb26cc1d5f6543224b0957954e88ca04204a19512a2917406904f91aa119b0417432ad6e3cb38580b595247a4065624715848ad67869c767f23c32600a579676a0ace994ed5a14f3479c6d241cf8ce355a9d0fc7dc68518665373650285ee566ac17dabe906a48571091bbe35e5e070cc4750cfa29a9891f6053bca5d74404c442a9d2", 0xb9}, {&(0x7f0000000540)="b0726dbb05cc94989a0e81236c6444a4b34ab9936a1d374def2957ce51d792163b30f534821449723873140fa7a2abd81324ccc79a0b8cacd12d54cd98e7cf3077a00709692604c1a8a001d2f06284a0941ce123b986ea516219d152e8ee8e461efb7ae4da8225ae28e5a55c1826bdf5f499882ef8e403e48dcb32c25236a5d9180c3f732fbbbd9d83e14c5b3ea86a5d23024b07e88aab34b652b8b4a130ff449ec09dbe4def450f43c633527a56d6b0a0df2fdfc3e0f048d04ef4c122467cdc22ef4d84384fbe253c892248686a35c557c5958ff7786618ad7a41b9ee859a2e64dc7f298e64aec085da517ad3a5e2591adf5aecb1f1", 0xf6}, {&(0x7f0000000640)="f70a45d60616c31349af43fc4eb0453dff89ad10f208b6c513ef33ade8c7e2ebbde9ae6607cd2fa9ddb171371f74ae431e173b052d4f317777df685ab38b742fb898e121ffada2ecf4289337aaaf191f70563e8e6602d8c1445d9d5e3b2d1884904b50ebda0b6573201f4e05761f6e462c03667be436501d9c58984eb10a6758", 0x80}, {&(0x7f00000006c0)="ea78d51fa607a0bf3cdd24b5be078878900e15", 0x13}, {&(0x7f0000000700)="cd19ca62887c824e2bd84e9789f19e66bb1f572bda8358709ba379bcfd605b3fd4fa822d9fcc4d15febd29e93a272972cd97db2f30005c6d35f41e95f001beb44db9dc3345ff5627afee65c8cf79e8a3ceed254601301dcdc45a0a19afb16fcde17844307e5e02f90cfee80f5867dacf747f66f1563f2e967b951b4f70de2b0685e1a306a646bbddab7342fd4c1caa0cb05d57cae19618465bf87542701eb50e15e8c15f7e5915f036f2f99598978987099a4cb8119280f42da5dc4aa936c24c47e5380eefb4de61", 0xc8}], 0x8, 0x0, 0x0, 0x20040000}, {&(0x7f0000000880)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000e00)=[{&(0x7f0000000900)="7ebeaf2db38a6c3cc30e989dfa543d0efa718113d1dbad982343da6c02beb69650e94472ce3bcac889f6e212d4205f60", 0x30}, {&(0x7f0000000940)="10d23740ce23301d84211c3bd2371d0e808975a6427c3d9c2ac2839208031c5cd524af7ca7dcc7b2f27116e3e7df2fc1b2a0c57bde14be", 0x37}, {&(0x7f0000000980)="872ac46e090dfd277d759ad1c9e0a382ee96d026f27b33abb777d07bb883d582658a0a5e4d720c8b2f688a3fc125364c", 0x30}, {&(0x7f00000009c0)="c0f94609ae375f563a268d22579ddb972c92cd788bbd31612ce2d0de2614dd77c3a4e1409ca8d6bee38e1059ff4a7e1070d4fb3438a44c6f200333666b0998dcefb277e374ba8b289e92898b3904acf20ebd7f71904433e8532cb3680f2a1a4eda22c63b62ad4b31d6bf8510b419bf825f289c619feaaae0eb072dafd900828d4072e8607c2b8e380c53fb734d24be63393cdd6d0605e67ae1a96739516287623900d195ad31726de7a8c069d40cf64637ab3e2dce8eebc6b1c269a0903e67", 0xbf}, {&(0x7f0000000a80)="b9b56e7260870e34bbc9065c8eb80685366272dca3a094d3c55407c196405c77d2", 0x21}, {&(0x7f0000000ac0)="dffd1753170b7cd08520c2c559375202e35254d4281e79fc22886ab98d47060d5c07578dd723f3757190e6ea6b14a189678f579694c2177633cb98ea471b3268f1776183097fcc8cddacf0ab48b02dc1efd8ee005cd4b40a632dc2e0a1ddad7cd4cace22fd40655319f043c981eb62daabe268cc28042054541cd139c30552334bd92f0f095fdb5128676b842e7798ba772dc7ee05e0082a5c2fa11536b149604a283900f863a2d3961a25c9faf1fbc9e3a0ca8d472918296e679afb8925523f14d52fc00a81629886e415842ed1f8162546350eae7421893c7404e7d9f1b73bcaafd4496064f5ce4c6239da348a901b0b", 0xf1}, {&(0x7f0000000bc0)="a0be88bcf3dfa14bf8049d3da52d9777e599746721d6cd9387a51257c0032d34d83827b7a3bd3ed045e2acf9455f8ff1feeaa10c0426a5c78eb1f683b439ce09804939d65c50bfa79d0bd91d677c4e2225c54a413aa2d5a6e86f98a702c24041268b6d635c039f6cdef367a5916a9071d6df3a3f14c17b34ec2c0c1506148cf35849c7ba13dae98ad32f23c231e608f5ef7fa2fbeb81af9eb24fc3849578bbffed3074b8c9eb0c4dc4cb206f785abbd748052a863acd049d496f5596d06a2b6d67636d3baf86cc9cad6eac87f282325319802ec41c7d241a6c196a86286701e2281aab7de66106dbc0", 0xe9}, {&(0x7f0000000cc0)="47fb05ba1f638de10b9c9da04978dc611bb6b602f93a65785b8cd4223bb1b61f5318d7c75ceee246202c1c7fb8fe0a84b887d6feb037fcfcc95bd69e2935d685c5a7ac", 0x43}, {&(0x7f0000000d40)="451dfddb687cfd137098bff622f8928f2909d45e475e7cfd24570bc26d8ad386a5c88f63d6f5090fe87dbdfc4f13762c86e0819619a781006178a41916574da25cf3841ec8f8a331f64af7e63eb99050db5dc77f7a097bf339691c5ea163164cbe384bf9c5549e74b98b51887c9db806f5d5c7846cf6b9e4b7b4fbf6fbc57fbabc5164ba9754fdf28c0f47665a18acfc0f8eb4fcada57af7ec2a619f8d28aeccb7872bf3504e880f4957695a4f", 0xad}], 0x9, &(0x7f00000013c0)=[@cred={0x20, 0x1, 0x2, r2, r5, r6}, @rights={0x18, 0x1, 0x1, [r4]}, @cred={0x20, 0x1, 0x2, r2, r7, r8}, @cred={0x20, 0x1, 0x2, r2, r9, r10}, @rights={0x38, 0x1, 0x1, [r3, r4, r4, r4, r0, r4, r4, r0, r0]}, @cred={0x20, 0x1, 0x2, r1, r11, r13}, @cred={0x20, 0x1, 0x2, r2, r14, r15}], 0xf0, 0x20000000}, {&(0x7f00000014c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000019c0)=[{&(0x7f0000001540)="4765971d79d7d831f7e73c2350303099d1860cf33eed92e6727587ca61157d237eacd17b3d724f3ed9fa35c105908c6937e344e22e1b57643cb6bb35c0f09faa0073c8c3502de73210c6afc7b7154afb43a829a991b5c21e12d3d7bc825f1d033dc0be6c1cf171be9f203a34ced3d494bf0f916686", 0x75}, {&(0x7f00000015c0)="fb2b8fb5e5e6baa096ee6593f7d1b5d5bef0a0421e2fa20cba4a166af2fe9639bdc2ffb9024030742d9f2c6c48b39d08fc2aa363c4c4b068cd052c05148053246caae75d038ded53d623191dc928c0eb9bd59256db193eec214be7ea32cd7f69cbcc3b313ecacbc207e0c981b01075", 0x6f}, {&(0x7f0000001640)="19b17f5f01ab7248f54f1d57b321cfe8e3c9c79144ab54c6cb2fd48c9485c3ade0a1381efbc9a63eb08e03b7906981d34503a2cb39ac8d0bf02851e051a93231aed3c3276a1c9837372304ba100844cecffc", 0x52}, {&(0x7f00000016c0)="464eef9840d929e0d61ef8071fef57459d9c8c820f2aab45932f1f5463c364bac4f22fd28a481fdd71ebc95a02b0d2aea613871828c66b4bc9f875a41b2185bbf4530cc5f1bdfd670c7267ff7408cb1c0df9e1e4d6a2e1dd51fd4bdab1efd003f59f9371a0bfa9adfbd5cbbe923a590f45aba73aeb8beed28f7e147b511dec6955730b2385ec", 0x86}, {&(0x7f0000001780)="363b2ec73be3935d75221fe4177f8322aad15824589f5baca271872f7e7251ddf12942a63f7746b4cf2010a5585d1ebe97ebeac1e22e2dfb53bfd5a0a4908c600d63909917f1339140ace84701227b25fa1dae9064272cd619d17a5b15dbf4349addb3c870e8d4f41e04f99314b802fdfa544c37de658aca952a583fc3af5d720b8cfe47996fc6ec98daa90e7c124a31c33c115d2315cc8d0234aafce702dc3c7b6b43a494f4fe8c4bff221077db054fe67394bc182ef62c52e502569a16aa24c42d36a9abaeeff3d897eef30d1561a3c32d", 0xd2}, {&(0x7f0000001880)="a7751c81c2a435038914ed18ac1291c739cc469dc83d035582c8c0ceac8741f2585c4c056a1357dcfcad72afb8484925f28028640571aae1b6ca5cfdc6f113aef684294bdab616b6cd5441134a147654fbab16f6b8db792d14ac0ea0f1e245e670ec7354fb", 0x65}, {&(0x7f0000001900)="f6651be83a4faf859296fb017fc5e920f7b4f80bf4c0932705450ab459c9b16fc20e16fb8c7389a9a2144d2101bbac289544c001d60ef2933babdcd4e786aaa38af4aa501306cc96df10fc128b79759677d12c5bee55c5d8", 0x58}, {&(0x7f0000001980)="b3640a7e9b11970edfa4de4a7b1fdf73cbb3c3aeb4786c5e0fc0", 0x1a}], 0x8, &(0x7f0000001a40)=[@cred={0x20, 0x1, 0x2, r2, r16, r17}, @rights={0x38, 0x1, 0x1, [r4, r4, r0, r3, r0, r4, r4, r4, r4]}, @rights={0x20, 0x1, 0x1, [r0, r0, r4, r4]}], 0x78, 0x20004000}, {&(0x7f0000001ac0)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000001f00)=[{&(0x7f0000001b40)="3dc4fd3bf9decb037d0b30b059f7941f518dedfc034758f04aaa68599b23db1081d95f831d9ef5b5981b8ee718472a85e330648c6c9cefe80a072505b14582caeb3339bcfc77ba62ba2cd33ee130f3e5b8e853b1cb29054eb6bfa9303a1f797236ea447c4e6adaf07bfce58cde07c2488b963bd4e9fac4db64bce82b1d0622d8de8feb886db70c6f5bc79bab0ca01636922b8d344271a7f5f845450ed889a8ad073cc389dfce44c2be8f91cf3c2cf2c67f8ccdcc24bd6d4de0b8bbc8cdb56e1d297af2", 0xc3}, {&(0x7f0000001c40)="e01e8d188c7f54da6720afbcae2870a1e33748465400b9d1bd8599af5011a4caf40e4abe9980c9602883da271ee5c8650acc5055d5742df06d4d8ad31efd7e19bed4bf6b241d054409ec866b61bca0a153e8853faf65b4e30c8137fea07fc33d139f8e13e76bae1eeb9bdf2e61a07675fb42bb032fe5c415f59c359c78adb15f1c184c1078cfe66810dec7b2244c6bf2fbe4ae95e3e9f4af8534f803fcca06c7d41b456f9a225d4ecb881227cd8a63be564e4577893ee5d46dde31c5e5eb5a7c91c0dce381d24c15bb1ae3d3507faf72fd1623b4904d1aceaf2d311f9f17dee586f517f900f2376dce69af", 0xeb}, {&(0x7f0000001d40)="1d1b792197a6153b72c6209d169393996304ce6a5f6c32315e44879a7818d0b8b3a207fbd1f1220b1a65727600549af8a38f815603fb0902b4323d1b955a1f3682716a80a686e60c7192e560036f6d76c94ab0992fda5edc85d80f5c401efe9a17b10dfcb72f43ec3af430898851b8edd34be6669289117e46fd00508fa40e7675453bd215fe656c8ee2129f2508de99b416736b16d99609a9ecdb9b83896fe37d9246f04d7608a877302c4da3c4ed1e2a36f679efdf", 0xb6}, {&(0x7f0000001e00)="88ced7c2e50000115eb71fc5adc93645395e4d6271abea285973ef69d45ea1860f5a510e9552528749649cc701e83317cedfa74d1c904cf76ad5b843f7f3717d0db3671584d16b40e4343cb4c02a3a11b1e00453f4599920f70cf41d7c33f443350fac3352687c9427df322748985038811c662a64a03d70bf1262c26c9d2eac319b04a28d89dd6a4b857a9b480ae28c5de0445859e4ff04c734291037552239635964edd13b923337979151eba22c92f4f539d633f9c285f8cf9b1544ae97c6a114e0453779298fb6822eace689cb5004839a00e0b6b24169538591ae7f2fcdb6", 0xe1}], 0x4, 0x0, 0x0, 0x4000001}], 0x4, 0x800) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) ioctl$VIDIOC_QBUF(r18, 0xc058560f, &(0x7f0000000100)={0x8, 0x8, 0x4, 0x0, {}, {0x6, 0x8, 0x6e6, 0x0, 0x0, 0x8, "b344ee6d"}, 0x3, 0x3, @offset=0x6, 0x4}) ioctl$FIBMAP(r4, 0x1, &(0x7f0000002040)=0x9) 09:50:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x80004, 0x2) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:50:58 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000fffffdfd0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1841.995779][T28830] binder_transaction: 5 callbacks suppressed [ 1841.995789][T28830] binder: 28827:28830 got transaction with invalid data ptr [ 1842.026674][T28830] binder_transaction: 5 callbacks suppressed [ 1842.026694][T28830] binder: 28827:28830 transaction failed 29201/-14, size 24-0 line 3180 [ 1842.057288][ T7899] binder_release_work: 5 callbacks suppressed [ 1842.057296][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:50:58 executing program 5: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x432640, 0x0) ioctl$KVM_SET_TSS_ADDR(r0, 0xae47, 0xd000) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket$inet(0x2, 0x4000000000000001, 0x0) 09:50:58 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:50:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000060ff0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1842.325118][T29041] binder: 29040:29041 got transaction with invalid data ptr [ 1842.366602][T29041] binder: 29040:29041 transaction failed 29201/-14, size 24-0 line 3180 [ 1842.403906][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:58 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r1, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:50:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000fdfdffff0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1842.809539][T29191] binder: 29177:29191 got transaction with invalid data ptr [ 1842.829938][T29191] binder: 29177:29191 transaction failed 29201/-14, size 24-0 line 3180 [ 1842.849496][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:59 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) getsockopt$inet_opts(r1, 0x0, 0x9, &(0x7f0000000040), &(0x7f0000000080)) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:50:59 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000000, 0x7a2d) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x8000, 0x0) write$vnet(r2, &(0x7f0000000180)={0x1, {&(0x7f0000000080)=""/156, 0x9c, &(0x7f0000000140)=""/59, 0x0, 0x2}}, 0x68) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:50:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000040000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:59 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) r3 = semget(0x0, 0x0, 0x0) semctl$GETPID(r3, 0x0, 0xb, &(0x7f0000000240)=""/4096) clone(0x10000010000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1843.108664][T29396] binder: 29390:29396 got transaction with invalid data ptr [ 1843.132107][T29396] binder: 29390:29396 transaction failed 29201/-14, size 24-0 line 3180 09:50:59 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1843.173942][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:50:59 executing program 4: r0 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x408000) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f00000000c0)={0x0, 0x6}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r1, 0x29, 0xcb, &(0x7f0000000180), 0x4) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x0) setsockopt$bt_l2cap_L2CAP_CONNINFO(r2, 0x6, 0x2, &(0x7f0000000040)={0x2, 0x4a2f, 0x7, 0xb6ce}, 0x6) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@initdev, @in6=@ipv4={[], [], @dev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@loopback}}, &(0x7f00000002c0)=0xe8) r4 = getgid() fstat(r1, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r2, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='fuse\x00', 0x3000, &(0x7f0000000540)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000160000,user_id=', @ANYRESDEC=r3, @ANYBLOB=',group_id=', @ANYRESDEC=r4, @ANYBLOB=',allow_other,blksize=0x0000000000000800,mask=^MAY_APPEND,fowner<', @ANYRESDEC=r5, @ANYBLOB="2c686173682c6575691a0565e8edc3643e", @ANYRESDEC=r6, @ANYBLOB=',audit,obj_user=/dev/adsp#\x00,appraise,\x00']) 09:50:59 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:50:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000ffffffffff60000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:50:59 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1843.490621][T29584] binder: 29581:29584 got transaction with invalid data ptr 09:50:59 executing program 5: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x402003, 0x0) ioctl$VIDIOC_S_JPEGCOMP(r0, 0x408c563e, &(0x7f0000000080)={0x7c00000000, 0x3, 0x10, "0d862ab6e93dfe8e2019f41f163824abe9f90b77bbf0c1b217695c35bab7f1b058129e1fc8d49b09727a856d3c9e9f0a391e359f5dcd021e09a50471", 0x7, "8bf8203e9aaae4d9d90978f712449719a75a67d1fa455a5dc637d38fb20888a1630f92162f195c6ac095f894ae27b5e848ffc775506c47909332346c"}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) setsockopt$inet_int(r1, 0x0, 0x7, &(0x7f0000000140)=0x6, 0x4) [ 1843.546566][T29584] binder: 29581:29584 transaction failed 29201/-14, size 24-0 line 3180 [ 1843.595790][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000074000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1843.871399][T29782] binder: 29777:29782 got transaction with invalid data ptr [ 1843.893738][T29782] binder: 29777:29782 transaction failed 29201/-14, size 24-0 line 3180 [ 1843.927075][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000ffefffffff7f000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1844.106338][T29978] binder: 29956:29978 got transaction with invalid data ptr [ 1844.126816][T29978] binder: 29956:29978 transaction failed 29201/-14, size 24-0 line 3180 09:51:00 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x6, 0x80000) ioctl$PPPIOCSNPMODE(r0, 0x4008744b, &(0x7f0000000040)={0x3d, 0x2}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xc9, &(0x7f0000000180)=0xffffffffffffffff, 0x4) [ 1844.155997][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:00 executing program 5: r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x101, 0x40040) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000c48}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r1, 0x8, 0x70bd28, 0x25dfdbff, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x7, 0x4, 0x4, 0x280}}}, ["", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000000) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r3 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r3, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000094000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1844.470850][T30108] binder: 30106:30108 got transaction with invalid data ptr [ 1844.508581][T30108] binder: 30106:30108 transaction failed 29201/-14, size 24-0 line 3180 [ 1844.536972][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x408180, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1}) connect$inet6(r0, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000240)={@in6={{0xa, 0x4e22, 0x400, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x10001}}, 0x0, 0x1e, 0x0, "1d6988f8fb50b5bf323e50831f790f00d426c1b4286117e444538b7e9b93c8ba4221f189e5171eeb4e35dd454cf5ea65e3d5618f65c1d74244c659a7500bced65ac4dec4d344a54152a651abc43ac647"}, 0xd8) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:00 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:00 executing program 4: r0 = accept4$x25(0xffffffffffffff9c, &(0x7f0000000000), &(0x7f0000000040)=0x12, 0x800) ioctl$SIOCX25SCUDMATCHLEN(r0, 0x89e7, &(0x7f0000000080)={0xe}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r1, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x10000, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000080)={0xffffffff80000000, 0xe1e2}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:00 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000071500000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1844.894410][T30411] binder: 30383:30411 got transaction with invalid data ptr 09:51:01 executing program 4: setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcb, &(0x7f0000000180), 0x4) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000200)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x6c, r1, 0x302, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4000}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xffff}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0xff}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x53}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20000010}, 0x8000) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, 0xffffffffffffffff) ioctl$BLKRAGET(r2, 0x1263, &(0x7f0000000040)) [ 1844.944144][T30411] binder: 30383:30411 transaction failed 29201/-14, size 24-0 line 3180 [ 1845.003982][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000070c00000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1845.215941][T30729] binder: 30723:30729 got transaction with invalid data ptr [ 1845.231264][T30729] binder: 30723:30729 transaction failed 29201/-14, size 24-0 line 3180 [ 1845.257414][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000050d00000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000100004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:01 executing program 5: socketpair(0xa, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x808}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r1, 0x10, 0x70bd27, 0x25dfdbff, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4004005) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") openat$mixer(0xffffffffffffff9c, &(0x7f0000000440)='/dev/mixer\x00', 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000003c0), &(0x7f0000000400)=0x14) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) fsetxattr$security_smack_entry(r2, &(0x7f0000000040)='security.SMACK64EXEC\x00', &(0x7f0000000080)='\x00', 0x1, 0x1) remap_file_pages(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000000, 0x40, 0x40000) r4 = syz_open_dev$vcsa(&(0x7f0000000340)='/dev/vcsa#\x00', 0x7, 0x133000) write$P9_RMKDIR(r4, &(0x7f0000000380)={0x14, 0x49, 0x2, {0x0, 0x4, 0x7}}, 0x14) r5 = syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x10000, 0x20000) ioctl$TIOCLINUX2(r5, 0x541c, &(0x7f0000000280)={0x2, 0xf49, 0x96, 0x10000000000000, 0x401, 0x7fff}) getsockopt$inet_buf(r3, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) getsockopt$inet_sctp_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f00000002c0), &(0x7f0000000300)=0xb) ioctl$SIOCGIFHWADDR(r5, 0x8927, &(0x7f0000000480)) 09:51:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0xfffffffffffffffd}, 0x46) socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$sndpcmp(&(0x7f0000000140)='/dev/snd/pcmC#D#p\x00', 0x7, 0x140) ioctl$KDGKBMODE(r1, 0x4b44, &(0x7f0000000180)) r2 = dup2(r1, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = semget(0x2, 0x3, 0x18) semctl$GETVAL(r3, 0x2, 0xc, &(0x7f00000001c0)=""/96) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:02 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000200004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='cpuset\x00') ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x9) 09:51:02 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:02 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000140)=0xfffffffffffffffd, 0x3) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x10e00, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="6f000000986d09aa04d81558f26e3b86dad650cd3f504d1af3937f2d1476ed82c24575ca1d2baff2a8d12a0e195356db23c28a26772bc1596bfb9f26ec6dbe5d0b4e267c4046952406782db05749c51d9068e51dd190849596c00624821ff2ce4d6b900c"], &(0x7f0000000240)=0x77) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000280)={r2, 0x100000001, 0xff, 0x6, 0xfffffffffffeffff, 0x1}, &(0x7f00000002c0)=0x14) sendto(r0, &(0x7f0000000000)="bba11e861319c6bd6a5da54763016c449209f36d6a0a875d9d80d9eeca596a3a8627197deaf7a6dd2f6b5670f5cabdf28fb07a90d208bc243e896830c48391876deb386c3f2fed2bb310321dca293f8691e52afd94a819986ec7132beb801bdca3901627d2a66d5726ce0d4f247bbd95bb003fc0033a9618c043e0560d4e512fd0ac5377ad145bd1b0a11cdc3ba6e6e84b0b2805c4dddda912176e52291f03784149ef8084a48f752a442c24", 0xac, 0x20008000, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @empty}, 0x0, 0x0, 0x3, 0x1}}, 0x80) 09:51:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000300004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000400004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @remote}, &(0x7f00000002c0)=0xfffffffffffffee8) setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000180)={r3, @rand_addr=0xa4, @multicast2}, 0xc) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000500004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:03 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x4a89, 0x54000) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000140)={0xffffffffffffff9c, 0x10, &(0x7f0000000100)={&(0x7f00000001c0)=""/145, 0x91, 0x0}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000002c0)={r1, 0x10, &(0x7f0000000280)={&(0x7f0000000040)=""/148, 0x94, r2}}, 0x10) write$input_event(r1, &(0x7f0000000300)={{}, 0x17, 0x707}, 0x18) 09:51:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000600004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:03 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = socket$inet(0x2, 0x4000000000000001, 0x9) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000080)={{0x0, @empty, 0x4e21, 0x2, 'none\x00', 0x8, 0x7fff, 0xff}, {@dev={0xac, 0x14, 0x14, 0x24}, 0x4e21, 0x10000, 0xffff, 0x1ff, 0x3ff}}, 0x44) getsockopt$inet_buf(r0, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000040)={0x1, 0x0, 0xfff, 0xff, 0xc4a}) 09:51:03 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1847.098184][T32005] binder_transaction: 6 callbacks suppressed [ 1847.098197][T32005] binder: 31988:32005 got transaction with invalid data ptr [ 1847.155387][T32005] binder_transaction: 6 callbacks suppressed [ 1847.155406][T32005] binder: 31988:32005 transaction failed 29201/-14, size 24-0 line 3180 09:51:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x3f, 0x0, &(0x7f0000000000)) write$P9_RSTAT(r0, &(0x7f0000000040)={0x66, 0x7d, 0x1, {0x0, 0x5f, 0x401, 0x80, {0x10, 0x2, 0x7}, 0x40010000, 0x601, 0x2, 0x4, 0xb, '!vmnet1\\=:\x9b', 0x16, 'keyring-/vmnet0md5sum,', 0x2, '@y', 0x9, ')security'}}, 0x66) [ 1847.227885][ T3269] binder_release_work: 6 callbacks suppressed [ 1847.227894][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:03 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:03 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$inet6(0xa, 0x80004, 0x3) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) write$UHID_DESTROY(r1, &(0x7f0000000080), 0x4) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x800, 0x6) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) ioctl$RTC_IRQP_SET(r1, 0x4008700c, 0x13d9) 09:51:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000700004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1847.641441][T32219] binder: 32215:32219 got transaction with invalid data ptr [ 1847.668555][T32219] binder: 32215:32219 transaction failed 29201/-14, size 24-0 line 3180 [ 1847.736582][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000a00004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000640), 0x200000000000017d) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = shmget(0x2, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000240)={{{@in=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @empty}}}, &(0x7f0000000140)=0xe8) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000003c0)={{{@in6=@local, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6}}, &(0x7f00000001c0)=0xe8) stat(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r2, 0x10, &(0x7f0000000580)={0x0, 0x0}) r9 = fcntl$getown(r2, 0x9) shmctl$IPC_SET(r3, 0x1, &(0x7f00000005c0)={{0x200, r4, r5, r6, r7, 0x70, 0x1}, 0xfffffffffffffffa, 0x0, 0x0, 0x7ff, r8, r9, 0x8}) getsockopt$inet_tcp_int(r2, 0x6, 0x2, &(0x7f0000000640), &(0x7f0000000680)=0x4) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1847.987482][T32322] binder: 32321:32322 got transaction with invalid data ptr [ 1848.015667][T32322] binder: 32321:32322 transaction failed 29201/-14, size 24-0 line 3180 [ 1848.060062][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000001200004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x20000, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8030}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xac, r2, 0x711, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x80, 0x4, [@TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xd1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8b}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4e}]}]}, @TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x4000}, 0x80) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r3 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r3, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:04 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000000)={'nr0\x00', 0x3ff}) 09:51:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) sendto$inet(r1, &(0x7f0000000140)="3c39a091a8b27981f2a4e57d032e42cc648858e10482b5732d9f1ae345dbf78a18d8339e64e53e084cd1f5c4b334701db4cb5bd6efd3b0a7f34a6bedc4", 0x3d, 0x4001, &(0x7f0000000180)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f00000001c0)={'ipvs\x00'}, &(0x7f0000000240)=0x1e) [ 1848.331386][T32535] binder: 32532:32535 got transaction with invalid data ptr [ 1848.338813][T32535] binder: 32532:32535 transaction failed 29201/-14, size 24-0 line 3180 09:51:04 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1848.454513][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000001800004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:04 executing program 4: utime(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x6}) r0 = accept$unix(0xffffffffffffff9c, &(0x7f00000001c0), &(0x7f0000000240)=0x6e) write$binfmt_script(r0, &(0x7f0000000280)={'#! ', './file0', [{0x20, '/dev/admmidi#\x00'}, {0x20, '+](keyring,<^}cgroupvmnet1'}], 0xa, "3a29d355490ef53307f911470c7023e30fdd977cc6f4266c002ede432ce81470f044e99cebf76b18c55e19172a822fcb060b5cd3f868c0a139509d1ceb6480bf3885b401cefbd3679197c04bd6815d69f26bc29c96e03a37c85373ce185cb79d7ccb69267add6287bd1b3ad8e075a8b2332527e9786aee0ccbc06c4d99874c56a2aae3b86f6b47eea61e278bacaec1aa05220c740af83b4fa362a10b9aae72"}, 0xd4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x40000, 0x0) ioctl$SIOCX25GDTEFACILITIES(r2, 0x89ea, &(0x7f00000016c0)) accept$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendmmsg$alg(r2, &(0x7f0000001700)=[{0x0, 0x0, &(0x7f0000001680)=[{&(0x7f0000000400)="8add09fa787b44fdf291172d2a618a99e403f6f759e48fb6ac0ea1d1146a9cd877758e94d3c467cf95d43dec3a00e7ba2b694065fdb3552faf0f18cb56ab1cedcfc855d722038ee9997878d0e391bfac1ddf6e35de9a7b1ab5e2ca6cc6a4498a72b4c92fd2939e16ae35f8cd12e399fc0d5b3a951638e9f4d4fc59254fdd61f8946295a7bd3fdd8a4ec1dd2da61bc65ce68f8e980869f5b35d565d1a4870dac1", 0xa0}, {&(0x7f00000004c0)="366c6304a86c11ef72346e956aa3aa4ea7e34ca6668b8b4ad45d12f007db742e6291f4c1bec4e1a3c2bf67f6c31c59d274b9b78cdbe72524b28699f2f7b7f6703a190933796ea5ee050475c4bc640d2b2678278e126db50869aba00e3c7e8e0080a79ea6ac36cb7e11c8d6e2ba7311e32f97369800ac6815f4cdf518c0f2db0bb890733d688091778d776a99adc606b68de99d9a278c5942d43dae426d097ff2901d9bc6472a3a80c2e6cb74a08bcea039748b46598e847c698825eb007385126557d7ea7f6c607af4c3", 0xca}, {&(0x7f00000005c0)="a0dad736c2dc0be3ebb5532724487a6d7c6b346acb5319aba110466c84233fd9d6ba53c2aa31da7cc578953276b510f964dfa1d5a4788dd9c33beedae03c9747c2937c0e6355777499b1fa8c5d2bd9ad2f02c466d2667c726c96e81ecdc5d391412b114b4ef67481f74996a590bb3b5d54b31a1e4b3b15f5ce53e8c14866d42ac00a693f5376c1d1f6390f147fe2d74c797f480306edcf404593ddf1e1168e1b083ffa4e192febfc4fe1ae3681341ed16091386fdc46f842", 0xb8}, {&(0x7f0000000680)="89fec5306763547d16523fe688b085fbbb506e8d07e7bc2876b952dd5d690c642536ac4e34e600a4a6efee8c2f1548877c93786bff7d94c918b5b88939eba5b2a7ca12bed004697c6b4ae78d968e0d318e5e5fe16f2d2f6eabfa29aba1b728a28d270c03a5d6bdd1311d2182c8bab9dc9d18a0110ea12c9176c5381a73f43d4978c436612dd8d2148070209242bc8ea7b47f2ac709fb8cc34fa2026b26aa917f0c70f728e7096997db9ebb5b516ec5bc38fc2fbe68f4d7d2cf8a2b81c342d5773dc0561722ede24b228741ef734c2b6d3031232739c78a40d6a2571f2ee2e5ab4383144c7bf7c8272c50ad535bcc90683a04d21e698f36a28c42dbeeafdef3a46e9e77f73a2b3306f2276822e0682a81fb22f1bde75ed48e962086b9542e9e8a0031142af21512e3a09e47654b12717510c545e8ccc2e6814b44969ac3fb945a50537632de1061c4604f4db835a200997f9ce3d3b0ac0f210ddf874f0e28069aa9f8f70da875e3bc5848945138fbfafde03c6a790d24c94eeecce469ad033b7cc2688c419cdd426605010c92a9f871a6d19db037d5b3ea386c575a9ffea336826bbe76e267e3d2c2852bade557dcfeb9a355ea64a5533dd4632fb766fc61b531405b3b08952347997d0064a7463cd708eef3d14f7c028eb8f09b141bb3ae3a054e6dc86aeacd4499a42b19ccb8e0dc72096f5dc27b7dbc2ef992cd1fc0f1b4ae3500d7645f95a182f083b75ce6f975983529dad44bed4551522d3c5ef03350ebca61f61b7df2c813e20de257af8e3db30ae20960a4725d16ea8e6e88aadeef6357265460f00cbd359a7b2f92eaa5a9cadc847147937049d0a0a64790be0417899845cc4a37052926744cc610ff9323c2ea1886fff4659e5a76aa26f1ba445f1f338c8a9e5f0ec96f3ddc59147ef68bb80f3ad48cbe31a75b1bbe8a467d4fab1870e45c803c3e2f568253e5f12e0cd5c4e1caa0e60f96527ebcafd74e9d7f7e8ce0af59903b62246ff285b28020b63d5349e16c4aaac1b4be5fb61bd89c838550cc2454ff284f160f29102d57d74156ef857834d2667691933ba6974077495fe9e2019844cbe51597ccb5ee1f8e85aeecaa64be40583668710c1b047a9fbb70b2598b41fcc22e3968d8931dafab1ca0801ded8930e307329eb5392c1039943a80361f2e84586c99896798e1c9553a462a672944bdf027af49777669df71dd491769537bab73c6773bf709c928f8e98513ab8902b4a90b94c046fa051a3e9e1e24f3ff43781407493ef8be0f71042bba6fe579755760468f15b3d3771c0f1251db0b856db39d1ff508aa6977c0e87de92ab553b70d2d4b603c350aa3f31934a67ebdd8d8495cf353aac751001049977c5fc84b2966b504b0123cd6ee5f835c3200bcd6220927ec27babf6b48c4d00e2957ee7c5c2ab21387836683b02cfa0dc4c1aefc5b9bb6393816bfe88bee1c7503033ecc653d9709b979c7841beb8044b7ee48e66d5363a0d0e57171c34ab677c35ea52adbbdfe51e72a04edaed05ee522efeee65874fd27a1d6c9cf06e4f1160744f093e1aa02149a931c34b8a1bb09e97c2a3f8da45392a99fcc2ed350d9e6767e404428c799b917c9693368b95b49d44f75a1a480a6711f76cd2952b4a97b512806fc5fe7eb711d34cc6647ba50f48e11953ada66641d7b2a90e36661c2b8dd2d5f7ccd0023e6ef96aff2f936c400068170829eef135671d589fc1aa3873df6909744d8ccaefa4dc955ed43ba54a8b7b0eb53e989747e73eeef95ea6d550e14423a9062e13ace4743794ab1c6147b279a3c4afd9869e26a0ad74b74de38cfd2a58c4ee26b3208b7f5c69737286e9b01e4b3975ca1a0bb78abfe79043ca1be9701cfb4301715185e2f9b8d4960ce3cc78f83fa29040c1560103a32448611b4d5a76822b8beea8ebbdc7d60107d2e50ffe94588d7ad8f18ab66480a53472769f693e1e97fe6dbbb04b6bbd1a9730b4998d00a8140eaf5d221f05d86e313d5fccaf23dffd18888d910d5aff9398b49e4fc88473581b85384fa85ccae309cf5971ef63bdaf8ca8e1367f3a0fac3d73f0bd04780db2841c69b22e7a0781af21f4913b20a733648faa717b8cf8e175941a561ea8fdabdecd4f7394587645f47e60f189d2961aa4ad0039327c266b2f980a6e91fc8a74300012fd6f2acf10a9a43fda6dceef4582ae3c91fa0147a3f8e12df4e907e64983e5e85b27e46c6a781c0ebfaca2fdcfe11a551ceb481ecd88798d4be53d7f2bd57033dd31d9ae452196ff894b50ce024db189499c793eb5e3e94d57583a3c3be6ef723a57bc5084e2cf231533eb6abc56fb6489172ea64f5d48bde573f7a4e3de386aba076287f1c60eacea83efae63f3f3bddfd25dd0c5741f9f7ebb8d89573cfaf29b0daa4b6dd2aa25028ec1b29df84cced1817ba8550eba6de134936c97e4b5d37b33422744a9cbeb589108ba8a2c1fade648c1b0831763bf4998953aff3ddba1a1de4e12243c0d493ce68e6efc1a85df12c06acce1faf3c7521add703c70e684c2d240b29c774b25dd3499c96a867e7f0c685e4a627ce9b4a7e175f8de36b81559ea89c2f1dc6cb0970e6d556314638ac4e076c8a81fc2a789be61d196672901940bd4a6c592e96ac16f9e43ad3f8264b804c674cab66959692d0000a788dbd829e701308c9970e677b02d2852ef076ae186c13fc31bdc7f41506d5134c662a2ef48fecefa0979323e027f3aa6652fbe4db3c0371dfea9db25e2c3824ea4b559ced3857219268f6ce9e53da91535d5e6b052d3ab4330c7ba13a6d74f3d66e9c785460210dcc78549d72f432b5af5a0661ee6e05cce755e656859492cc9298941ccfc113fe1c077205e6d68825377cb7caefcdde1bad8da4d11b159d68a7142d5877f8b4dc6b14465a6c5d88cfce5522d03fce1ecf01068082a45425c4d76e030ad866feff984718affc898b96d6dd12980e6e37b3885f6c2df3ffc09242053e71f2d66ccbd1670b4215c548c764367523410223fd66d9d580ccdea1283ad428fd3d2c3d71e7ef633b7381c459355c57dc22b3ea5297dc765df7f9676ac48d75292d5f32ba7ef2a8c2be44e3d324f2b8f9e3767cc576396c5277b71ab1026a8fce027621558b4fe231676a0c5dff03dfee638123b660263e6c52421698ff4a8003e6ca3689e1263dcfdff0183a628cb72deb3fc417e25857acdcec4370983605a7d716ee222cd2248f95807ad10bce759142adce6a4015ff5dbdbf6bfbf4e7a567a59383bc4650ddcdbe363e7cec74024570317e05c811f25aa4a226061a2c8dd5046242696bbfbc0a932ffcc885d14d6796f36f2f75d43bb23850397f7390f7307def907a735df23a95daef823ba0f76a779ea58b7a0ddd2df0ecc90fd6cc82a3484d2cea721837a9c96874499022c5ee8321d265408239e252d20fa7c4b7b1f685bfe2081962e6e643cc5098b1fc39c43199e9b3b7a86a43a9dc5e4946b50bf8b62ee2d6f30ce6824b5cf2eea928b50f1b69c2ccbc20e67501687585eabd857e5f7689ed4e6f8dba6e24c7458876f89970f9c76846a91b52d5b50365a18dbbabbdd72e65af767c37d4cf96a9c2941ae0e4db88cd0cc98482bbcda4651d616a62c999cf60d336e49eb19850be595352aa95df48b7c8c1f1173a322a14eb88ec57a6913f4a7d1dae644fd758d661218e7c440a2e2abf5215429e26fb8f601aee1c29aaf18b37e8da2288c07671fb2a5be7fd5b0b3e08182e0e503242979768f96e632c7b109fc168498a78bc9865f89dc271671c2df1f29bdcfdee2c4cb8932c9d5581216bac5832366bdd68e685d74fc064bc726a67858fd9e6045f939df06e2b9a9d64bb1bc3eb7f09f1a4c280bcd94dfbda2b48b0c88db261ec842dc2d126f23c58dbaabb1f5c59f7c6c1aae1429aa83149c920cac4cc85b3d58f8bd2fea025f8a2b4455aee6cda97b989285759869f21399ca59e1bc8f3efee81981352621d560530141deefbecedc82aa468fd50cee4ed502f8612a236e0c8305009d9563975cc692ade0590d108536d8ca1a2b6d7966aa921a3d4ca8b509247f10d66c86593322c5bfce4e1aac219f8075ed6ab30c9f71531a1364698e2f4bc6b58a092017a8117518ee5e5ec448faf2f0b9aae69a0e1314322921b0cebb17fd7c4f2cea224b4d088ecaefc2e0cfab6b21d05fac291c4b1963fe80a6a87a55cdc777d07cdaff537e6c75abf25b4d6869a33955be6ca4029dfc9f8f0dc6cd2017a8f025f219a27c59e61e772561bd636144f88c0a9140fbe1c2df502af2c066e8661933820671352e283b0ab1052046e41880cc2d1bfe1566ceec43215b6f603cfdd63523dcd040f90b2849e134fe1dc2bc1c9617d8719d2ec350364fd54624d1562ee7baf446eda9e9f14cc115aa70db9c60172c7323c34b0d3f95866860bb80f195c4e73afc5d059981f0c9e5ae73c09852847ac401c00392581669d78677f1569c83975ca9858e86885d4f73032b215beab4a28e0c338df1280fd201f6fa49ab7f8f154fbdf2caf60d1f66be34387e0f8526f12ad53df90da02f09b55078a17cc0b22246d8250e87f190a932bfd165707d3640528ba343ffef6681057f66d1e032d04bf124551c9a131417a54296b66732cc5d188b755b690fcc36f454722eea77b26152b357a6a755f2c6d8c95ecf35db1539cdcd97eba67138a9214b1970b31f6385d6e239c722fda443b065ab8838bb6b04d17f94dbf593f36ff00d40e9ffde8bb9ed663c48e0c925d5bc3150d2f57fd96adf90d8ea5636b9980e6ea33e0b767276b69e7828e9e3fd3f01f0f331068a0fb70ac4c6a6e746013fb8ddc80505be7459eb271301d28206e5466a30be713b9961d621ac8dffb0bbbb4bf6182bbef15e4c0f44aed16e5a35105738dfb453d6ed087bfa501d0842b5c47fd2b349547c1b80244d9aedc74bcadb3b44d0fe8ed783cec1c82b4f21ec5b1ec87e7696ef89ad4df86400cc225e4e3ad9f062579b8b196a4a14489735bbc3e2d2cd4002f5941cee986593f41658d2bcf6afcfa40f3a23eb7dadcccb95380cab413e9716371657e039214c0451427383e689b4ccaa18ddd029d9803666a20b6b10e07d44786ead74b75dc97aea6cb9651d536e85e28bd92d0ad957ff1840e418962319c6fc28f1dfec04bf012550f7ceb84542bbced7a38e64dc0537053d15589e623df1073bbddc974bbdc1df2127363dc6a074219bd65ccb8845e66208c1dc2b7b4b96dd68f69db8b3db967f3c71c165ccd1a49bd62dc16fc29fac10f3e09d8102c9c15a28be17f4d8ffe99ef90c9b72f3a34b9bd8f6ef91e4413d35ddb5a251a336378b127ed0685746a1d77f3bce21f3afc271943c2b4a3bf201e432204021c43a1dd72a9059283cdf4e94552282270b3b5f982c8547b3c65e91a43552880d7f414c74c16c7ab3a2ac54cd35d13f5b229417936d66aa7bec653bf3c7d389035d6b950f8a54cf047ef61a497ac9b0adb7a6e48744bbc6002ca9228ab6a3bdb99f72590d94ed2bd0627fff451b07cce1e4f25f920162cfad83e065826e0a1909d1b605db325d8a70aea32834a980d5be39ea66ac72309f4c3c17a355c29127438eb0a052ad55c3b2f7c136af87de7e1d8c4e3106b6d3c62e91ae21dd38d47030190add2b0e5cd45fd7eb79901e32e29e7443c05b59dfb8dccb7fd72f9038c5794af8b90a1022e206a4f623bf4cb2fc0c8261b7732484450214d53662833a77c43a2f6eb3cfe03b7ff91d505c2942878901888de4b4231c437849e7915a19a264da5", 0x1000}], 0x4, &(0x7f00000016c0), 0x0, 0x20000000}], 0x1, 0x1) syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x7, 0x2001) setsockopt$inet6_int(r1, 0x29, 0xcb, &(0x7f0000000180), 0x4) tee(r1, r1, 0x69340afa, 0x5) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000), 0x4) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x1}) [ 1848.683670][T32758] binder: 32751:32758 got transaction with invalid data ptr [ 1848.714020][T32758] binder: 32751:32758 transaction failed 29201/-14, size 24-0 line 3180 09:51:05 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1848.791773][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 [ 1848.818709][ T391] Unknown ioctl 35306 09:51:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000002000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:05 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x53, 0x0, &(0x7f00000000c0)) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="2f63707520006370752000706964732000696f202f72646d61202f6d656d6f7279202b706964a4f8c5d7a73dd22a7920"], 0x30) r3 = gettid() ioctl$IMGETDEVINFO(r2, 0x80044944, &(0x7f0000000240)={0x3}) ioctl$VIDIOC_G_SELECTION(r2, 0xc040565e, &(0x7f00000001c0)={0x8, 0x0, 0x0, {0x5, 0x0, 0xffffffffffffff63, 0x1ff}}) fcntl$lock(r2, 0x24, &(0x7f0000000140)={0x2, 0x0, 0x8, 0xd9, r3}) [ 1849.067215][ T593] binder: 592:593 got transaction with invalid data ptr [ 1849.134984][ T593] binder: 592:593 transaction failed 29201/-14, size 24-0 line 3180 [ 1849.157762][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000003f00004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1849.317691][ T762] binder: 755:762 got transaction with invalid data ptr [ 1849.338461][ T762] binder: 755:762 transaction failed 29201/-14, size 24-0 line 3180 [ 1849.378430][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000004800004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:05 executing program 4: r0 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x7, 0x4000) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x800, 0x0) ioctl$BLKROSET(r2, 0x125d, &(0x7f00000001c0)=0x6) setsockopt$inet6_int(r1, 0x29, 0xcb, &(0x7f0000000180), 0x4) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000080)) 09:51:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x6c0100, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r1, 0xc004ae02, &(0x7f0000000080)={0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:05 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1849.680853][ T1058] binder: 1002:1058 got transaction with invalid data ptr [ 1849.719061][ T1058] binder: 1002:1058 transaction failed 29201/-14, size 24-0 line 3180 [ 1849.752154][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000004c00004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:06 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x3) 09:51:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000001480)=@broute={'broute\x00', 0x20, 0x6, 0x13e8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000080], 0x0, &(0x7f0000000040), &(0x7f0000001540)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff020000000900000004000000809b6c6f0000000000000000000000000000626f6e643000000000000000000000006e6c6d6f6e30000000000000000000006970365f767469300000000000000000f1ce655c4a200000ff0000ffaaaaaaaaaabbff00ff00ff0000009801000098010000c8010000636f6d6d656e7400000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000434f4e4e5345434d41524b0000000000000000000000000000000000000000000800000000000000010000000000000011000000400000009bce7369743000000000000000000000000069703665727370616e300000000000006e72300000000000000000000000000073797a5f74756e0000000000000000000180c2000003ffff00ffffff00000000000000ffffffffff0000b0000000300100008001000064657667726f757000000000000000000000000000000000000000000000000018000000000000000500000007000000ffffff7fb2a90000ff0700000000000041554449540000000000000000000000000000000000000000000000000000000800000000000000010000000000000049444c4554494d4552000000000000000000000000000000000000000000000028000000000000000004000073797a3100000000000000000000000000000000000000000000000004000000000000004c45440000000000000000000000000000000000000000000000000000000000280000000000000073797a31000000000000000000000000000000000000000000000000ffff00000200000000000000000000000000000000000000000000000000000000000000000000000000001a1079040002000000fcffffff01000000150000003400000002000000000000000000626174616476300000000000000000006e6c6d6f6e300000000000000000000062726964676530000000000000000000aaaaaaaaaaaaffff00ffff00aaaaaaaaaaaaffffff00ffff00008809000088090000d8090000616d6f6e670000000000000000000000000000000000000000000000000000008008000000000000e1310000ff07000003000000fbffffff0700000003000000000800000000000006000000030000008801000000000000070000009300000001000000c1ffffff040000000000000007000000ffffffffffffffff03000000000000001f00000007000000010000000008000003000000a90000000500000008000000feffffff83000000070000000800000004000000d9010000320a000000000080010000000700000008000000e1ffffff0002000002000000030000000000000001000000010000007700000005000000060000000600000001000000e0ffffff0180000003000000050000000100000001000000ec0800000000008020000000200000001700000003000000010000e60300000006000000000000000000000007000000fbffffff9e0d0000f50f00000300000001000000c700000009000000ff07006e52f520d44891e10008000000810500008100000001000000e22722200200000008000000810000000200000096860000000000400500000009000000030000000600000001000100010000000200000001fcffff00000000ff7f0000100000000400000000000000f404000003000000010000000010000040000000c000000003000000050000001f00000020000000060000000700000001040000000000007f000000ff7f00001b000000400000000400000001000000010400009d00000000000100810000000000000006000000050000009f4100000300000006000000eb00000009000000060000003f00000008000000010000000900000087070000fbffffff00000000d8000000020000000600000081000000090000000000000005000000010000008aec000000000000000000007f0000000500000003000000000000000400000008000000080000001c620000000000000300000000010000020000000100010009000000070000004100000000000000ff0700000900000009000000800000000600000000000000010000000000000001000000800000000000000000000000020000000800002dee3e04c0b1aa6d1fe0bd159cf30001040000e5000000080000007f000000faffffff0000000062000000ffffff7f00000000000000800100010001000000ffffffff080000000300000008000000000000000100000000feffffffffffff07000000040000000000000006000000000000003b0000006a07000006000000090000007e010000050000000600000002000000ff7f00006700000080ffffffe964000009000000030000000300000008000000d5030000080000000400000005000000ff0000000080000000800000000000000100000003000000010000000200000000080000ff01000001000000ff070000b10c0000f7ffffff09000000b60000000010000000040000010000003f00000004000000000100000800000004000000060000000000000001000000050000000800000003000000ac1414bb03000000ff03000000000001c8f0ad48080000000000000007000000fbffffffe0000002fbfffffff98ead06ac141418850f0000c5a3000034070000040000000000008049060000ac44000004000000090000006f540000bb28000006000000030000007f000000cc730000ff04000000000000da0b00000700000006000000010000000000000000000100ffffffff04000000000000000200000008000000010100003f00000009000000090000000400000005000000000000000100010000003c2b7f0000000000000006000000f28100000300000020000000f8ffffff05000000ff070000030000000800000000040000e30d0000000100000200000009000000605000002e71000003000000000000001f000000ff7f000008000000090000000000000004000000050000000100000000000001010000000800000004000000010000000700000009000000040000000000000009000000408d00001b3b00000000000022000000ffff00000700000081000000ff0300003e7500001f00000000020000060000006b00000009000000050000000000010042670000050000000300000003000000ffffff7fb59000000000008000000100070000001f000000c50b0000ab8e00000900000005000000040000000100000070ad0000050000000200000003000000040000001f00000001000100ff0f00000300000006000000feffffff06000000a4310000feffffffbc00000020000000020000000000000009000000000000800008000081ffffff05000000000000000001000009000000040000000700000006000000040000000000000002000000fbffffff0100000004000000cef0794d0100010000800000040000000080000001000000200000000500000005000000050000007700000002000000008000004900000005000000080000008000000007000000040000000100000008000000020000000004000003000000010100000400000000000000000000000080000080e4030000000000000100000400000001000000010500000002000010d000000000000008000000ffffffff04000000070000000500000002000000ff000000ffff000006000000000000000800000003000000530000000700000006000000000000000400000001000000ffffff7f4d800000ff070000ff03000004000000080000000100000001000000f878000009000000030000009f3500001f0000008cc1887c00000000ce000000000000001e91231120357028ff7f0000020000008000000000000000050000000600000001000000ef5400000100000008000000020000000800000003000000a7000000090000007f0000008d0000000300000019c900000800000016020000400000000300000004000000ffff0000010000000800000001000000c3070000018000000300000005000000070000008d0000000500000003000000030000000200000020000000e00000010300000001000000ac14141f0700000047040000ac1414240000000073747000000000000000000000000000000000000000000000000000000000004800000000000000f70000000300feff0100aaaaaaaaaabb00deff0000ff000008000000020000000700ea9faaaaaaaaaaaa00ff00ffffff4e234e230200f9fff8ff0600e7d9d9f10500fdff2000cc016c6f67000000000000000000000000000000000000000000000000000000000028000000000000000315ce38a4c80c813ae6107acde04d758392c191dbeb0a604532a0f049549500020000000000000000000000000000000000000000000000000000000000000000000000000000878ffce91c000000000003000000feffffff020000000500000020000000fbff69703665727370616e300000000000006263736830000000000000000000000079616d3000000000000000000000000073797a6b616c6c657231000000000000aaaaaaaaaa18ffff00ff00ffaaaaaaaaaabb00ff00ffffff0000e80200003803000088030000627066000000000000000000000000000000000000000000000000000000000010020000000000000e000000e552090402000000c806feff000000000500fe05ff0300000800ff6a60be00003ede025240000000010004060200000000f8fd0405000000080000ff7f00000002003000ff01000020000000c100000005000501a354000006009a09010000000500ff0202000000de4201fe080000004406020501000000ffff81097e5800000400080102000000090008077700000000008707000000001f0004ff00ffffff01f003ff400000000600043c00000000020009df0600000002000900010000002000cb81000000800400ae520700000056030700000000000900bea604000000ff018009f9ffffff010000011f00000002002d0300000000060008aeffffff7f0001fcdd040000002700e70501040000020003010002000001000601a2c50000020009fc04000000a800ffceffff0000050007400000008004000501390000000900972f070000000100280200000000400000fcf700000005007f6500000000ffff000908000000050005040001000007005505fcffffffea0c2255bc00000000000909070000000300ff19070000000200370200800000210101edef3400000900030601800000ffff070117000000d609ff09030000000300013e08000000fdfff6060100000002000105c0000000ff0700000400000003000700010000800000800307000000030007046014286afdff0581050000000104013f0800000000000000070000000000000071756f746100000000000000000000000000000000000000000000000000000018000000000000000100000000000000000000000100000009000000000000004c45440000000000000000000000000000000000000000000000000000000000280000000000000073797a31000000000000000000000000000000000000000000000000f7ffffff02000000000000006c6f67000000000000000000000000000000000000000000000000000000000028000000000000000019877b8f8b6fe9afb552d132a94067ac48e7122225f74b7941d06a2d20df0008000000000000000500000041000000809b697036677265300000000000000000006272696467655f736c6176655f30000073797a5f74756e00000000000000000073797a6b616c6c657230000000000000000000000000ff0000ff00ff0180c200000e00ffffff00ff00007000000070000000c000000049444c4554494d4552000000000000000000000000000000000000000000000028000000000000000000000073797a31000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000ffffffff01000000170000000800000000006966623000000000000000000000000073797a6b616c6c65723100000000000064756d6d79300000000000000000000065727370616e300000000000000000000180c2000003ffffffffffffaaaaaaaaaaaaffffffff00ff00004801000048010000c001000070687973646576000000000000000000000000000000000000000000000000007000000000000000697036746e6c300000000000000000000000000000000000000000000000000000000000000000000000000000006970366772653000000000000000000000000000000000000000000000ff000000000000000000000000000000a200000000000000000000000000000000000000006d61726b5f6d000000000000000000000000000000000000000000000000000018000000000000000dda000000000000030000000000000003020000000000004e464c4f470000000000000000000000000000000000000000000000000000005000000000000000050000000300070000000000106d0b8c58b171b3ca4caabb16cdc025953c50a4d7c401324d99906bc0b893c7f224deee0e63dc6640f4b2b66b8a99b808a568875248512942786cf60e6a92e100000000126cbe6187adc3452c7ea5a22f6eefc87d9adadb10518487598fa2e37478764b07aa42f28d0c35514ea1783181991a533a6114611f72a495b07e64da70158755c5926d57cd320923ed96437fce8171c4b22f9b5bc0e7b33f364446b986f20484e9008fea39946172cfa87dd3c49eb76dad4038ccf71316c03800e3d9bb176766cc7e54c544df4a8016e8935c910d8ccb0d2a7f10779894252be04a0d2ca35fbfed97c67d8c2ba751f45055828547342252620d8ea360350f0f815c5eff529cbcdefff0e1c822b27f49214ce20900"/5312]}, 0x1538) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f00000000c0)={{0xc, @local, 0x4e20, 0x1, 'lblcr\x00', 0x1, 0x6, 0xd}, {@empty, 0x4e21, 0x3, 0x4, 0x2, 0x6}}, 0x44) ioctl(r0, 0x1000008916, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1849.955778][ T1235] binder: 1234:1235 got transaction with invalid data ptr [ 1849.994000][ T1235] binder: 1234:1235 transaction failed 29201/-14, size 24-0 line 3180 09:51:06 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1850.063991][ T1240] IPVS: set_ctl: invalid protocol: 12 172.20.20.170:20000 [ 1850.093883][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:06 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe2(&(0x7f00000001c0)={0xffffffffffffffff}, 0x80000) ioctl$SIOCGETLINKNAME(r1, 0x89e0, &(0x7f0000000240)={0x3, 0x2}) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vfio/vfio\x00', 0x20000, 0x0) ioctl$KVM_S390_VCPU_FAULT(r3, 0x4008ae52, &(0x7f0000000180)=0x7f) r4 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r4, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000006000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1850.251347][ T1262] IPVS: set_ctl: invalid protocol: 12 172.20.20.170:20000 09:51:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x4, 0x0, &(0x7f0000000040)) [ 1850.428110][ T1359] binder: 1356:1359 got transaction with invalid data ptr [ 1850.453572][ T1359] binder: 1356:1359 transaction failed 29201/-14, size 24-0 line 3180 [ 1850.495060][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:06 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0xfffffffffffffee9) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000006800004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:06 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x2, 0x181000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='pids.current\x00', 0x0, 0x0) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000080)={r2, 0x1, 0x1000000000000, 0x2000}) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0x4e22, 0x7, @remote, 0x767843a3}, {0xa, 0x4e21, 0xfffffffffffffff8, @mcast1, 0x401}, 0x2, [0xce, 0xfffffffffffffff7, 0x2, 0x7fff, 0x1ff, 0x7, 0x87729ab]}, 0x5c) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000140)={@empty, @initdev, 0x0}, &(0x7f00000001c0)=0xc) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in=@rand_addr=0x1d5d00, 0x4e21, 0x100000001, 0x4e20, 0xfffffffffffffff7, 0xa, 0x20, 0xa0, 0x3f, r3, r4}, {0x9, 0x5, 0x3, 0x1000, 0x3, 0x0, 0x2, 0xfff}, {0x9c1e, 0x4, 0x101, 0x4}, 0x7ff, 0x6e6bc0, 0x2, 0x1}, {{@in=@multicast1, 0x4d6, 0x2b}, 0xa, @in6=@mcast2, 0x3505, 0x0, 0x1, 0xffff, 0xfffffffffffffffe, 0x80000001, 0x3}}, 0xe8) 09:51:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0xc6, &(0x7f00000002c0)="0adc1f123c12d0319b84700418f4") socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f00000000c0)={0x6, 0x9, 0x4, 0x4100, {r2, r3/1000+30000}, {0x7, 0x8, 0xffff, 0x5, 0x9, 0x40, "4f439840"}, 0x1, 0x4, @offset=0x5, 0x4}) getsockopt$inet_buf(r1, 0x6, 0x17, 0x0, &(0x7f00000001c0)=0x52d30483251dda88) 09:51:07 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = fcntl$dupfd(r0, 0x0, r0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x10000, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000080)={r1, r2, 0x5, 0x1}, 0x10) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r3, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000006c00004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000007400004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:07 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:07 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x2, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, &(0x7f0000000040)=""/114, &(0x7f00000000c0)=0x72) 09:51:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x8003) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) r2 = accept4(0xffffffffffffff9c, &(0x7f0000000040)=@alg, &(0x7f00000000c0)=0x80, 0x80000) getsockopt$inet6_buf(r2, 0x29, 0x2d, &(0x7f0000000100)=""/106, &(0x7f0000000180)=0x6a) 09:51:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000007a00004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x8000, 0x8) ioctl$BLKRESETZONE(r1, 0x40101283, &(0x7f0000000180)={0xa1fd, 0x8}) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000008000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000fffffdfd00004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:08 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) socketpair(0x1000000, 0x80b, 0x6, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$netrom(r1, &(0x7f0000000040)=""/107, 0x6b, 0x10000, &(0x7f00000000c0)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1}, [@default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast, @bcast]}, 0x48) 09:51:08 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:08 executing program 5: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c70") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0x3, 0xffff}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={r2, 0x1c, &(0x7f0000000140)=[@in6={0xa, 0x4e24, 0x7d1, @dev={0xfe, 0x80, [], 0x27}, 0x5}]}, &(0x7f00000001c0)=0x10) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000080)={0x80000001, 0x9}) 09:51:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000007fffffffefff00004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x9, 0x8080) connect$netrom(r1, &(0x7f00000000c0)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x5}, [@bcast, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) ioctl(r0, 0x3f, &(0x7f0000000040)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1852.362073][ T2756] binder_transaction: 6 callbacks suppressed [ 1852.362083][ T2756] binder: 2753:2756 got transaction with invalid data ptr [ 1852.401249][ T2756] binder_transaction: 6 callbacks suppressed [ 1852.401267][ T2756] binder: 2753:2756 transaction failed 29201/-14, size 24-0 line 3180 [ 1852.447256][ T3269] binder_release_work: 6 callbacks suppressed [ 1852.447265][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:08 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x40010, r1, 0x0) 09:51:08 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x80082, 0x0) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000080)={0x80000001, 0xffffffff, 0x7fffffff}) write$P9_RCLUNK(r1, &(0x7f0000000040)={0x7, 0x79, 0x1}, 0x7) 09:51:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000ffffffff00004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1852.794441][ T2928] binder: 2911:2928 got transaction with invalid data ptr [ 1852.816304][ T2928] binder: 2911:2928 transaction failed 29201/-14, size 24-0 line 3180 [ 1852.843608][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) connect$inet6(r0, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, &(0x7f0000000140)={0x671}, 0x4) ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) read$alg(r3, &(0x7f0000000240)=""/164, 0xa4) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000060ffffffffff00004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:09 executing program 4: syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x12, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xc9, &(0x7f0000000180), 0x4) [ 1853.117227][ T3201] binder: 3183:3201 got transaction with invalid data ptr [ 1853.135183][ T3201] binder: 3183:3201 transaction failed 29201/-14, size 24-0 line 3180 09:51:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c) [ 1853.199276][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:09 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000200000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:09 executing program 4: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x4000, 0x0) ioctl$PPPIOCGNPMODE(r0, 0xc008744c, &(0x7f0000000040)={0x2d, 0x1}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={'syz_tun\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1a}}}) setsockopt$inet6_int(r1, 0x29, 0x9, &(0x7f0000000180), 0x4) ioctl$int_out(r0, 0x5460, &(0x7f0000000080)) linkat(r2, &(0x7f0000000140)='./file0\x00', r2, &(0x7f00000001c0)='./file0\x00', 0x1004) [ 1853.494560][ T3450] binder: 3439:3450 got transaction with invalid data ptr [ 1853.550839][ T3450] binder: 3439:3450 transaction failed 29201/-14, size 24-0 line 3180 [ 1853.600130][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000300000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1853.796165][ T3661] binder: 3660:3661 got transaction with invalid data ptr [ 1853.816597][ T3661] binder: 3660:3661 transaction failed 29201/-14, size 24-0 line 3180 [ 1853.908252][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:10 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:10 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='uid_map\x00') ioctl$UI_DEV_DESTROY(r1, 0x5502) ftruncate(r0, 0xffffffffffffffff) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0x1, 0x0) sendmmsg$nfc_llcp(r2, &(0x7f0000000340)=[{&(0x7f0000000100)={0x27, 0x0, 0x0, 0x6, 0x9, 0xff5f, "378b3c891affa165f9c87503b0f3b47b6c358bda76a3030caabde8f473428ebee1dffb706c9cb86e827fd76c296a5c21fb5b0fa5a9164bd97a94049c19df00", 0x32}, 0x60, &(0x7f0000000280)=[{&(0x7f00000001c0)="363c9839ae11f234826869a08cb9f33bad63ad1057016f963c1fb746132be70af59998bbb391b908be731bf3a9605d71c280f853cde6e4519297a1f02d923e4a34bc000a0e7b61196ac2f2b8642a5a03df53a4163d3a9d38a748765b873b354def65bbfa5a07c9163c5bc5669853c52a870b0d4ad604a79b9cc31ab761fdc0f4dd7ef12c07277d8213c8a2c25f178c3b961a2ff7d8fe054b9035c36c237ba7106f98e56d56007135877a42e590ecfcdd50d3d7043a7d9420cff4a45635c4fb02", 0xc0}], 0x1, &(0x7f00000002c0)={0x60, 0x11d, 0x3, "72c68ef5b331807365f342363b3bc3b56b4fd36df9c00ee6103c81cbb9154bff5d471068d385e1707ee55c42e500d272d2f1839fa84abef3f80fb7d002d0c4dbf78eeddd2b5f5467511fcd2f63"}, 0x60}], 0x1, 0x20040044) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000000)=0x5) 09:51:10 executing program 5: r0 = creat(&(0x7f0000000040)='./file0\x00', 0x40) connect$unix(r0, &(0x7f0000000080)=@file={0x0, './file0\x00'}, 0x6e) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x7, &(0x7f0000000000)="0adc1f043c123f319bd070") r2 = socket$inet(0x2, 0x4000000000008001, 0x1) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x80000, 0x1000004) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:10 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20}, 0x6bf33361a55c4cf5) fcntl$setstatus(r0, 0x4, 0x2000) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000400000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1854.336122][ T3886] binder: 3885:3886 got transaction with invalid data ptr [ 1854.356586][ T3886] binder: 3885:3886 transaction failed 29201/-14, size 24-0 line 3180 [ 1854.423469][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000500000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000040)={{{@in=@broadcast, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@empty}}, &(0x7f0000000140)=0xe8) ioprio_get$uid(0x3, r1) r2 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$setperm(0x5, r2, 0x10) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r3 = socket$inet(0x2, 0x4000000000000000, 0x0) getsockopt$inet_buf(r3, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1854.622936][ T4092] binder: 4091:4092 got transaction with invalid data ptr [ 1854.686803][ T4092] binder: 4091:4092 transaction failed 29201/-14, size 24-0 line 3180 [ 1854.726114][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:10 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:10 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x101100, 0x0) setsockopt$inet6_tcp_buf(r1, 0x6, 0xd, &(0x7f0000000040)="73b0e1360b7190d656d4aba70351e0a9b0f561f046f358f1c48d602cc25e84d7f74785ca13bd3dddbf27654931d9ee3f26a7eb16e463d8f71eba1c81645c3c6ca94a396b4aae3f4e3803e3c8bb728d0bb2630c7340de19578d4058ab78f3a16c578c93eff5be97a31ab119d4c452d517d8b7ea661bdd576a47a28d78b1ee2ca15f93ad09388994f91e531fc18b2e", 0x8e) getsockopt$nfc_llcp(r1, 0x118, 0x0, &(0x7f0000000100)=""/54, 0x36) 09:51:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ifreq(r0, 0x89bf, &(0x7f0000000040)={'bridge0\x00', @ifru_map={0xffff, 0x4, 0x1ff, 0x6, 0xff7, 0x2}}) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x80, 0x0) ioctl$KVM_GET_FPU(r1, 0x81a0ae8c, &(0x7f00000000c0)) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f00000002c0)='team\x00') recvmmsg(r2, &(0x7f0000007380)=[{{&(0x7f0000000300)=@pppol2tpin6, 0x80, &(0x7f0000000740)=[{&(0x7f0000000380)=""/242, 0xf2}, {&(0x7f0000000480)=""/238, 0xee}, {&(0x7f0000000580)=""/157, 0x9d}, {&(0x7f0000000640)=""/21, 0x15}, {&(0x7f0000000680)=""/125, 0x7d}, {&(0x7f0000000700)=""/32, 0x20}], 0x6, &(0x7f00000007c0)=""/153, 0x99}, 0x4}, {{&(0x7f0000000880)=@can, 0x80, &(0x7f0000001a40)=[{&(0x7f0000000900)=""/74, 0x4a}, {&(0x7f0000000980)=""/4096, 0x1000}, {&(0x7f0000001980)=""/36, 0x24}, {&(0x7f00000019c0)=""/122, 0x7a}], 0x4}, 0x8}, {{&(0x7f0000001a80), 0x80, &(0x7f0000002f80)=[{&(0x7f0000001b00)=""/107, 0x6b}, {&(0x7f0000001b80)=""/26, 0x1a}, {&(0x7f0000001bc0)=""/243, 0xf3}, {&(0x7f0000001cc0)=""/153, 0x99}, {&(0x7f0000001d80)=""/114, 0x72}, {&(0x7f0000001e00)=""/4096, 0x1000}, {&(0x7f0000002e00)=""/20, 0x14}, {&(0x7f0000002e40)=""/84, 0x54}, {&(0x7f0000002ec0)=""/175, 0xaf}], 0x9, &(0x7f0000003040)=""/105, 0x69}, 0x4}, {{&(0x7f00000030c0)=@l2, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003140)=""/244, 0xf4}, {&(0x7f0000003240)=""/182, 0xb6}, {&(0x7f0000003300)=""/182, 0xb6}, {&(0x7f00000033c0)=""/237, 0xed}], 0x4, &(0x7f0000003500)=""/57, 0x39}, 0x1f}, {{&(0x7f0000003540)=@hci={0x1f, 0x0}, 0x80, &(0x7f00000045c0)=[{&(0x7f00000035c0)=""/4096, 0x1000}], 0x1, &(0x7f0000004600)=""/242, 0xf2}, 0x9}, {{&(0x7f0000004700)=@sco, 0x80, &(0x7f0000005cc0)=[{&(0x7f0000004780)=""/249, 0xf9}, {&(0x7f0000004880)=""/206, 0xce}, {&(0x7f0000004980)=""/246, 0xf6}, {&(0x7f0000004a80)=""/1, 0x1}, {&(0x7f0000004ac0)=""/138, 0x8a}, {&(0x7f0000004b80)=""/178, 0xb2}, {&(0x7f0000004c40)=""/4096, 0x1000}, {&(0x7f0000005c40)=""/124, 0x7c}], 0x8, &(0x7f0000005d40)=""/100, 0x64}, 0x93}, {{&(0x7f0000005dc0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000006f80)=[{&(0x7f0000005e40)=""/102, 0x66}, {&(0x7f0000005ec0)=""/143, 0x8f}, {&(0x7f0000005f80)=""/4096, 0x1000}], 0x3, &(0x7f0000006fc0)=""/152, 0x98}, 0xa91}, {{0x0, 0x0, &(0x7f00000072c0)=[{&(0x7f0000007080)=""/23, 0x17}, {&(0x7f00000070c0)=""/13, 0xd}, {&(0x7f0000007100)=""/228, 0xe4}, {&(0x7f0000007200)=""/139, 0x8b}], 0x4, &(0x7f0000007300)=""/126, 0x7e}, 0x7}], 0x8, 0x12000, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000007580)={'team0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000075c0)={{{@in=@broadcast, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@loopback}}, &(0x7f00000076c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000007700)={'team0\x00', 0x0}) getsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f00000077c0)={@loopback, 0x0}, &(0x7f0000007800)=0x14) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000007a80)={0x0, @empty, @dev}, &(0x7f0000007ac0)=0xc) accept$packet(r1, &(0x7f0000007b00)={0x11, 0x0, 0x0}, &(0x7f0000007b40)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000007b80)={'vcan0\x00', 0x0}) recvmsg(r0, &(0x7f00000081c0)={&(0x7f0000007fc0)=@can={0x1d, 0x0}, 0x80, &(0x7f00000080c0)=[{&(0x7f0000008040)=""/53, 0x35}, {&(0x7f0000008080)=""/20, 0x14}], 0x2, &(0x7f0000008100)=""/144, 0x90}, 0x10103) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000008200)={{{@in=@loopback, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000008300)=0xe8) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000008700)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000010}, 0xc, &(0x7f00000086c0)={&(0x7f0000007bc0)=ANY=[@ANYBLOB="4c030000", @ANYRES16=r3, @ANYBLOB="00002dbd7000fcdbdf250200000008000100", @ANYRES32=r4, @ANYBLOB="300102003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r5, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000300000008000600", @ANYRES32=r7, @ANYBLOB="3c626c656400000000000036657b08a2f40200000000000000263d7bd5e7e6004000f6fa7b7c0509df703c0e08993b64179003ab3375d9cdbdef1065fb8f3b61058cffbee4c1f67956098da3643633a3720258fb40568c00000000000000000042ba0ab66ab324ea6f94b1ea9ccfee592349f51e46ae64642e7623618e86e6f31b98edf100000000000000001800000000", @ANYRES32=r8, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="0401020040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r11, @ANYBLOB="08000700000000004c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000001c0004000200010904000000060000b30004000009006d09e402000038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000080003000300000008000400000000003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r12, @ANYBLOB="08000100", @ANYRES32=r13, @ANYBLOB="ec00020038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004007f0000003c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000000c000400686173680000000038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400010000003c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000000c0004006861736800000000"], 0x34c}, 0x1, 0x0, 0x0, 0x40}, 0x4890) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000600000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1855.057974][ T4309] binder: 4307:4309 got transaction with invalid data ptr [ 1855.086795][ T4309] binder: 4307:4309 transaction failed 29201/-14, size 24-0 line 3180 [ 1855.130125][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:11 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:11 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000000)=@generic={0x1, 0x3, 0x58}) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x40000, 0x0) ioctl$PPPIOCGNPMODE(r1, 0xc008744c, &(0x7f0000000140)={0x3d, 0x2}) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) lsetxattr$security_selinux(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.selinux\x00', &(0x7f00000000c0)='system_u:object_r:hald_log_t:s0\x00', 0x20, 0x3) 09:51:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000700000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:11 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) syz_genetlink_get_family_id$SEG6(&(0x7f0000000180)='SEG6\x00') r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000140)) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1855.521351][ T4590] binder: 4567:4590 got transaction with invalid data ptr [ 1855.537999][ T4590] binder: 4567:4590 transaction failed 29201/-14, size 24-0 line 3180 [ 1855.575736][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000a00000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1855.813775][ T4903] binder: 4851:4903 got transaction with invalid data ptr [ 1855.831850][ T4903] binder: 4851:4903 transaction failed 29201/-14, size 24-0 line 3180 [ 1855.856362][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000001200000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:12 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x100, 0x0) open_by_handle_at(r1, &(0x7f0000000080)={0xd1, 0x8000, "b34486b4f9a943d5698ee975f8a5fb88117c286f58ac3b08a9e999a47b0ebddbd7725f33be9ffa7513f2c095f286e48c3e9dbede23c23ca3480e29720b93a343df984da3817d9b3d091aa64a50f37e8b8099a345dceccf582aa059adc53269930162d18550b0f4783194561a2db430a568b6398d188c9faa079e7060ec7457a6fde50526a947cb0e6a633dfd713f9cce17d022ad8e90d90aa6eb6a18f1a885326245cf525440b4df13357e951ba5f3b692da7fc99123f1265ff34f92b20e89c154ac30e260e8ce2cb8"}, 0x40) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)={0x525}) 09:51:12 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x7, 0x101000) ioctl$VIDIOC_DECODER_CMD(r2, 0xc0485660, &(0x7f0000000080)={0x4, 0x3, @start={0xdb43}}) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) socket$tipc(0x1e, 0x5, 0x0) 09:51:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000001800000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:12 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x5, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000000c0)={0x0, 0x8, 0x1, [0x0]}, &(0x7f0000000100)=0xa) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000140)={r2, 0x10, "26dc8309a0390fb50a43e86cd3c5e464"}, &(0x7f00000001c0)=0x18) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r3 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xf5, 0x20000) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f0000000040)={0x7, 0x3}, 0x2) 09:51:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x400, 0x0) ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, &(0x7f0000000100)) getsockname$netlink(r2, &(0x7f0000000080), &(0x7f00000000c0)=0xc) fdatasync(r0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x80, 0x0) ioctl$KDSETLED(r2, 0x4b32, 0x7ffffffb) 09:51:12 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000280)='/dev/usbmon#\x00', 0x3ff, 0x8001) ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f00000002c0)={0x3, 0x3, 0x6, 0xffffffffffffffff, 0x7, 0x3}) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000001c0), 0x1ffffffffffffe8c) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000140)={0x0, 0x1, 0x8, 0x7fffffff}) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000180)={'mangle\x00'}, &(0x7f0000000240)=0x54) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000004800000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000004c00000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000006000000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:13 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) ioctl$VIDIOC_SUBDEV_S_SELECTION(r0, 0xc040563e, &(0x7f0000000000)={0x1, 0x0, 0x102, 0x6, {0x101, 0x3f, 0x9, 0x80}}) 09:51:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/sctp\x00') ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000080)={0x5000, 0x0, 0x2, 0xbf7, 0x2}) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000240)='team\x00') getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000400)={{{@in=@broadcast, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@local}}, &(0x7f0000000500)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000540)={{{@in6=@dev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6}}, &(0x7f0000000640)=0xe8) accept$packet(r1, &(0x7f0000001480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000014c0)=0x14) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000001500)={@local, @rand_addr, 0x0}, &(0x7f0000001540)=0xc) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000001840)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001800)={&(0x7f0000001580)={0x258, r2, 0x204, 0x70bd2d, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0x23c, 0x2, [{0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0x5, 0x0, 0x423, 0x5}, {0x7, 0x8, 0x400, 0xffffffffffffff74}, {0x4, 0x5, 0x8000, 0x1000}, {0xcd7, 0x0, 0x5}, {0x8, 0x6, 0x6, 0x5}]}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r4}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x2a}}}]}}]}, 0x258}, 0x1, 0x0, 0x0, 0x40}, 0x90) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r7 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x0, 0x2f, &(0x7f00000000c0)=""/227, &(0x7f00000001c0)=0xe3) getsockopt$inet_buf(r7, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:13 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000006800000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1857.532421][ T5874] binder_transaction: 5 callbacks suppressed [ 1857.532432][ T5874] binder: 5873:5874 got transaction with invalid data ptr [ 1857.546147][ T5874] binder_transaction: 5 callbacks suppressed [ 1857.546164][ T5874] binder: 5873:5874 transaction failed 29201/-14, size 24-0 line 3180 [ 1857.562664][ T3269] binder_release_work: 5 callbacks suppressed [ 1857.562672][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000006c00000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:13 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000000)=0x4) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x100, 0x0) mq_timedsend(r1, &(0x7f00000000c0)="fd5232bb09e2b68031a4e60064a7b1c2915186f64813ccd4f0bd814081e21373c03fb71fb09e110ab29b0af705a31554da50d7ee7bbb9bef771bfa184d833cc45ead39cb3b125e4e5e00aee972fefd658b69e48edc6d85f7532084c5666fb79e208700d1c5e851c3d46ce2afeabf445ca8798669094c7b85324fa242a93807de7f1671861e4433fa55b21d16f833662a4933db7591819854509b", 0x9a, 0x7ff, &(0x7f00000001c0)) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@reserved}) [ 1857.794086][ T6077] binder: 6076:6077 got transaction with invalid data ptr [ 1857.808740][ T6077] binder: 6076:6077 transaction failed 29201/-14, size 24-0 line 3180 [ 1857.848221][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x3, 0x2000) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f00000000c0)=[@mss={0x2, 0x2}], 0x1) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:14 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:14 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @rand_addr, 0x3}, 0xfffffffffffffc56) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000007400000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x5, &(0x7f0000000040)="2bdce2cc36aa66829f0170") r1 = socket$inet(0x2, 0x4000100000000001, 0x3) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:14 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x0, 0x4000) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000080)) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r2 = dup3(r0, r0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e20, @multicast1}], 0x20) 09:51:14 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1858.443380][ T6394] binder: 6389:6394 got transaction with invalid data ptr [ 1858.451230][ T6394] binder: 6389:6394 transaction failed 29201/-14, size 24-0 line 3180 [ 1858.462162][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = getpgrp(0xffffffffffffffff) waitid(0x1, r1, 0x0, 0x0, &(0x7f00000000c0)) r2 = dup(r0) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x4) write$P9_RRENAMEAT(r2, &(0x7f0000000200)={0x7, 0x4b, 0x2}, 0x7) r3 = getpgrp(r1) r4 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x7, 0x402000) kcmp$KCMP_EPOLL_TFD(r1, r3, 0x7, r0, &(0x7f0000000080)={r4, r0, 0x7}) r5 = socket$inet(0x2, 0x4000000000000001, 0xfffffffffffffffd) getsockopt$inet_buf(r5, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000007a00000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1858.813189][ T6612] binder: 6610:6612 got transaction with invalid data ptr [ 1858.840470][ T6612] binder: 6610:6612 transaction failed 29201/-14, size 24-0 line 3180 [ 1858.886024][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000003000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1859.095215][ T6715] binder: 6714:6715 got transaction with invalid data ptr [ 1859.117533][ T6715] binder: 6714:6715 transaction failed 29201/-14, size 24-0 line 3180 [ 1859.162324][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000005000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:15 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000040)={0x800}, 0x4) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000080), &(0x7f00000000c0)=0x30) 09:51:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x15e, &(0x7f0000000000)="0adc1f123c123f319bd070") setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000480)={0x5, {{0x2, 0x4e20, @local}}, 0x1, 0x7, [{{0x2, 0x7, @broadcast}}, {{0x2, 0x4e22, @multicast1}}, {{0x2, 0x4e20, @remote}}, {{0x2, 0x4e24, @multicast2}}, {{0x2, 0x4e24, @broadcast}}, {{0x2, 0x4e23, @loopback}}, {{0x2, 0x4e20, @local}}]}, 0x410) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x20000, 0x0) write$sndseq(r2, &(0x7f00000000c0)=[{0x100, 0x7b5b, 0x2, 0x3947, @tick=0x8001, {0x3, 0x33daf5cb}, {0x80, 0xc5e}, @quote={{0x4, 0x7}, 0x3f, &(0x7f0000000080)={0xa8b, 0x400, 0x5, 0x7, @time={0x77359400}, {0x57f2, 0x7}, {0x5, 0x9}, @note={0x2, 0x4, 0x800, 0x9, 0x8}}}}, {0x4, 0x0, 0x8, 0x9, @time={0x77359400}, {0x951, 0x6}, {0x0, 0x3}, @raw8={"b27b97db72f354f3d3a06ead"}}, {0x1f8b, 0x8, 0xffffffff, 0x7f, @time, {0x8e6, 0x3}, {0x10001, 0x49}, @connect={{0x3f, 0x401}, {0x6, 0x3}}}], 0x90) ioctl$RTC_ALM_READ(r2, 0x80247008, &(0x7f0000000180)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x38, &(0x7f00000001c0)=[@in6={0xa, 0x4e23, 0x4, @rand_addr="5ca00d78c2340c8c08fa8f470c0d706b"}, @in6={0xa, 0x4e24, 0x6, @mcast1, 0x80}]}, &(0x7f0000000240)=0x10) ioctl$EVIOCGPHYS(r2, 0x80404507, &(0x7f00000003c0)=""/179) setsockopt$inet_sctp_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f0000000280)={r3, 0x4, 0x6d, "c4aa97ce5df034e315934d5690509db61cb8f038782cd06c06b2ccbbc50135d37e3ee2e0c51630e58ba4d27f9195df5563f2200aee6707fbdffbdeaa17282a29bfe005aa3ece847b6eed2b27770d1fb58a4a81ff63938efb43940475acfd85dbaba54fc24fe7ba553b8f70764d"}, 0x75) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000300)={'batadv0\x00', 0xffffffffffffffe0}) [ 1859.396852][ T6946] binder: 6900:6946 got transaction with invalid data ptr [ 1859.425136][ T6946] binder: 6900:6946 transaction failed 29201/-14, size 24-0 line 3180 [ 1859.473287][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:15 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:15 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x10000, 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x9}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000000c0)=@assoc_value={r2, 0x8}, &(0x7f0000000100)=0x8) socket$inet6_dccp(0xa, 0x6, 0x0) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000006000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000040)=""/181) lsetxattr$security_smack_transmute(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='security.SMACK64TRANSMUTE\x00', &(0x7f00000001c0)='TRUE', 0x4, 0x1) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000200)={{0x2c, @remote, 0x4e22, 0x0, 'lblc\x00', 0x20, 0xe167, 0x32}, {@broadcast, 0x4e24, 0x2003, 0xf205, 0x101, 0x8}}, 0x44) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000100)={0x1, 0x1}, 0x8) 09:51:15 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:15 executing program 1: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e24, @empty}}, [0x1, 0x0, 0x7, 0x6, 0x2, 0x5e8, 0x4, 0x1f, 0x3f, 0x0, 0x2, 0x7ff, 0x0, 0x3, 0x8000]}, &(0x7f0000000140)=0x100) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000180)={r1, 0x4, 0x4b}, &(0x7f0000000340)=0x8) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) r3 = dup2(r2, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1859.809276][ T7137] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20002 [ 1859.821872][ T7137] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20002 [ 1859.833541][ T7141] binder: 7132:7141 got transaction with invalid data ptr [ 1859.841225][ T7141] binder: 7132:7141 transaction failed 29201/-14, size 24-0 line 3180 [ 1859.875286][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:16 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcf, &(0x7f0000000040), 0xffffff68) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vsock\x00', 0x100, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000340)={&(0x7f00000001c0), 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xa0, r2, 0x300, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x8, 0x6, [@TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xa3f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}]}, @TIPC_NLA_MON={0x34, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2a}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}]}, @TIPC_NLA_LINK={0x10, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x44000) r3 = dup(r0) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40200600}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r4, 0x420, 0x70bd27, 0x25dfdbff, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xffff}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x8800) syz_open_dev$vbi(&(0x7f0000000200)='/dev/vbi#\x00', 0x0, 0x2) 09:51:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000040)=""/33, &(0x7f00000000c0)=0x21) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bd070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000014000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000000)="360fae08670f01d1b8c80e8ee0f2a566b9af0300000f320fc75ac70f019af5ffba210066ed0fc79e9c5ebaa000b80118ef", 0x31}], 0x1, 0x0, 0x0, 0xfffffffffffffdb9) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x7) getsockopt$inet_buf(r4, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) accept4(r4, 0x0, &(0x7f0000000100), 0x80000) 09:51:16 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) open(&(0x7f0000000180)='./file0\x00', 0x200000, 0x40) bind$vsock_dgram(r2, &(0x7f0000000140)={0x28, 0x0, 0x2710, @my=0x1}, 0x10) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000007000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1860.245866][ T7358] binder: 7355:7358 got transaction with invalid data ptr [ 1860.255814][ T7358] binder: 7355:7358 transaction failed 29201/-14, size 24-0 line 3180 [ 1860.267701][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000a000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1860.531152][ T7532] binder: 7519:7532 got transaction with invalid data ptr [ 1860.585815][ T7532] binder: 7519:7532 transaction failed 29201/-14, size 24-0 line 3180 [ 1860.607625][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000012000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1860.790425][ T7781] binder: 7780:7781 got transaction with invalid data ptr [ 1860.809109][ T7781] binder: 7780:7781 transaction failed 29201/-14, size 24-0 line 3180 [ 1860.837142][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:17 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000018000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000040)) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:17 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) mlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:17 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:17 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) iopl(0x400) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x1) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$UI_BEGIN_FF_UPLOAD(r2, 0xc06855c8, &(0x7f0000000080)={0x8, 0xfffffffffffffffe, {0x51, 0x10000000000000, 0x0, {0xfffffffffffffff7, 0x6}, {0x81, 0x100}, @ramp={0x2, 0xff, {0x5, 0x552, 0xfffffffffffffff9, 0x1}}}, {0x52, 0xda5, 0x4, {0x401, 0x40}, {0x0, 0x9}, @cond=[{0x3f, 0x4, 0x9, 0xc3, 0x8, 0x40}, {0x6, 0x6, 0x973, 0xfffffffffffffff9, 0x3, 0x2}]}}) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000020000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000003f000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000040000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:18 executing program 4: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet6_int(r0, 0x29, 0x4e, &(0x7f0000000040)=0x2, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r1, 0x29, 0xcb, &(0x7f0000000180)=0x5, 0x4) 09:51:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x4000, 0x0) ioctl$TCSETXW(r2, 0x5435, &(0x7f0000000080)={0x3, 0xfffffffffffffff8, [0x2, 0x6, 0x3, 0x600000000000000, 0x81], 0xffff}) 09:51:18 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r0, 0x29, 0x24, &(0x7f0000000180), &(0x7f00000001c0)=0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f0000000140)=0xdc, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0x63a31f5d, @empty, 0x401}, 0x1c) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000048000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:18 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x0, &(0x7f0000000000)=0x800000, 0x4) 09:51:18 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") syz_open_dev$audion(&(0x7f00000003c0)='/dev/audio#\x00', 0x80000000, 0x80) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x1, 0x2) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00') sendmsg$NBD_CMD_STATUS(r2, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0001278fbe9ba574f10b7f0000000c0008008f85ad4f8c939130e76de6f9bf0000000c0005000400000000000000f0d8497e81126c723cc01e6d86b77eb8aaf69550d554212ca12b1473e3b4307aa6710b4feda6827d66d463324082d5d9688d42ed94b62e78ea9160420f4dbe00ef8242542e90b18dcfd1a901f69d697318a60c079508342711b25f43e1557e9d03913d9397994fc492b7a535f70daf2f33d15a75575dc8e94bc64a053624bd0b95383300331bf32f9cfb5fbc8f2183cead151a3932e0a6d657184395dc1e5d4a74b55b4ee5c7b394f66e2ccd00ea12509e0e53e22dd2f8b023"], 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) getsockname$inet(r1, &(0x7f0000000080)={0x2, 0x0, @multicast1}, &(0x7f0000000240)=0x10) ioctl$TUNSETVNETBE(r2, 0x400454de, &(0x7f0000000200)) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000140)='trusted.overlay.origin\x00', &(0x7f0000000380)='y\x00', 0x2, 0x1) [ 1862.547808][ T8666] binder_transaction: 4 callbacks suppressed [ 1862.547819][ T8666] binder: 8659:8666 got transaction with invalid data ptr 09:51:18 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) socketpair(0xf, 0x4, 0xb7b8, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="ac15297bed829392f6388e87f6bda5ad02f571e002fe3ff40f697b50fe5a5547d832239f6e7af11fd2a655a23ba71b2ee5e4d883b5b0339d7d633f819b9351d2b0bf657de9f07ca30f4af444e2ba5b8cc4a83e06226f6e97b5433734965a50bcbf6eaed2542bdcafb8c75b74510efb80b40f8936977a1befba35841e994125a84a9eca6d7ae42cb3556a2a33c5cf6eca090dafb6", 0x94}], 0x1, &(0x7f0000000280)=[{0x90, 0x29, 0x3ff, "91a68094f5958b61c120f04aba5618b9a8fd6e469413d7b4ae88f375cca394d72e0edc03c5074a6a9ddc65f0124ac14b769788947caa8c55d53e89352edc065af3ec42fdab9529ef967e35ab5da63f54605c1dfff4e992d89ee37d62436f337707c01c561f7015bb1e6cb700fba3e4347b52a55156eda6e3a647747c"}, {0x70, 0x84, 0x3, "d20fa55dfb7bb83d63fef4fcb5ffece4b8c56c6c53c64efdbbfc2e8d26ef38b37cc5a21c908911173b2ddb0c8fd69013a58699a99c316383a5a6afeb83003ac0b6a401643285c751c90409a1a769a029a36ca0d0b5c206f2e5aae6"}, {0xd8, 0x12b, 0x1, "73b0dea69de504add31316701430a0ac07e899d4181e226f17ea1750e9e1d0c16dabfa57ef4feab3737a6ad5c19b18bb94eb9b3ad942f1e364ed21cd1ae1835e46b9a22ac29d7ca4dfad7c6d43f320040d41a005da8e27c586a3ca44db7babb34c9f7cfda04b481f5ae32387a58454257df44c87964de377ea53bc7a63286eeaa57bef5ba45605e612825162b8f5798c37201e64670c83be79ed32263ae6848780465d449e8a03bbfa411f8f756f2cf036f3b9c605ac1799f7cef48773879d3b0e"}, {0x68, 0x111, 0x7, "afc67ce449e4f2a5c3515756f9116a220ade1521a059d610869a1890ed81402ed01f2052638cdb0f2afc28a910225abffc4ac1420b5dde34d7c98269d916c1d04551ebbb78831345619e0b1acef42a7722616559"}], 0x240}, 0x10) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000040)={0x0, 0x7, "b71ae4f7e110cf"}, &(0x7f0000000080)=0xf) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00000000c0)={r2, 0x6}, 0x8) [ 1862.599189][ T8666] binder_transaction: 4 callbacks suppressed [ 1862.599207][ T8666] binder: 8659:8666 transaction failed 29201/-14, size 24-0 line 3180 [ 1862.633841][ T3269] binder_release_work: 4 callbacks suppressed [ 1862.633850][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000004c000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1862.876781][ T8940] binder: 8914:8940 got transaction with invalid data ptr [ 1862.904743][ T8940] binder: 8914:8940 transaction failed 29201/-14, size 24-0 line 3180 [ 1862.940766][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000060000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1863.134788][ T9091] binder: 9090:9091 got transaction with invalid data ptr [ 1863.172812][ T9091] binder: 9090:9091 transaction failed 29201/-14, size 24-0 line 3180 [ 1863.201551][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000ff60000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:19 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000140)={0x6, 0x7, 0x0, 0x1, 0x6}) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:19 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x1000, 0x105001) ioctl$VT_DISALLOCATE(r1, 0x5608) [ 1863.419755][ T9230] binder: 9206:9230 got transaction with invalid data ptr [ 1863.427151][ T9230] binder: 9206:9230 transaction failed 29201/-14, size 24-0 line 3180 [ 1863.477788][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:20 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000068000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:20 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:20 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x4880, 0x0) pipe2(&(0x7f00000001c0)={0xffffffffffffffff}, 0x4000) tee(r0, r1, 0x1, 0x2bbc4f1e65872127) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_group_source_req(r2, 0x29, 0x2c, &(0x7f0000000000)={0xd5f9, {{0xa, 0x4e24, 0x20, @local, 0x5}}, {{0xa, 0x4e22, 0x7, @ipv4={[], [], @multicast1}, 0x2}}}, 0x108) setsockopt$inet6_int(r2, 0x29, 0xcb, &(0x7f0000000180), 0x4) getsockopt$inet6_mreq(r2, 0x29, 0x1c, &(0x7f0000006800)={@rand_addr, 0x0}, &(0x7f0000006840)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000006880)={'team0\x00', r3}) syz_mount_image$reiserfs(&(0x7f0000000200)='reiserfs\x00', &(0x7f0000000240)='./file0\x00', 0x5, 0xa, &(0x7f0000001800)=[{&(0x7f0000000280)="27a5b80f208868110c42f6ed3c4d8f1d9afb5dbf49dbc4a1bbd48d29e934ce5dc017520e60d80819f9f6daa0955e1634e6b295bc83af1179f7f48c34636f02be9a871e869eb7bcc815574d68d6f19968a499b122797c43c49973af624934ca8dc40ba30ac8a7", 0x66, 0x9}, {&(0x7f0000000300)="75962606822bc8c14ef453cf9757d6f3819d9d7862cfe5e8fc690140cdba576b748eef14b44a00346f72c7a82f", 0x2d, 0x7f63}, {&(0x7f0000000340)="8fc03f10bf5bc5d036c817d69988a332661f689e7059f6beea48b90b9d7362ab67e437605ba712aa3cac53f7d96052", 0x2f, 0xfffffffffffffffb}, {&(0x7f0000000380)="7b56a187bc70af4409734f5057368987fb250f2fcdbdf15db3dc5d02a1d6ddaff5fc942ec26473a3b75e79bce62fe743bf63e268db0fa9cf2658ad28ea18ef5ab9134d3d22892ce95af923f3484445af71622f0db540dc822fc25a12a37503c1e8b7d6364b137ddb0f2ff9731750695f9969c71574c30f2f36bf50257454df0a61d9b5b424aa02072620a8ff1ecace9c65cadff1724e22b59e42c0ad4ef5460cea374f4a9051ddeebd568f9fcf3e7013a5a96f0aee4101f14647723e6c3fc8ac5cbcdd0427af334ed43e53892a53403cd65d55e94af1159c7ed89bc54f92c56e91e0ad69e2d134809286b637a7fbb3d1398dea6e1f85a1872f63c71b66bffb72a54fe908d50a88732ffec65b29d622e1ce976e0131e02323372cb9cf9ffd0ee1a616f6953307394272c021332a923d1e9e9d3cf30b3ca25f42642487f0bc2f89feb452eacc7158123f51ecd97c7167b0dcc67d2a99c6d3e5936cd57d4d5a36bc935df1b9703ff1d3e73d4a9430cd9cd6b80a454daa0b96995adda0c7c4b8ead26316d0efba2cd22fb89ed05d686b421b57f0f750af826a4be2eac263d3abf4b7d134289f09c45c838da65bbaa32995db6a016b35fd260e619eced087945b72d483a8670a910cc79fa903108895baa89e9df625829dd9d2adcb1702ecfddab58a70a0eb19f4edfcdd43095af5a69223f2e42707b4eb0e99f6cf87da86cefed1a753d72a63d0ef6b8a84996508e9211767e7333efdbc1f0bbde3a2c66f8abcaff3d83ca963741a7952b2f86cc98efbc3df186f2dcd2fbbaa6ca89129bfa48388fb08e75748907f9e4ec6269b84e297cfdac6ab0749c42dc4ab7d3af35eb30b53e3067d4e3a9a490adc58e3bd2cb3d7e231e2a38cbe76629ca4af443fec6a0d7c92d24c3908b11eae4df8d49986f6acfca936457fabfe64fbf88865c6bb7657c5fb2fa42d19dadc6bc44505de0ba8195a661a0142dddfe6478c45e7b9ff30a7eb7e934137b7487a021d919842e7d8fdbb0c3e4abddbcda13bfd5ff92984dc74c4097753aa492ca0e0f8cd731720b7cb771a554f915d6817a39a1f04b6a8ebec9f0d2a34729805c9fd574d5e26aac43f127750c2e218a4d1e1b2d2f6d8d247b1cd7323c43765adef6edffb362bf0c2cbf885512d25f35489b6f82b4ebdbb5c536a54c0c5d8109e633c3df35fc9d0bb5755c288f35577cd3206ceb18e420244de0a7529b0b3dc534da0f3aa44951c35d6ed227a757f801abe6c420912b25c2ac2b88948d839c0c6b0a40e65d178697fa82c1b2f0f3f4444537df1b21c5b89432636fa5e88304b1d56763b4a743f432cdd07a1c2accec7e0adc2ff301a832c66ded6eec30cbbb21dd0b92ec9907be9cdcc7da389d98ee2c3df145cfa315f07a0c2d01e220e397708a0d0f49b305791ef1f901cf96ea35acc97ebc2e390d7ebccac83484e7eef9b22c59b30417bbe59d280c80a0f956a6fbe132a9b261de6bb063714961fb8cd74256b718ab5e27f6d8cef4f6b6a4846d53e809c39f7fe2228ca785669253d471ae15067fa028543634e7f464e7bc77ac31e385a0bc5cee598ce8dfea89ab356266638bd8a6816962b235b45f1a968ae70fc5f0a849670b320d8e4cac55f24d8f39a94111e3a76dc4057eda1d1f875a5687c701d4da08e901ced07a334038757d0c4e2a144174da13e211201fda565d2f478e202f4753dd2f24e80c00e1f10e66910eb8a1ae2ed4736034810b89250ca3214b9756973097ce6f74a5f4fefc2e14000722d0c3093b756b39c6c0664a2ba38db0498585962ebcee9b51abfc027887e37375b30c8c29b800426129e4a915cce816951e017fa7bef00bdff5b4b464db3e9c031bb336804beb8c14452e1dc949b156069d084df665ce251f9c7be159273751f796aad0e1fd9f44193acb9b79bb03284ea86feb82e2f50ed8d7083ed5f7f8d1b90a76aeb78aad8e1044f6b7ccbfaf748eb8f8140e8deddf1cf68b6e1ce5b606a3e06bac26076ecd0691bf384182c7d518c3c6df8323994c1416196d08644ccb8ae11ac6a5e4c7442ca2b2759fe2502cbb153d35950e61c2b882bad5942264119d6ac380b5908c93ba23b839f9101277d2d932d954a72f9bcd25890cb1190e2b9c8da3aeb73fb8e23658f5e2f0725947e63df298b1dfa7dea96ca8f94edd88e523fe3cd98a518acf157dd6c8fee682bf9378c4a4bee015eda15d6aa0543799e3a981b7093e348bc7d618835da291092fd1d2bec936fa48088e066611b549c3be5540500dc70567b726df335626f5e0b61e15cfa85f9eb85778ae22aa852bd75cdb52b02bd1200af19f79c06ed5d1e93b7b7b6c450a77fe2ec78240738f0f06668d2a07101ae75ce2c5c39b1fdb60ddbfda33604ddeb2bef43398f593b9ff97ce44b8ec2b15b80b9da10bd291194a57d26c473df92022dd972ea64de7d7f645ebf561a6969847441611c31945bca3f854c9d6c1cec2c32ec9301015f5c932b96389c680a0ad5a15f9a8dcace36348d0100066969cb08600332586916b6ffcb0836c27a2dcbc93e0d7ee83c30628965ba9146b420a08bf3996cff77ed53f8ff53b5141a7a9282f24a6f92a7277437573314a30b24ed7adb931bcd514a171a2983bf0a4dbfa4e92340ed8f45091b5330a0d43eae67ecaa5a0c96312e1abde0a7966791a91f9605fe129815d4738676d327c6adcd257eac13beae7543e353a047dfc573eb1fc90e5f41263e59009bd40651cf38577fd85d90c6c7f41a4f43702c2c5467514523b7df6d82eff346f4ecd17e666b4a47f0e0ac6e474b93ab889121c00dce2f5f583ddb0fddc256e0aa7876ad494fd85a5248616511cad31262b72aaac452582e7d62180355aff5867888107d237509603c446a63a1fb249b547b0045af11b3d3c8177da3cd5d7fc314db0297ba8995d47eb1e66996aa95967388cb7f903d7fbf7aa8542f3ba883167e54207c804941afc4047baf1cc7237338051a11fbeedef798e909fff9aa2c80523dafa7e69f34d9dc9f660ed7b71fd9f6f4e282e0b70b460d04564b63739ebd09260ba0cef3dcf50e9864d8276ec0d9b600150ec0e21e6009c768911f37aa1d0c643345fcf0607e8e6d8fe8218ca07455380feca6d53933f02ed80234ba297dbfa27c8d0db162d63e0f3c57f7641a9b99b2619e33926e0859f18fc565e4518108a724d978c4937f06d71fc78702c98ed19bdfdf80e9c0d909c7168ec24b7bd0c96f93284efa56351aa9515c3de50831267204f4c9b137babcbcfd44735f243530faf9260a23f046d6f5f1ef8e313cfd427939c2edd4f3ff58f2f24786c73ef160b20e171cfc5a6becac94e8303d08dfa9aaeb5918e9534c856664153ce7965aa7c5061a176558a900f9ec3b5762c0e2801d45e56a61ccffa31aade5f613e881635cae73c994d8abd2019ec34bdb61f1b60879c1b4e96e6e7701e2d36bcf9634110e3329b2cb060bdbe55a845e7082c13736e8f34f4aaf0467b2ae7c776696bcc885d8e32a553c25dd4b3b6e3462d5e75d6638e31fb7d1f9db3c21d56dccd8a1116dda284c00b7ecb46caf3e3aa8c8a5215086ea4c63e35c8e65194506e1026562d8ecaf18d7699836998edd82dd9abe41f59be8909f3f7aecf916d44c302bfc1df7f06b6014f9289a692a4590070aadc652bb06f539824983b105ceb2e412e676b9268211c52f4547ba58041159d9a0a98b5dd269752bd7ce05b0ea9725c48068ba280ece214a8f90efc905116183ebd6a80bb62bcb3920c07d9cba98d725d5bd83b4006e00354bb0898443908caa5b092fdb3eb1495452532730da6bcff2e046d685fa0bf6993372f3b0ff9a8f43ce392b1f2f1890c39ff5e4e4532e8af1d4fee6dece9284248ca4cec0853496408cb0ab08b99a369c492a34969fe1d220df0e690606d7fcaddf913f1549442da58ea1277b9a0a6a61c1b41dfdcf75e5c6d50a559583daade272ca1d4e3ad2a656589d72c49384510b5ac70f9cc298ac5a5960bd83a99af2757e8929500d3966cbc5af7e9624fdce1c531a292e9029e1881355eb2b33cb88b98921a3798dd17b73e4825599a66cd19f380c5d491a4f8c29a3103cb3abcdc0aa45802061edcfa056eaf26caff1bf06db064c8d343d653696b3e5cfcf15d91c111015b16d2aecd5d4684ef745a2d562ff8e3da3d10b0ace7d0b0e1846f83b0bb440ffe80f611773ae9c8a312f9de35f421e9ad708ece731e9ea94404537957039c398e11f3bb6ef6d71f144cc48305f83c8a651b4b7991c17a4e95e1ed24d73e26e4bc8f7e17a42c4d7e8872bbaef456b24e074138018da61b79dd5512d6511763da60ea25c3ff7a6fe0bf248e5ce8ab24924789ac5a168621edd7655eee8c076e9a5027ed0256e94b8c099a0a3616bec51bbabfebdd91107dd3289a7e225b5bbd1c0c9686939f186aa63dcd57896aee447ef3ae87f6ed4e1d6bc6f04b17dd66ad6d29a3bccf7ea4b6a99ac24444a0d3a973f96f4ad1dfb9d74e2e3d80f05b92f756f77d3c44470e45d05a0d6c44f5b6695c21b801f0ffebc4b227479566804a7474996a7e364e46f27966ceab06d67e28346afd3a787dcf31756b33ffebe2deed20e63dd1a4d6a1cc0929ff67102ce90fa40359cb813dcc42af4a6453b4865aa34522b954443437821d3c59dcf1ba2c536957ba262b16c220bad6d8236b08979de179173ae0f5ba89be2bd0569be28b06b218a62d0e731cba5e5e9c1da69f2165618e5fdce5ce2f513cae62ff025840aa11d3ca15fa3464da221c6a0779f0e4b7d91d1f443eb7fa0a905ae23b14c877770efbd99de4effc691fff95fb0257921ae643d75bb26c42c7e4880028802883031e66e5dd4785243ac281c55be37c08cc4c090a42d14e8c04cf27808d6de210c499f9e07fca6cc83394931d3a14c08e487383ba8519b82e33ea1bb1ae528083db4a592b0f7708e877f634a17b87018ad63a3a79ca247dec7e68405a4ff059a343b6043a14251e41d018f62b5cf8d14dea6abad60888de74412213a491a9d48f3e8d723369f13c14e87391abed9dbcfe3c51ea5dcbad66009ad3cdd0a6595f3a713b5207d5adff9463ddb27f49adaf7ec494d41c618c054a3bdeab132f13aecbbbda8cc9c96eb7387de71e8b87d6307f35569141e1ca2681d352a4c8190bd0b332cf1a4510d1d4c363d7f56dc89c2c2c41d7e911ad9d5f5fdd28347de2e3ad8c24626ff02172389e30af59e6feb497971d634643f83420d0a0346c8c0b72a2311476fbf4e7e3e1cc6f3d6995a2e8b9af3cc13070841ee2d76e7161ea96a50304fd4c221bb16257c58a0ada56c98bc92de0f4fe05ea8e1bcf9202b888e62c5abafecfa9755ba9ee452aaca5c15aab9340fa4b23308e5b2364123a16526042bf4a9a0c12ccc6f874a3367869b90b11f448f3d7e7f079a8482e8e5f324ca2c41bd522975f14c6397ca775f607cdcc99384c5b677923bcbc5fbb9d9dcd198f7696af12c7ee9f9d9f4847e97642fec7a57e4200de83d10e0d964955aa40fb8d320293d88d10c77cf89c573caa2ac83321936e94bbd65526169c6e818fb84bf9ab2732ee5a8e161010aa19ae2bc45224721512edb2b24cd5efa189cadf0258f9570541a8f12d5c4e2c98fb02bcae64060c575a1a319640239fddfc6cba1f94ba7b5030ae28aace55641b5be75e076cfcfe371dfb41137dce1db52fba121b02e6f21edc3c47dadb5d7fa2569213d8146c52351706f7d9ec569a25f314522d232f4ccc57eae43ba2faeb236708b557407720c107be2dc6a7e68f16a88", 0x1000, 0x5}, {&(0x7f0000001380)="f934cf2f7677290b024c2f0bdc3b44ee21f6d1129494415eb0fb65057ce163c8c025f918d48dafe3fc493b91a1260c48119ddade7287c13997a0d2ad4989c34bccf8311edd23a127ebcf7462e993a303ef5b2eaec64e2f9273b0a8ad", 0x5c, 0x2}, {&(0x7f0000001400)="3ac0315baf03c340ef1e9a919ebd7b266ffa2255ad5f8594ee375c34dc0ed7a7c8bab9d281f70d96a9a2f29c63aa84a430f2664be6c5da784b76fe6bf9a192476a712086341c45217e830e6a79218973a485bb4c3f8742bdbea40aa7a6b705b3134f006abe5cf03f909c77e9", 0x6c, 0x5}, {&(0x7f0000001480)="e40529afeafe3870e93599df2fcb1c0486695207df7d00be8ebf9291b64bfb1edb281e86a9fedf57a25be43d049780a4e4490a367a90393d4b986c49142ed75733222c2ed4be6ea2e6f3db1b8e26cc327994097b577aaf3516736c725801fe87c3f1069dae6195cc1ab6e8d3caa74df9d1f5a11e3c635e68ce52884b7738b961a68a0ddff33f8e2a51f62d644d7b125e18a6f2d42c8477a69eea77c130a706852c1589e095d9e7880483cb3b652049eea7d445c4b480698e4154eaf614b8a8941d68dc9b1d4f7cc31cd9ec7b911b007c2cbeb16886fc7d8f3454445ef899ccdae76e4d17c9e1183581985fc96ad5a68f5de6224387df06", 0xf7, 0x10000000000}, {&(0x7f0000001580)="18066b4d16ce260ccc0322d6cded9ff9879431f3952b5efee68ad8b24332041ae34c34f4012a24b6c198a11d3d9ba13dd39a9efefc79cec2c88110f575e0785cf6dfea2be6a8ff5b2b", 0x49, 0x9}, {&(0x7f0000001600)="7c9c446aaf1a8491f4576358b953906f91aad92b4d8a6e7bfa9422b02c88b0b0bd337c5c12b5d3a2dc9698c53d480f3f645ac9c4c0bd1c18c4c886577aedafe26da8d63dead07ad31972ecfe77e10f54bdc9a257d9a866db6e5e1071d90534b668285ec5713600f3d01520a61ad7a80b283e751771fd0a2cda0e4d1b15f2dc4abc093750fd07e320c70b351b29576a2f0e9f6f59159815a3507ef2b099b8cb2889ea328e07e87baad43f14863964f7fb3dbd6bb632be3c3aa26aad29abe43a45ca101402f6b9c1c2707688c607c054ebdf4c", 0xd2, 0x3}, {&(0x7f0000001700)="871d1f1db5528a4f0091557284388e2fe22114c2c357ed7c5adc5cbda18376697f87c309c4e0e31a53d02abc8220e8eeee0785a726c1ead8a64b2f68e88b6dc68e369324d65816d8e4b2b8a94e48fd3a8d25d9fb28a68bd9dbb9265bf10d76fdc0d49c5cbeedf3896e904354fafb68b031119b855245e3059ad7aafb587261c7f58e7a25431489e8c644f9d288dd7c4edbd06972d78cf8a86fc60c2707021ba9b8e9ea4d68d07900ca5db17ad065d87e6259c453ce5383d4c9e92b908c313416f47083963bb682d600739bde8c3eb38dc83f23589f3ef73d13cac767ef70802da07b79a783539ed0828120379b4d7e8f8c61c2e2547858", 0xf7, 0xffffffffffff86a1}], 0x22010, &(0x7f0000001900)={[{@balloc_hashed_reloc='block-allocator=hashed_relocation'}, {@hash_tea='hash=tea'}, {@resize={'resize', 0x3d, 0x100000000}}, {@balloc_border='block-allocator=border'}, {@replayonly='replayonly'}], [{@obj_role={'obj_role', 0x3d, '-securitycpuset.keyring'}}, {@obj_role={'obj_role', 0x3d, 'GPLsecurity*'}}, {@seclabel='seclabel'}]}) 09:51:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r2, 0x4010ae68, &(0x7f0000000080)={0x5000}) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1863.994755][ T9614] binder: 9609:9614 got transaction with invalid data ptr 09:51:20 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x0, 0x10000) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e21, 0xffffffff, @mcast1, 0xc16b}}, 0x1, 0x1b, 0x400, 0x5}, &(0x7f0000000100)=0x98) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000140)={r2, 0x33, "c1f192844104d810718bfdf12388492b24cbd8c2fba9dfb1427e26335da734d4ca8e1d6f97e92aa005bad4b203b1c12caa06d4"}, &(0x7f00000001c0)=0x3b) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:20 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer\x00', 0x90800, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000380)={&(0x7f0000fff000/0x1000)=nil, 0x9, 0x5, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x100000001}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f00000001c0)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) getsockopt$inet_dccp_int(r0, 0x21, 0x10, &(0x7f00000003c0), &(0x7f0000000400)=0x4) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r1, r2) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@empty}}, {{@in6}, 0x0, @in=@dev}}, &(0x7f0000000300)=0xe8) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000340), 0x102d1d) clone(0x4000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r3, 0x84, 0xc, &(0x7f0000000140), &(0x7f0000000180)=0x4) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1864.054915][ T9614] binder: 9609:9614 transaction failed 29201/-14, size 24-0 line 3180 [ 1864.117038][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000006c000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1864.465073][ T9835] binder: 9834:9835 got transaction with invalid data ptr [ 1864.493607][ T9835] binder: 9834:9835 transaction failed 29201/-14, size 24-0 line 3180 [ 1864.518240][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000074000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1864.759208][ T9937] binder: 9936:9937 got transaction with invalid data ptr [ 1864.787715][ T9937] binder: 9936:9937 transaction failed 29201/-14, size 24-0 line 3180 [ 1864.829940][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:21 executing program 4: r0 = creat(&(0x7f0000000140)='./file0\x00', 0x8) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000200)={0x6, &(0x7f00000001c0)=[{0x7, 0xd6, 0xdc, 0x8000}, {0x8, 0x8000, 0x0, 0x2}, {0x10000, 0x0, 0x400, 0x7f}, {0x3f, 0x1, 0xfffffffffffffff7, 0x9}, {0x0, 0x9, 0xa602, 0x9}, {0xffff, 0x6, 0x1f, 0xee}]}) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x3, 0x0) fcntl$setflags(r0, 0x2, 0x1) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0x6, 0x5, 0x2, 0xff}, {0x1f, 0x5a6, 0x8, 0x81}]}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f00000000c0)=""/128) setsockopt$inet6_int(r1, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000040)={0x3, 0x6d, "ada8475cc2522cc71e49f0de9a2e27accba618eda1e032d9beb1baa89b9f562794baffbf82e67e1cc0b6ecbbc392860ef1142120bc1782fa52a299c94eb3b8a1eb5e73b12d6bd912815821c7c661eeb0270f2b4b228e6792932494b8e7814167327c843f07ba1a1ed7046477dd"}) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000007a000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1865.099432][T10253] binder: 10234:10253 got transaction with invalid data ptr [ 1865.144069][T10253] binder: 10234:10253 transaction failed 29201/-14, size 24-0 line 3180 [ 1865.165833][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:21 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:21 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000100)=0x400100000001, 0x1) r1 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x902, 0x0) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000240)={0x2, 0x6ff3a823, 0x3ff, 0x8}) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$DRM_IOCTL_INFO_BUFS(r1, 0xc0106418, &(0x7f0000000040)={0x52f, 0xe2b8, 0x6, 0x9, 0x19, 0x80}) r3 = dup2(r0, r2) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000000280)=[@in={0x2, 0x4e23, @multicast2}, @in6={0xa, 0x4e24, 0x6, @mcast2, 0xaee6}, @in={0x2, 0x4e24, @broadcast}, @in={0x2, 0x4e23, @broadcast}, @in={0x2, 0x4e24, @remote}, @in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e22, @broadcast}, @in={0x2, 0x4e24, @multicast2}], 0x8c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x0, 0x0, &(0x7f00000000c0)=0xfffffffffffffcbf) syz_execute_func(&(0x7f0000000480)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f61964dc800010000238fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000c4437d05fd5cc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") bind(r3, &(0x7f0000000140)=@x25={0x9, @remote={[], 0x0}}, 0x80) socket$inet(0x2, 0x4, 0x5) 09:51:21 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:21 executing program 4: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f0000000000)={0x0, 0x8e, "463af714c3831a468ae6a1fc45084272fd4b1087366b69a93859550e5727cf0e4b94b4c857cc6eeeb51c3545200d7c4f2ceff2930fb433632e75b4be69437f3313f3608c6c70f78e96abbdf7630ed76f7eb531da0b1c97415b548ebad5d247dc904be458958ae2b01ae02a7849bf51acde554f9ad7f1d684c39a43d9d47b815f807266105cbe04ed09b831163b1b"}, &(0x7f00000000c0)=0x96) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0xffff, 0x80000001, 0x0, 0x0, 0x0, 0x1, 0x1, 0x80000001, r1}, 0x20) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r2, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000094000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0xffffffffffffffe2) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:21 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = dup(r0) ioctl$SG_GET_VERSION_NUM(r1, 0x2282, &(0x7f0000000040)) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) getpgid(r2) [ 1865.441237][T10367] binder: 10360:10367 got transaction with invalid data ptr 09:51:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) dup(r0) [ 1865.509426][T10367] binder: 10360:10367 transaction failed 29201/-14, size 24-0 line 3180 [ 1865.534647][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000400000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1865.802030][T10606] binder: 10597:10606 got transaction with invalid data ptr [ 1865.825003][T10606] binder: 10597:10606 transaction failed 29201/-14, size 24-0 line 3180 [ 1865.865608][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000071500000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:22 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = syz_open_dev$radio(&(0x7f0000000140)='/dev/radio#\x00', 0x1, 0x2) ioctl$sock_inet6_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000d0500000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x18, 0x0, &(0x7f0000000080)=0xffffffffffffff1d) 09:51:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000c0700000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:22 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000180)=0xfff, 0x4) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000040)=@buf={0x1a, &(0x7f0000000000)="8217d526518e7d4acede1e63392b22f66cdafad12814dff9ce79"}) r1 = getgid() setgid(r1) prctl$PR_SET_ENDIAN(0x14, 0x0) setgroups(0x2, &(0x7f0000000080)=[r1, r1]) r2 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0xffffffffffffff7f, 0x10000) ioctl$PPPIOCSMRU1(r2, 0x40047452, &(0x7f0000000100)=0x9) 09:51:22 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:22 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:22 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) ioctl$SG_SET_RESERVED_SIZE(r2, 0x2275, &(0x7f0000000140)=0x81) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000050710000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) r2 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x8, 0x0) ioctl$TIOCEXCL(r2, 0x540c) 09:51:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000740000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000940000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:23 executing program 4: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000600)='/dev/qat_adf_ctl\x00', 0x200080, 0x0) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000070c00000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x2, 0x0) ioctl$PIO_FONTX(r2, 0x4b6c, &(0x7f0000000080)="5b4b8329eb064a6693b1b813978c0a4c72545ce12b1bb5b3a5020ead7c838be0d5688f143e740a2e285c4d4847efac453a3d6055baa501e4c215f39046e12f05970762367c6df6aed9331de29008859f1edac97e400a061e103580beb5a58ecbb1a664168016ec599e30174c330d11f90695040cbf15d68a6d203ff07e2cbbc7800341a2d6f95d94cd196d69d106c09bf7e289bf344fa82cca3571e1d8ed908ff5619c9b3dd9c7aa1d075e2728d1b2f6d20e3fec695d3ce7f8c3fad8fc3fe7ad295c5aad41b4ca0f22bd744187b84f8e9259d33766ee4bd7d1cf7fe41a62904a4fc25d022e244b23e0013538b98894e44a3aee3d7809e5a8ddf2edf772004e038308d1ff9addad82be71f406207cc5a9377584b60a92dda27fd6479532f5d77f01cda241a9deb0ac22d1cf0f978ed429ef294bbce737252ddb7f6ab871e35500e3e541af6c48741f76c08f4a5917dad34811842e6b6425a3f217c5a32dcb83d6a5c95ddd227d59321708781b36ddeccfd45beb1153a9d58cca6e37774452cf1a5d801a91a46039cdacdbcee737daef0ef447218b93b4938bbc79e51482bfa8a0cdd1a03a7adceb4882f2ca2ce19870760d11225287f99c59302cf87249498ec979cd60e28633acf09f9aae584cae6d53863bdeb2ce097b2bfed3e5846cd2daddf625edf7cc1ed5cc183802fb695a6a4a646d996266a501d0ac2ec179a9c3c7ecf4beb9ba191df25be4b5ffaa9ccbfb1aaca37ab41fa809cd8d8be00649a779174847cac0a29e8157a2c6ed18e8e8adff8e3f6910e797c7a4322c5887490681b14f43568db0f35acd169ccdacfbdf2e2ad1af642a2d520b8757ecbe88415539351ecc3b7034b6cbb855aa2a5d2f3717f62a01aa88f8d831fe3426b5f49fc2bec237636f2a865dd7fee818b67e66f1980958bdd5d436a545fbe29f6b15c966df8615567e9ef989636dbfd95c761c085ec67a9750e04480fbfb7e03b080d17064211d7228a36974523b8a48782c7f5a42955f7dda1ff75cbe1911df8a2d850775ed56c8deb5ac2b9d48456b3cb78a2c6ed2bf7fe42247744aa0028a1adbe9f9e95fac0109d63b2e4f1fd70a56ea4b5bba99fa34aa22175604eb1ede8dfbea847824770650bc69eab82b8b01cd67be98360c711b7f30afee76532721aa077b7833fcc2eb41973533baa8a66864120fdeeacceb3d80cf96969c38bf03943fad49e2b232a2aeff08dad5c9f94cf3df0407ff71aba382460211584a8f9d405d5206b719c3cd425367a98454d003364c8373ebadeb82205761ab8bb37e52d02761bcf17bef996d411dabc5bcbc71eac52ca33928989a85ea021e2d5584857c8941a0df038fd774725e9eb21304f71ee75dbe3f387d09847b4c3f011daac1bfbd7e4f759f157a0e7e8031296af5dfc6c20774156a357854716940b75ac12a7fbf7632cd3ba360b95eff32bdcd92ccb6fb735970f771ce5391d0d887804bd07d9f33d92533675b163056c346a485cd37d9a957d8ff6055b91ec6e416b7fe7086393999762c315e124b4e85ba8f8b2a1d1462e5c3986a5b4ea83c370466d668e20dd5d7cadf8aa5f89aec88f180edbeae310ba8638f56ad57cea811a86255d9523c867e1e47b8756425e58469fb107cb52945000645582cde2aea2e4db780288a7f5305253bf04110d14abc79a1504bffcb0790e6c22b54c49b9428321ca97bfa2b1b66d958f5d40abaa1cdd78200afe2acc1599609043a606d4b8f9de739baebbea91c80779cec330ad9243de935613f26ae1658ce5deb4e4424c62d0b0a61f48f28e7fb2bc1b4174dfbccae77331ea09cc8d5f947d3f341fedffa2e3bd0434c886cd77a8d6a9a72bd05231412c9c4fcfdfa756f84b0417a0e8d14dd578310fabce11f452fc83f0a654a642c5b233b281066a86b36ac168159c09926bd19a505060d4c456f9973328ad68c57dc712d522d698f71c51335c80ff0f173105f7bba98b584ccda95a76ac0b8603c3364224011d5bc8a8f6238a613135bd7911cbb8430a179fcc8319ac4135ea4d6f41fe53a9a5e3dd111797011a667e7f438a5e48bac15ea431964d953cc7669f12b689c5afe321ad785fb781a0dccf918671f410c35b2797359d7478dc716d0e46deb6f066f3295c96bfabd4494b665d7bb3c0588a1e29f924867ca2d6befe982e97df4262133621094c5469f196c282233fcafa8e23ca7d8891f4766a09d920d3332ef2aaa46ab10f897ee15befc0740bed388827b4c701584febfc0fb3fb67ed23749d20230f7897aa81cb174a602beee85a2fb9f4333e40f976575808c7e67b88ad0a1795f7e43b73eed0502625e0da3aceecc86078ec2d82129661ed23795f9de965564f08e832d304fc630a5ce183ba4ea5c7aaa4ce9bcee7584f499ceea63bb3ad0e616641167247f43004b620bad5c02f31072281c5cb6710afd2f5868e2f754159654787999c7bca8fbdd1ecb4704bbd8e07c516290fb5f9dff9136f429e3d56a5235b9becb86b57178f56487649676ef597457d0b9ad0a8e8e502f0728063bd19032c962bd9c2b66c19421052b64771f41870dbb0569cf0140e744ab22e2de5b693cd2b1ddc37fb5b22f3a7947ed1eadd4c6c623ade4caf8efe339f0751f13af3092a43e72704d03e4c16cc289332cd9fbea2c224a2fbf6aac415479f10d263ec3743d7ab703d864547bbbb937fcd7590d51da0cad51b0aa0b267770d668a9ebc6fc7613731a9c38f332b08f190ad952368435bd4c6c3bb51194d12a3b77cdfbc222168295d26fcf458dbf8c0409c141dd325bd4abdb5609198da23e7cdaae2f5c9fe3ee30917e80fbeea369c75eb1edcb1a21530f41317c615c1a522f6944ccae9d07e0c5c8a173b15b69c711e568050bcc3281f0664ac9d01dcc58a749d1114d9745684a2abeb0f5764568ac0c92e8e67a75e3c797f0f7dc2b864d6ec7be76525c5f93b67d84ddce3900abcb63ef140ee2af2c88245146cb8213a764b6f38ddf6990321d6a295eaf54bbf52c7ba8b592d024eda53d9eb9f3ce4356407d5a4e0d5efbc1e891ced9d6d4638775a1b5087a6a4cc79aff6a7801e688eeec2726819fb961d2a39b676fa6126636445fea24373611fb1232da9777aab182c762dddc832d0daf65681daf5b1352c0b0dd726c3ff5062519fb48f05bc3f57816d5ab3aa05b76131298e0596c789a46eb6ba63537eb61bb1059f79d5333849c475db316dd599e4e845e0761212f7455f71ac5bf77fa86c3cf3a4d960c7f46cd834cb54f1c70dd99a56fa94b1532287ab4a93ce18376b4a11fbb35bcdf4ede27600122283d5ff40faa833fecd5faf7cd5129a09ff2a3beef8f161b846f042e298fa0ce4249c7a17ab23e96c93c300a783ddaa64d02373a4ae027f9b8afdf5be3fc684c38e85b33e289d1a3604e15d46ebab79d9cd51b19002ab7930ec01a7f866a54fc1e444d1b298a19b41ca83c60d0db0bd4fb4866dd0eb76d945652df02dc55580e1bb6dc74846c6035bf58e46c3ab6f33cd8c6af5058de24d3c9f0b08c44cdd61c36e07c6fbe28f2609c6b177d2c74ed2eb98b7b682364c342eb7fe3e971ae94566d31aefed5d5ac92ebcf03c29da620afea9a1217eababf1418f6f35ab0cdc41587e28e7c1b963f0a9224cc0c4bd6448d928178448875fc79c3d9b771a55563d999806665e4339e3c31aa83b7a58512eeee425eb30350db00a048ef4d273796f64e3cf98483b8318accdfd8cc400ef7a6da0e7b4891e1fd0866e60988b1c20eebf3e5489f84749fd7ee2ef44808f08e5132b35d3efa7979c8808bd4624335792deff834afd07eae956148c0c64ae95a680b01f379a44ddc60809ebce3c487cf99b465d899fa78e0cc44ab0ed52f58fe0da0ebdbc91ac10a1a298d9b3bacb710414a37c17038eaadfda99e543802e582de97a02c430abd926b6183f4056a549b6fce73ed4e0bbfcb32e8fde6192dd099b88ea442a91107b043099580868a0084fc3317a8c27c53d86f702b49b40a8e4030547ce8b39616de2f665619442220827f2eeef88b56215555e63b73fe5c10fc981084e221753e2b3b90642f1ffe033928cb48e0ad3762573d22d0bd454441fd556e48c2bd54be05c7974c26a64f8cc346c24aec15ee018a481d980f833d5bfef06e6a99eabf40aa5bb73c0c1ba80913b68e92a76de97eb9669e7a82a1b46dd5182092b6243ee69933046677ea55ebb89cb1d2a36e2be2e3a69db0a935219f2d1d9beb9f22792272997b2306f1d198a437f5fc1fbe53eb656a683f620af56454ac176650c29bf07ebbbec41edaa356e2a123e5bc56ce2371af149ee3c4e1752996b73550fb0678542285c800c36f85deb46f6a18c715723c6f9cee02bb3c7d3d5cc3e36801a0a126a26020b88d82e0aa7610d0eca6dc89777a9a7dd446b8104f3b0baa561cef196340d5ca24e5acf06769c9be83b7f721d0160b9427ccc61fb223c3dd5fcb68f7767033162b6d1308568437fcc5de5493c898eb6358717c941a56c83a8f748aea7b4d21d509b5d9a0359870d5cf7d1d5d7cdb063af4b2a1baf801f9ed45aabec47e5aae8ec8aad84a6324541a173adc6f716612dc32b7f84c9192aa2d1b344f29eb4a8da6385bf7308b2102e38b249719fa60c76f6c0fe15fe9d7eb533b1938cdb4e5f53ca1a5406e9244a54c1520404985df047f8b69c4fdbeeda3165e60a4ab84f14ed081a74bb10fddfb90ce4b74e74498cd939d2f1b6e937fa04b3433881f8c66fd3829ae724dbf87948553a1eb4d9fd040b459ba7305bf42173c14f6646ff4d8fd8f833e9a537f1eaef8f862dbbb4c4c3ebbe352b546a9f50d0c6895bea765daac8c1ab1cc4a1be63b6b9fdc1e4066e69b7dca35fb5338ab0120b05cf532c32eee04a77b92ff144845c0c5e696e040618895d366c6d539461d53f644bb48990d3f355af2b5dae3c449da9a7c0d1601a12a6cd30cebd5a0d26c17d86bf9e13708b339828244bc9354dc96430936da7108e29d2a76b6f620fa8b9ccd4a644174b19dd48b1419f416776992c12498f133526078dd55121687b2d75b705407da7d89467b69e0547c9970c046858a43885121a2f705a34778ceaac99ab3486de680bfbcd4856fc8bfa6887bbf09871fee8af4a560421f13c7fad6ede447ef9169095e955f8efc1055a6e227d393e21ad51e0877e15364b4c3e93753fff3ffda2fddd2143e7e53d793fa195f26d37e07fb1701c9ae47572e09a7dfc9a36c407e44e2c707540a4c16a6c9487ceec78ce56cad5dacc34b5f8be23a1ff29cdcb500f921152bad7a80572d3e0305a00aed668c5fa4a16601211168fda6a1a9a50273838635b755dae714425ad7ce32f52cfec17a226b0baaff175e125c8e6b0bcef4b12793ddec520317eb8e91cf5a1aeba8e11d7aec91862ccf11f60f65af3d7fe8164be2e02822b6a0763adbcdee964cc378418f667932622de60e449edb7ad5b32ed2dfc8db52fdd4d299d18e55bf4b616747472f28e366ceb19791dcb6d84155d3d47f304705838ea50b9f230305883917490ddd20c853f9cf4349f98634378d9fc76cd9f8889e16c3a1e5c7224a68e61fc8aa65b26e99c26a139a6594595c9e9361153af25dbaa5ee913c641d44588e1e15237b600e7d51d5e9e18590e52bfbd945abed2f01e5b30a00e917ebfeb8704c455fd10fff30c601224c106d36c995cb660b30bb18ce6c2d4e38114186c343da6a22b2818bd63a4ded5cf87f8eeb5ec1f0692713863dff2ca6581d5451a1ae3412b029b15318d85032abe4c69fd53441") [ 1867.691819][T11917] binder_transaction: 6 callbacks suppressed [ 1867.691829][T11917] binder: 11913:11917 got transaction with invalid data ptr 09:51:23 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f0000000100)={@initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x21}}, 0x8) getsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000300), &(0x7f0000000340)=0x4a921e08e4a18dd7) r1 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x1, 0x2) write$P9_RWALK(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="3000040800000000008003000000007e82040826a171760000000000000000be05fffa00492d58261c1f236384f2b27b9ee13d5da431aa451754374cefb4056293e68fc3b16996a3055877ea8f029fce1c1f"], 0x30) r2 = socket$inet(0x2, 0x4000000000000000, 0x0) accept4$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000240)=0x14, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000140)={0x200, 0x3, 0x100, 0x7, 0xfff, 0x5}) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) ioctl$sock_inet_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f00000001c0)) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000040)={{0x32, @multicast2, 0x4e22, 0x2, 'lc\x00', 0x2, 0x59f, 0x32}, {@loopback, 0x4e24, 0x2000, 0x800, 0x4, 0x1c}}, 0x44) write$P9_RREADLINK(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="10000400170100075f0e7486070000000000000066696c6530"], 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000380)={0xf, 0x8, 0xfa00, {r3}}, 0x10) ioctl$VIDIOC_S_AUDIO(r1, 0x40345622, &(0x7f0000000440)={0x8, "c9b3c0c4bc03e8de463b7b96bfcf656fd624585f6353a3387bcbc9ea5fadd612", 0x2, 0x1}) 09:51:24 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x40, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@mcast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f00000002c0)=0xe8) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000300)={{{@in6=@mcast2, @in6=@mcast2, 0x4e20, 0x0, 0x4e21, 0xffffffff, 0x2, 0xa0, 0x0, 0x3b, r1, r2}, {0xffffffff, 0xfff, 0x90, 0x4, 0x5, 0x0, 0x8}, {0x8001, 0x0, 0x8, 0x6}, 0x7, 0x6e6bbe, 0x1, 0x1, 0x1, 0x3}, {{@in=@local, 0x4d5, 0x2b}, 0x2, @in6=@remote, 0x0, 0x7, 0x3, 0x7fff, 0x6, 0x6, 0x4}}, 0xe8) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r3, 0x29, 0xcb, &(0x7f0000000000)=0xa857, 0x4) fsetxattr$trusted_overlay_opaque(r3, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x1) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000100)='syzkaller1\x00') [ 1867.777690][T11917] binder_transaction: 6 callbacks suppressed [ 1867.777721][T11917] binder: 11913:11917 transaction failed 29201/-14, size 24-0 line 3180 [ 1867.839147][ T3269] binder_release_work: 6 callbacks suppressed [ 1867.839156][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 [ 1867.944730][T12004] IPVS: set_ctl: invalid protocol: 50 224.0.0.2:20002 09:51:24 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:24 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:24 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = syz_open_dev$radio(&(0x7f0000000140)='/dev/radio#\x00', 0x1, 0x2) ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000180)=""/77) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000280)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r3, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, r4, 0x10, 0x70bd27, 0x25dfdbff, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x200000d0}, 0x4c041) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f0000000380)) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:24 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/udmabuf\x00', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x10000, 0x92) ioctl$SG_GET_LOW_DMA(r1, 0x227a, &(0x7f0000000080)) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000050d00000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:24 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x1, 0x244140) write$sndseq(r0, &(0x7f0000000140), 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x10000, 0x5a) ioctl$SIOCAX25CTLCON(r2, 0x89e8, &(0x7f0000000080)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @bcast, 0x6, 0xfffffffffffffff9, 0x1, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) syncfs(r1) getsockopt$inet_buf(r3, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f0000000140)={{0x1000, 0x10f000, 0x8, 0x0, 0x100000001, 0x3, 0xe2c6, 0x1000, 0x80, 0x1, 0x101, 0x3}, {0x100004, 0x10000, 0x10, 0x80000000, 0x81000000000, 0x9, 0x8000, 0x7f, 0x7, 0x6, 0xffff, 0xff}, {0x106000, 0x3000, 0xf, 0x100, 0x3ff, 0xd535, 0x1, 0xffffffffffffff00, 0x5, 0x3, 0x800, 0xffffffff}, {0x2, 0x1000, 0xf, 0x5, 0x5, 0x6, 0x6, 0x2, 0x1000, 0x4, 0x1, 0xfffffffffffffff9}, {0x4000, 0x1000, 0xf, 0x9, 0x1, 0x5, 0x5, 0x8, 0x6, 0xff, 0x9, 0x8000}, {0x100000, 0x1000, 0x9, 0x7fffffff, 0xaa, 0x6, 0x40000000000, 0x800, 0x81, 0x7, 0x1, 0x3}, {0x100000, 0x104000, 0x8, 0xffff, 0x3ff, 0x1, 0xd6, 0x800, 0x1, 0x9, 0xa00, 0x10000}, {0x2, 0x10f000, 0xa, 0x4, 0x5, 0x2, 0x5, 0x7, 0xfd, 0x81, 0x9cf, 0xfae}, {0x113000, 0x1f000}, {0x0, 0xf006}, 0x20, 0x0, 0x5000, 0x40000, 0x1, 0x800, 0x6000, [0x800, 0x9, 0xfffffffffffffffe, 0x2]}) [ 1868.259264][T12047] binder: 12042:12047 got transaction with invalid data ptr [ 1868.270436][T12047] binder: 12042:12047 transaction failed 29201/-14, size 24-0 line 3180 09:51:24 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$unix(0x1, 0x7, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x0, 0x2) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1868.346159][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000100000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1868.570572][T12360] binder: 12357:12360 got transaction with invalid data ptr [ 1868.596591][T12360] binder: 12357:12360 transaction failed 29201/-14, size 24-0 line 3180 [ 1868.637875][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000200000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1868.854016][T12464] binder: 12463:12464 got transaction with invalid data ptr [ 1868.876195][T12464] binder: 12463:12464 transaction failed 29201/-14, size 24-0 line 3180 [ 1868.911824][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000300000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x8) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1869.127645][T12655] binder: 12605:12655 got transaction with invalid data ptr [ 1869.167087][T12655] binder: 12605:12655 transaction failed 29201/-14, size 24-0 line 3180 09:51:25 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x80, 0x0) getsockopt$inet_mreq(r1, 0x0, 0x27, &(0x7f0000000040)={@broadcast, @dev}, &(0x7f0000000080)=0x8) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) [ 1869.206197][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:25 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f0000000080)='./file0\x00', 0x8, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000400000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:25 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:25 executing program 4: lsetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'system.', '\x00'}, &(0x7f0000000080)='\x00', 0x1, 0x1) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0xc00c0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000001840)={0x7ff, 0xa, 0x5, 0x8, 0x0}, &(0x7f0000001880)=0x10) r2 = semget$private(0x0, 0x1, 0x0) semctl$SEM_INFO(r2, 0x4, 0x13, &(0x7f0000003800)=""/215) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f00000018c0)={0x0, 0x2, 0x1f}, &(0x7f0000001900)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001940)={0x0, 0x100000001, 0x3, 0x7fff}, &(0x7f0000001980)=0x10) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000003300)={0x0, 0x8, 0x30, 0x8000, 0x4e2d}, &(0x7f0000003340)=0x18) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000003400)={0x0, 0x58, &(0x7f0000003380)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x4e23, 0x2, @loopback, 0x3}, @in6={0xa, 0x4e20, 0x9, @remote, 0x1}, @in={0x2, 0x4e20, @loopback}]}, &(0x7f0000003440)=0x10) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000003480)={0x0}, &(0x7f00000034c0)=0x8) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000003500)={0x0, @in6={{0xa, 0x4e23, 0x100000001, @empty, 0xff}}}, &(0x7f00000035c0)=0x84) sendmmsg$inet_sctp(r0, &(0x7f00000036c0)=[{&(0x7f0000000100)=@in={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000000140)=[{&(0x7f00000001c0)="dcf0d76d55b0a2c76725613b5e45689144a470902b8b8af4c6192295afc3f0a10ddea3502db902701a12541ef6ba16970b90bb98763c4a22215079a6e13796e6cccb7f2fe39204549d1d18cc2b18a7c0e8763e2f1ba96834b7212ded8add7d0e58673925669df93856fd1e84393262d2396a05e395401e09b6df039f8a4800adc49dc748517762c7c47be3334dee72af35877f2baee75e3b322a3a0e7f82a31a08017da4c786eb5126941b2ee9ff73ecfebcb386f5ff5f0b3eee63bf6cff8a2a64bd216b4ca6dbc2d1e96ac36dbed031c0cdb369648e0b1a27bc0e2093752c", 0xdf}, {&(0x7f00000002c0)="f7f7f82b193c1d8461e3afb4fa904cc6d0b2e5aa76a612b1471ee67d339d06b9cc386ef25170fbb979e43c887676469460a9189bbb10b4ec06ae230b6bdb034af0ea91e882d11c0c8555790f989c9adc96be1da3", 0x54}], 0x2, 0x0, 0x0, 0x10}, {&(0x7f0000000340)=@in={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f00000017c0)=[{&(0x7f0000000380)="a07d673e2e568d7481175eb56f61d88593c69f582c24e60c13a86442419d99e955c3a5467ab89cd479a74acad52fa27e24fee537c69dd6ee4c6405ee647e4fc87bd9f767e6ad264cc2c93bd65d6ddaa5b9a1b96189835404c714cfcb0f6819a8f923975ff5e11a71a4de3ed58876ae72761be42f685e944474d43fdbbfda2340a0cd79eee46824b3d07f2a4c8fde6e3a64d47aaee6859a9c126b01948e6867ff43becac45365735748254f4318bdb1200eb779b707735cf6b74d65dee8474670d8c2393358cd6114d518453c26fd04bc0377a404ae53a8843e0d3a883e37a83e32b772b9f2d88ed3533ab7f606968f21d0a7c0a8976a891728d4bb43d3a5921ddb767e0235dc28115c7fcd42928363240a1cf1461a1e2efbca32ba261c94c314e3d92e319dd09577389f3358095bc02f9819b44654595cec0132aabbe5e784c175df147d4356596f6589af280fb4f7f6a9b36fdd34b22d563055ce8f737a86a7d1d1497949ffc18320707c038231960732d6a1a5b85c1b40d741d7762c869532aca87db769d36477d9b5f349929eddc2cbe9cd26b2812f6c0448e1f2110ac1a28753472ae36e04c64bf9c93dc7b9a3757fc562e4cc54e3181fce11a06aadd9e0090d2b66b6c426e2ebb6ad701dd6ab05dcd74d639815eecc607bf4070d1067c829c248d5c57c0711e9cd1955affa45c9d1a8e4f6e047d086cc7f53f4148bf872d185a251f55e3a3cfdd34b615685ecb10458aa1c09efa9617f4fd13e3d4bfd48609393678daf7fd71365eecadb099a7237ef450a34e8c080082021047515e015a8a7b151e031ef1a0aa5ef0ec09921ea38e066aea7535607875ab44335390f977311f19e34c227ae6d8f0a3df14cff1a6d712a769e300cd52c84b3bea11c1aeccad71d1c5e553095e8220caca6cf05ba3092e0445540c1b0dbdfa357c8e167589cc350b4d4d9cef2363f1e3f60ecb07a4340b4d0ad3873ccda1ac4d9a6e0619c99162557c6e7c587f65da49a17181f4ffbee3d94c54a089ab72b916c4b40174bd256c531ccbcc8be4b8bc883e67c4acc9da4702f5b5f18197cea62a7be17fa89879b6c375b549f19ac1bc26cb1c5ab062a4b3da9c45154f18963b133a99cf5c4733e8c02e96a037e79c58bf73b420801c0059842bb3634bde54ded2c028347cd29aaa838e2c3bb14bac016289b0437b0bd695049bb6a4918efc6e8c2b352b7fd60b7e39b8ad065b387549d46c7995e1ab465580cbc62bdf1e028b527d1b461e2f49ca2c74633a744745fddbc19614bb3057f1e7276ba4232c792ddf1942a907a99450f239aaeaf273a8a07b30cc0d8110c0ca08566012ffe4704cf91b9e793824c8dbafecf6fbc933d571d470a3ce894733bbcdeb3e2279dc9cdd3d021ac4bcbf879a6a66729c1e150ab75230a2903e335a07d78b3fc28cd062d7dda8da71ed21fe4ce549d6026631346272960618d794fe97f398b3e6cbee7bdbb2d198ba6b51455b1f36eea3440a737d3cf0955a2d29cc1a22418d73664fa6ecd9908a20b32c308db5dbec3481d8afea39c26474c19750ea08980b24988930db42bb4937709355fba46a7f5a647eb3a283e47a003bc550ad3ec8a3331e5025992db92c4e1bead48cde6bc3b39d056cef290306c2698d239a6d7b007b3b064966353d2f977f45bb7d0ffa366d54cd7b7a09e8bb614c95afff3b677f1b63781efcd3ced1b574b22fdaad4478eb09d8e5141c1deb80100f47603582edc44e818f115bf632528b36b91581a33e4770fc0d57a7a9f26667b5dd9bdfbe628da9dc1f3023e0572829fa68554525281ee5f0d256cdec63e226213d3b47c8c112c007ed71fcd0ac2fe26907541462051c5631b8c58d24638daa1a451ea763e7685ec6c39a31f0f21a1752862f26ee0e09681efc2f1b315536ea8d6333736bdd7dcc508eca661b321d1d3b4e246fbdd1fcbf5a3567966f0609aa15472097e98fce730aa9d6dd2da3d6577fbe20dbd568eb2abaa8d50ce1d9ac6a2c4458a881cf0f91e1e44fbf414783a50437b71899a6b1b6d707bbeff570aaa345dab008c69ec7ec413c07954f042b375803d9b7e86dda43e8c1f3595d54b350cb17a0a6736047f91c5447813763f9bf59d973e498bd620b947f6ae2e20aed82e328903ced575163ea29ec60ea430a000c16cfc58aa95501427c8a70ffedd838eac460abb5381803563dcb625c559c06ff0cdd284eb48a56a579c1f2a0af25672624d53f52848ef8e31ef5d797f9103d31b4af851a0ff58d598e25dae481304d615a6dba66a09ae9daf6d9c7f5b34258e8da488d596e33bf00b301606c2409a20bd341bd23a4addb3b35f8392f19615aff705667769cc3d8f677e6c77287d0f01389e0625948cf2ac197727597029cc89ab9fa2494b640e841dc1e1223c6091b05fe304f13be3f4af7b25a67392cf13e09417f2a882103469ff3bfec1f4f4ff0980532926b2b7c2a7971ffac85ab70ae2557e61c6a270d4d660b8d5a9809dd86d2e446eee513f86854fab49802897a233e50388a634aac2eef6423c51c5b9f9fa00b423744a61cdd203f505942a5629a58b561b5249041f0e87a59e95ddc65ab5e5f32600603031be5b6d5b824f33a5c103ba6787d99f58af63ab69fc9fe60d60acd946de7a7a9d19c99b206220cab3aa5c6af82d275868bbc21b4b62bd7e973962422114e7c3e4b9c72afe20c8c1672b96ff7a3b23ffadf8400b32c9cbcb38ba01e17ca4eeeeb9aac90b9d7c99c9f238642b0ce6062b0ee16f0a2b3cacdfd2a2bde2d65f2028291671c32295430e334692a5dfe21007d99706f58b97d32c7167539e968aa56a40de076c0ed9fe596bfbeb8d1080b464636c35e8ed1762205ace28e0077db79c8ff21b5bade921baee1be9a0cd085a6dadf7010eaaa18bd3cc00dfe58ff293b26fd6ae6f972c94782f79389c32aa51ef9f59f1398adbdf6062da2096bd5156c995e452ffb814d578bcf74c233db1d681e979b4099b7b312861d84b06883dfdf0defa4d2aba0e2d40e7cecda832f174ca8fc4e271aa1e40a4585ff167264cafa88ecc98794010bc7eed870634c70c5d8c2d3c55e75508131e33c978eaf4a383128edee89d84b15bce9f5405f9321ca447c4518c26bae5909da007de3fd277f0b4c9bd4f0b8a8670d16e5f4745b86d435c18344687cae5d6de2ff17aad77192ceebb8cf789877c2ee9db686db915ff57e2f9a85d73e436570e5ba499f1b3a50ca6117ce45c415d412fa9056eca2953e1c520acb3fc7de949b36b4dffed9108ec4e1c281ca7823d709fb36017d18e1202c81c6e12ad318b219481afcd62c2e56213963678eb01e493e943b859815c60c22b9ff59d27a939b1aee6eb3cba118ef15d073924fe8ac313d35c47dbd4adbce8c0dfd43d897b7fc7263be782f01d7c52419c93bae805d4746a49e4b60cb97050ceb71571360f1ed71633d27a2c35283c8f4a89a9b069a43bb8e03784e071ce42dbc1f28a51992497682f4b2d4bd7ad9741608eecad89dbb04348fc72d76cf9cf586f8cd89a6e4704080ad0a1685a9f302716e05f44a892a73d09c5f0f5e89b19d9e6fb972953524866a3dc4ae95e04ee108cc3b3fbf07d004947bfd0a5d8b9d11b8880860f98ed3d13d167e7452a4a7b0bdb9170d691c0f87df9fdf3dfcfa210c5e6221ea73f556ae10607feae5c337c42a623db208730e58c8f6c3ddee2774ac580cb1e65036404edb86b9860ff13fc511dbb504a10cbf49fcacf8b09c36cfc9e550848cf9f1597dfd33c2d6bc7416f57968d44d4b60ff8f6a07384b59a6e6bf29a8dcc44c3e535d7446a7a745e1039e5b30a152a4be497940e7ff6b8de0ca92608ff92442c9acc9d902c3d0c1d6fbe21d60e1c4460c7647e36fdf45f3d4b77260643ff96cbc97f08a3396498231ba25e24070619ab2bc6f18f11056875b82b5e636bc7b44dbbb1da0781afe4986caea8b7cf981cdaaf21e7bba9d67d06024bb26218e96de0801ba05125ffa21dc86d9bd8d78c109609bfab7219aca0b26da6943f22193abc689e276e74aa6bf9fb90cb51ddaca5246d3e464a74c114aeb31575ea0497c057de3e4031285ef084ef1d5b41652760c34493aef22736c1b3e0d81dfed1b7ce345a7e5fedc9bd1d11afba19c771b0ca0d0fb44a40eb0ebb7dc9098bc6a83b7560d7a479a66ed5469afd8201281278ce2956cf788f9decd7d4203bd9db5032be63fd927e7f4a3a0847cf69b05f2dfd1d083f6e29e46c01ebc905309df5139898c427ed9f66b9ed11dc908c13b9c02b046b4033c9ec59461d0973ea5973963e15388241f9c40a3e3a90b14776e70c1c3159887492118b6121b2db476f9a4121324072175132e8f5ad2a9d44ac414fc5724891c3649dc3fc6b9cec21dd27b172fb589a11ca7c1482073fe294bc759f66c1cd63a6a8ec5f69930612d577c6e90600f86cd4e223945d1f199cc4a2389eff873e5728850001ce36aa550aa6dcc874c04e00576515da6c600c2febb4ae6ea8498f2cd7775ce1a98dbf2274a03be519ef1f77f0bb523e9a6aeef90cb0aea2c9c3a5456433e6e34cb8bde5c202cc47787b322e4387e427feebead17259942c9a4389579d5c4d0b53fd74436dbfb9a8fc9c339f1f426511d8c82c385dc62b39e84ea8bc1e8e13ea6e8880478227a18605eeeaa117783467cda52d43599d6389c089facf165079bbc21c463ad850757a5149cc262505be4f987f9171fc1e7eb68681f9a5f14d4e264832f9a2c44aef40e6913cc799679e015c20873e4b45e52dca1d261f8ca1dc827df7bf6a40f8283c54b37d7e3eae299c4402ffb5bb8c465f05e1b01a538f8bf9126422644f26bb220be00859f879abffa4ebff18f0e27d69d90bc90dacc97ec27a1eceb3c32bd6c7a964b12e5345eb064ca28850edc67ee88b3d5c5ebd3a2f1353481d046ff7b4466220a2e485955c45d4d0a7db410367f4a83bbfc6dd36ae1ae9b1ccc3ef712a4cface9d07b68a260b2965ac2f5c3531697209ace7ea5f2e73cc569235c3246f67af48264c36c5fce83109850249ab3a1a542e45b919a716203ea2c6691c35ee954723868d4d969bb4c309ecb0eb387d73975a893a4f0972c03a6185c10ff231174e4ba9e74458063c3824c285b67d0a1a4552d1709186c0e41e65947198bfdb2343029f681950ab1abc0ea907e12804456dad3cf11050398bbdf6de472455ce67914653c76b867880a63d026610907581955471cbbd953ca86b40d820f51893ef6532a5dbd829de00c9b900627038cb3d8976c857d63fa5559953b55dc7b4af84e983a93140e0cf8d326ce5e1a6a895b3cda078ca6986972a7b7f26b1821dccdcb4f63c172bf2101b7bf5e0b8789ee0d3958afb747f126bcf98e88821d0981a4a5892819ca33c9ec8ddbb4f9ee572c6382a548d8a7f1da948a1efee480416f3b295875d8941fecf140c297438c2b16189d8d17a24e99ba2efb1384c5a6fa4e07a10caf9a87db51b4a886699e2873a2b1965f608c875574375c5b86c44ad57040f092ff3e9e8c5ed8e894ca8ee0ffb489cad3dd2b6b9920c6d370349815857a2558f39d461f7cf9fd20a4e68da65a30c55e88beb4515b9adc0b29fdfc6b000d15b12d11c0b335c9699c8f27f2366da455e0d8c51317cb4ab5bf88924415a98751ff006f5060600dce957990870ea0d14b565999efdc0cbd9e1f254d1340861caa194d5fa704315853c167a971694ff87a5e77e03e9e0aab58b3949a9a4e44e66893747b84eba6b19b872203976e74e81a588b5f03ed7d350f1", 0x1000}, {&(0x7f0000001380)="bf9599b82959cd381320db627d1948cb2f4b6c0a9bee554e3abff018b9c6d9ec64aaedfe5c5876d931ae10a6cb555e67a88fa00e5284bcb2e407ab28e8a01a9b5c07f7a2da628b433f8d7140747e4bbab5f0e771583e4ee90d91ffe52b314fb5c523fd918fbf34ca1f4d5446cf7623b334b9d5ca39b01874236b698fda338f0f77cd97ba5ba19272309d1cf6e5e575259543ba1a16ade442ad91f440b5ff5c6417e242fe8960adf46a8227cf6769a19105695fdee3cd2df806563f8b99e035e1", 0xc0}, {&(0x7f0000001440)="75a6fbb9610984384b7f1ef4bbe2c57de260f505a1b80580bdf07dee9b8c2e28efecd78d5adc12beab7f443aac19ddaf8bef00009f8e8e5fc0b30b277e002a97d26a2932e6301ea661825ef6dd67682a4d86cad197a299b806defd3ffa4d4d1849bf912a6c7a2dd00b93afa69164028ac093e653ea58441adf3eb4dd803840a9eb67e405585521a57406a3f0b981cecd30cd2fef16c25c36bae1646d93bfcce39a07e09bd72a0b6113f254a688787784866a613a58b4baef43", 0xb9}, {&(0x7f0000001500)="7e23d99950da03a9c0f1d987b41840cc7297b2f8b12052a95ae787e091bb9d52bad2ed47c92346a1ce2b727e83ca02a84a73132adeabc63263adfd8e94066bb222e95c0cb56d1da28eefd5f61196e8481046d0d20e5e31e7fe76c331f9fe1ffeba6be296d9f5311210d5149b1986e3fd1201677486fc7828bfd690bd1aa308697c07b152cf7cf6f506a58f6a48184c1397690e3f4c3804c730a7fcf88753d72f2be5c832cbe15bc441dbb71ff41c5994568f4dd4bd313d95134d24e25b44dd584b75", 0xc2}, {&(0x7f0000001600)="f8db9ea1a5c35dd2525fed536786c24f731dd444", 0x14}, {&(0x7f0000001640)="97860264b04e1a87f6899a6803369ebfb4d32a309ddf2cd77e885d2fd6971a241ad9cb410b326575e1dee03a6b07c461ba9857706b0dc3e7ecd496b58ec79d016f5533dc29798e54d313ac95e8e759c85510065808aaba5ea008722fae602a58aab51ab86e6e71a5ba9de09152b101445e", 0x71}, {&(0x7f00000016c0)="e7dcbf2745658591c6fa5965d04526f8c0ddde8b2daff0a3179b92ba16df", 0x1e}, {&(0x7f0000001700)="fe25fcac87da74c0a1c9555118e24814f54365fde7a96d9342fe602584459a6ee56690359da9eefb5de51a03294d2d415d2283e548f166d1b4e04878a6479211f163ab93c1e6fd7d475c7510710bf42185b73dc195bf9771260cd062a07f897128253f5814f87b2d2f048410de79dded7eff592d78a5030563d58af4f57ddfcb1879680dc05b320a9deea59eb112257deaf775", 0x93}], 0x8, &(0x7f00000019c0)=[@sndinfo={0x20, 0x84, 0x2, {0x20, 0x8, 0x40, 0x5, r1}}, @sndrcv={0x30, 0x84, 0x1, {0xd96c, 0xfffffffffffffffc, 0x1, 0x6, 0x9, 0x4, 0x4fb, 0x81, r3}}, @prinfo={0x18, 0x84, 0x5, {0x0, 0x7}}, @dstaddrv4={0x18, 0x84, 0x7, @multicast2}, @sndinfo={0x20, 0x84, 0x2, {0x5, 0x8001, 0x7, 0xff, r4}}, @authinfo={0x18, 0x84, 0x6, {0x4}}], 0xb8, 0x20000080}, {&(0x7f0000001a80)=@in6={0xa, 0x4e20, 0x1d, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8}, 0x1c, &(0x7f0000002000)=[{&(0x7f0000001ac0)="27746a09fb90237bf5bb4e09ff20bc994d9c5df21147fcbd4c913140d5ab015b5ddecc25a8c4944b454969859d0ec2bce3c2f84568b4cbbfb5a7d4a5c717cde7c36a9421cbd35976d11ee566d26f570df4f6fe5cc93f2e6e06226ca51e1e342104980a77f63b787f3e48bc6b06f9f605d1e6d4ea1b7944ab0cdec3b07ae174dedb17164067d5955bd4d6ef57443f0a6e5bde93d739b605a862e398fe9d0d20a1f163b2ed3a121fc6aaa259154232e467d1347c0d3ad8d2e0e7f79322d708c98bcb01390b2f9c2dcddbbff1556cbe1cd4309e91af1e4442f2378183e405333837233cd7e4", 0xe4}, {&(0x7f0000001bc0)="9d5de1d3ba468b6f4ffcb9badd380023f134c37b3993999be7348ede3c831438eff725e4a851c16d6209abb90478e1f7b3b192653d055c06d79d76ea8b336e6980a2948398128a8b4ad304265e37992740de", 0x52}, {&(0x7f0000001c40)="02e46a38cd54ceec67ee6c08814a666c17ed249e4963e91e93f4f898cee51660930274db1ed370dc49483e879b7fc86fab81f4bf15fa15ea420eb5e08cfea4ee76a3e79ba382f9fa670570ba421c918d597e499a95a49873e67492bb649c08baeaf361ae0eca", 0x66}, {&(0x7f0000001cc0)="e56db4f732bd87094d7b32a904a89f4b335adee8aea51b6d884ff7118bb216240f652846689cdd7c91c907d6ca5ddc3c148f25ddf7972a9a7a5f6210976c3af1dfba51f48091c967a5b545b5344e7075a413e14add3a1d45e50793c5b0ebe8f5b946131127ec24d8c6b9e807884f0cf8ac345a00bc40f2c3e19200c99ae221", 0x7f}, {&(0x7f0000001d40)="13b103d29d1cd6b0fd8889e84800459e9a62b9c47374a76f65906ba8285c2b2164e1a3da283995c8df34c1c3ece2f0e8ab43bc08e5db1ad14b12b36de4aeb66fed541def1581509bc2777bc5812345058a19cdc09e1bacdc529ee11fbeaed759fa2af58441fc385fca5d9bc862af33c5256116c159a527660c042ac6644640eb63d94902db2a420156a50d261ea9ae5474d664d8dba63e6e7fcab47c9fdbc3b29826a419ab14648d21dee575cd8f69bb71060a1916bef16fa51fed0bc4b1d26f63fbcc4fdb6aa4e9bb40a46ea5f0f6881c358c", 0xd3}, {&(0x7f0000001e40)="8846a7a867228983946bbe84a3f27d502a4dd9c841bd26c0c7992d0ba54ac42da15285e941937ea8257a1019f211adb0dfb5c29e5b4a0165cb360a9535e8d8d1540dd43a606e1a8553e2fc7b35730bfee3f76b1e4b48e129801c55285ddc6ec1d57cfc6e12fd47011bdfdfd0276459a6487cdbf6cbb8e5c5a66a2080b95bf472872738386107f8ef8dc6a81f9c65d228a6f7b056c4405758d61737015b5c872666712d1f2b882f501b3b4670c883d946cac5af70ee495a593fd8ba49f0aa95dd9e1d1f2a15e97066e836eff49fd4835c9afe837ae09ebf", 0xd7}, {&(0x7f0000001f40)="3e97cb938f4efcff31a4d8e0ddd30023fd8d97987395088b054ab761f139438dd400038739cfcc53f785950fed8b5eab804ef314887c52bbf0ab51076dbcdd72536c29bf60059f225e657b57e23526efe096a782c655f7a9294f471dcf93384b5708b01cac271042c6590b953be11f1c2b8a27ff4f7d8699c30988d1e3be99352dd9b653b8f10677bc1c09343d9a70932e7c1481b4357bbd8384bd1ff6f43575df9b1119", 0xa4}], 0x7, 0x0, 0x0, 0x8000}, {&(0x7f0000002080)=@in={0x2, 0x400, @broadcast}, 0x10, &(0x7f0000002140)=[{&(0x7f00000020c0)="3d8e282861e30fda", 0x8}, {&(0x7f0000002100)="881bffed9d82793af8dbdc", 0xb}], 0x2, &(0x7f0000002180)=[@authinfo={0x18, 0x84, 0x6, {0x1}}, @dstaddrv4={0x18, 0x84, 0x7, @local}], 0x30, 0x4040010}, {&(0x7f00000021c0)=@in6={0xa, 0x4e20, 0x1, @rand_addr="724fbdb43def3039ed9c659a9e4d9606", 0x5}, 0x1c, &(0x7f00000032c0)=[{&(0x7f0000002200)="5dcc6d3a8f10992684144ff03e9afb159030111ca83124a7671e02dfb17cd022f804abb3b99bdfd382e427cebac7ebd286a428f0e2316e7699f886d4d4c492c10044db48e64cf098f6eaafbe41b8c59cc9175a0ccfa1039c4724578b865110cb826bc8b08632693b52b80956d6d8c32d422a2b1154772a57b9d0cc33a3e23ee03ffdda2ff405349e9fd3c6d8af568800a7c4183cc81c6e468ed2adbeca07f1fce7a1c0da510c5fa34f520c2a28cbd9f6bf10303b2f5b208aa35ed5ee0ebe71032ad364e0171d9ecf6356b74b446b99ebb5b8ec2a1986fe1898a667d254a670f30ca31cc2989e7be9ade6332d77b30db29af6a3e7869a7c1592eb2386659527e94361a5f1f724ad3e8c2990a333f63adbe789559c8aab4ce0964d9829370860ab867e796b75e70adff057c898bc5099ef4d0eee1b1aa1d1cfc721b8aa2b55c56f4d6643e79e72d5ad0d648b1622d0c4c366d824b81ce66fee268d8323534943cbe681784c45132fd79c4bab915a52a40850187ab53be5ddea8a45cc91d32993b3d9943299cd32ea7ec3e28f2c3943049c45ba54bd651bf5143446568d2ea600b250efe2e8cf0067c64e3eee59e5db49b756f236fbbc71298a2d77515ca8af659cff47e114fac8904d645ab28de014352d203307a27b87b1cd4b77d86c81c0291c6f72d7e31f4ffbdeb3a9bf8f0e8eefb66ae6905deb3158980e003daaf99a38bd74bba0ab2514c2a57775fbfd00fda1af05424f4274715fa61969ad26c0213ddfcacaa2c0bcc272cbe30ffbf61c501d390e6351717c3e1437b7295df47d35b12e8b3ca4fbd18714218c7c5fa7db654262d4e705917da5fda4e229711bded1982190d313b3c9b50df402757ec1bd4f5fd4fbf79d207e6aba96f69e2a5c0d2b759d0cfccb33511ab860ceb1148659befb1958028514ca3ca883764ab763f0cb0505e120033b0955b3ebffe4049746f342c9c9aafbb189d29daeeaa5ca75aaf6a6cc221ea3bd2e25ac7b4237cd28346bdda8c72b58368c2520491e308e56701ef5752bfb63fca7af2550a0125087c30ac0d0e188af9fff8d9589b161678a96ff8ad6572ac1e26a4ad4a8ea1b2b6675d291f7cda5f7d006459f66034c6409bc7201cb836a23665f1340c2fcd1b5f292590cf297b6f5bb46bbdb0a724ae24f9d8d442adc2a26e910f827c21eea57d5a78be74b252e242a964e9ca60daf03c43d024e86c479d9fcb62be48ace72cca41119ad7fabe6709d5e1695a3419a9fb6c91efbe552756312078949abeebf36e6aca61ac2abfa18e6d523e98081875c3fdc1e2d497f9be92486a0e9b6e80260da34b58f6bde05d920227944d979830758e189be294a41f641c5b9aa39f9953724c84ffef7e49dd3dfa20c1036c10ec9a051c71eb73df9c4266876a3e42cae5dc79975bb3a307fb9c9179dc45a96f6a07f2dc3bc10bfc4707fa06753e4c8a0ba4d65e0b6e0c98e267d5393d4021f3b77d315da6e913eaebaf199979304c1b5da441ef19f22ff8a0c9eed11e08c3ad43d36b2bb757c656e9a140a429a8fb332daf0de8c43ae106d88111b699036c35b94506fdf485c07c6d9493f59f3141c08ad03c2deb254c913bc4d6d15d1fdf37b998cc64ff877494da62c60d0e279b33c91bb06e7570948a3e7df511cc001d44bb3b41c5ed5a6ff4ff5ea6dea4476fde02f37a51e810230852d66c98445cbdf591d3fabccd7203ef1b8a2d62f6d464ff844c5a8405dba21e86175ab7f50a0d823f144503eec0bf3b0d125fa5a6cdee8d595225f4de076b9c30d8f6211fa1a2ee3124e939f7a9c5a34bbc31ecb89c43e9b8ee672708d85bbbb76fa523d163e89921565430cacd9fe6c4b54a2ff0f163aed63ac3ff38336bc97e44616b9e1b2354f0b4b631367cb1e6287b44e1361819e8b5b0040728b5704140e99a2a0cc4bf01bbc70ef68639bd8d14ff25cf0117a51efc10a2300d71501fe96e08fdfbff66181126976c4a935beec791c60aed7cecfa86d2ce5d3418f2e3e09ede73bdb54c4958c2e494a1134346f8df7d779dfdeeb2c205b3f04a9fad4237a8c380a90522600a56c3af4a5457c0a81e391ad0e133eabfe2f58584b8207af8e17b96cd3aee1eeaf0de4a325b02f84fa69fef52b3e5f0e0a9eeb6b0097050c96a648e4dbed66441571418c966012a2e794304cc7e21c8ebd4603230a59a13354dd3c63a4024746f36f703199d7c6b2fc3bb3fc770fd3c0b7deb442039077d24bed60b236d025038db4745daac02f81bd4dbcba9d0e609216a5c01e4e974ad82b9f51126df8773f0a89c4fc834b1b7494af01f68494ebab682250a6492d2afe4ea28631f231b5c8c3d7e5929215c3bbef307823e380ac3bc6305b15e6a8c0cb8a672d403a12a20ddf20e75b4fa7fec853142f82ca8e869e856abb8cf822a1bd81a86067afa33a7f7d903a8760b1c0ae6cbae52b1ead5ad404684bec486e593857eff963ab018fd838c47e50cf95d0aedbefe89be586eb73aab5f53bad6e5317634c86bff6008a13c326fcc011ffe7fbf603918d5ad8ce957cba90c28fc7e54009b0187517a73c3ace6913da43494a5ad62b0ca9a9f3fb8b0c9cb0ceecbabf2827a8ba039d4f33c505071ca04df74148f74548cd911fa6ba25ec0254d463833d11205fb6d4ccf172e1aa443bbba8cc059b4a6adbd7ac9406257df951813f06926ee6ed17340e270110ac2efd8047997553f1a295482c1e197502ca68c84eada80206e959d519d0b8862944c3e0050b487fd97a8fc1d89dfe0d1f9273b354bc0d61f5b4fbcdbaa9430e75d31f28d1f3f0afdd9872e20093fc89a191119c62af578ffc99a5227f2e6c3d7a2cf422075ad254b89ed0317baafd041e97c0e0fed4d99bc32bc3f0a91b77a1f3000670e1dee10e3bc5669de22cab6e022aa6bbe62361872e0d21df81d87302b6ae35080bd167239b5e268856533a6926c15f5d4bf8d9718f97df588be2aa99f03fd57e1c3eba91259ee642fc5e3e63f0721d385303d7ef402a24baf864bc2c667998b5e7056ad1416c2798f15bafb9e4cd4f945ddc20e3d8ad0fdd1ef2887595af922948f102cd22e2642707cfdfdfc4ee318ef71ae563b4a4d9666d30accee9607428f8d06af6bec0876736abe75e4748925a2bdd37e7d1ebe7883918a788d21c16bfcfc950bd63ec3990b96512655f1b1c4c52d04293360e8ba498c956d36e332327601e9e8707207d26cebbf59d9990139de2d2e53982f8d8e2d488891dec7ae767dec628edcb45f5527747a1e25d80f929119f5f896fa37409d861a93ba98a8b577c94901c6d592ccf3a55dcdb4da3f7a3614428571cfe0a27182f8bffe77791f52df9d4c85a2b7c6543fe8c608f2bec44d233a20618e594e6cc10216560b1841d1f4ef9db80ce84fc898de076bd2908609a270f1be9b684ced52b2918cdbf1198dfb7b24bef815703d9aaff2426649b4de87019ab88257fb45accd4e7fc653c28cf40122bac8136f80d285599d03e35d8ac35e18b5575945459a98c91a383043b2731788252acc2931d403d2481239e55c5613836aa7a2047b7bb76be935c9c63e6c7233435cc56b8c2b13e599ed7fc72d40920a57161f596f687421fe25c7118a82a51beb312bab17fd395a9b05f2d3c23ec281ea1c713b0fcba5616b57ca8cb1c024f3d22e285749cd4eb4acdbb27ed07d3248cb5127bacfea792560841c5fefe3499e1f5ed3085d21534aa96a8578fc9069497f31e1b2681bba08061969bce22b342decb7e827712777e2490076c6a4081d627e9a2ae05d5fd8f9725f3321431024baa7a0f3fdb210f944fda2c1c5c91b82941e3cfdae3e58344ef64fce2b88ca3023f496e677c129930c55a199d902ca62f5255d03c2e5cc955bc1369f31cde160623f77c0e86af0963715ef218611747145030628ae186a5b6d3d3144ce647c82e5a190fa12817979b3badc5ea937ecc2bd8d90e33c4e86f7f28b91300f4423fffdf65f9c82c42dee5896774b79cf5e01223aa9b9af4c9275b68c5c71efc0573a98b0adb57cc160f20b532d1c9fa9b5f95854cad861d3ef3a85a7ef0e3870ca55b2bac33384a67f3452ce71bdfa8d0e46e1bd9cdd0050d5b3320247e0f3656f1f360dde970926e239efe005abfad6e823cb28140875ad8bcb228ae1b5fe8ffd09d44801572e85ab2d8dd3b1c9794585a5968a98437570aad0e7cc66c2149556581846c60351ee272e4d31b5140b4eb2faa1a24dd54348d34fe9176de36bddf2581b021dacdc5bc3d4012e51bc98e44ed32efd97c4ae3b1d8213030708af719c99304d28865638c85cadc376f6235576073b67f99c3fbf5eb7e97a0eaeeb9d490f7d7590f0640ed3e084f66eeebac2924cb5454fa4d22d6cf6f880d6cafdece6e6265cf6d2eb734074bdd8b631ce45d3daa54052a220f878dcdb412ce35afc2bf94ca51a26648ce7d4c46317a63b8912c4bcc8ca2ca2ed1a9122788583488d322a2212d947e50d8a304e47f51bb33227e0f9527f09a6d4dc43a547ba825dbafbdbf5f9407b5242fc40780e3d50966bc235d5356fcc17090ed09e11f011b95c8f13b4e56da0a096d3e57a5241efceb4feafc75a28886b6da83f34569b72063672e0d7599a65466ab0c588e99e349773fb64d6a52cfe0a2c24cd565051830fa909098acff18576cf24528fc5c4ccc1baf420b76d3ad6c4be7d0742ed81a27eed9599fbc25e716d69525b1d8b13e7a1a6004e34da7963e630a42fa1bb85a0bc9c33047c2d16280fc2b3940ce7a25cdc726e3bf93c7594fb55deada1ff2d84a63ac8c97c463a65239a722c87b7afc62b47bed976dd984674eb84ea5065a316ea6f7900bb0c555cf0d0cb7337a9b3ff52a68e5454dbdc8894877340bcaab9d4ec0a7cc0919707fbdb17c6e796c2544a3c13b45420b0c1a24f317d71e8570c65d150c174e09878e462864d519f0fcfea9eb79360d151c27df1765a15e7b24345452dd434ada5e131af4da7882f3a028648ee5a4e08fb521012d235e3406a9f9cb4847ddface80c4b83b549b2910829cac8955eaf942313770611a01c2ef697e95218131c678d609cc4ebecba38f7f18ce121e8374c39a791ba30a93b727b6e7fc5940e2b40428745bfba14a55e03782e850b7f520213e1c4631d54d69713e051ce690b9e8921b2dbddb3a27c7128e540ea1c32043175d27a2472525ba686568b6364473c4f17de0c5548dc19e0bf545dd98cac3e460ab1277a5dc7c4040e64b1ec398cb4a15bbeb80be4fc311972dc781acfe51200f44938f453e4a228b3b5bf46580cf1094ae7363f370641e4f00d37eee4157e3dbac51bd18d277fca24830867c0e1c583baa9b77b8bb6a85decddf6777d1ecd872caf98068b814ccfd9cc504144ba40374966b4531f12bde17dcb25f876ba43050ca413548285d7c49129d32747a90394f1c3b40dea071a6e60d6569e50c7da669005dbfa6d2b1110d47a07c36412bf80e6aefe0c7af6221510aff5e3b0f8d4c07d408171e4776b05af8687c79e04fa21f3a95883877fd49c6bd0b21cc299c30bc3f8778a5abaf569f2cb543e7fb63dd68ff73fe376dd6fd6ba7e083173a28c16c87bb44cf9687dd5765010fa0c81285b5c22c0fa2de1d4bbb65b41344a7585f126f0aa0dea92ae20370772b2e38961584b597cd366807c59d889d0f6f53183ce91915c21b42156a78816f79767f4d08a9307c5fcacf05f198e23d5aef62546a150333e3efecc734307b1ba00e44da0649f188abfdd63280f2413f8740598eb0108ebb5e5d0810b14ede3ac86c9f", 0x1000}, {&(0x7f0000003200)="de116a991e424e7947bb89acab88a55576fb53a67ffeedca1a62b846295657057c1b519a1f54a5b135ab2e61da21bbae2f6c1d0425e469cb4ad648a618095bcccc8d436cba718733f7a4f1d163d991d456aaf7a23939ecb244532ca2feef1407c50cd637704f3fd6b8fbc8616a702678e21a1708cb25feb453a33ac3f9ee2ce9e1e3b6e51aeb6814d94e51c696e933c4d1095de4ef478f8ac0829aa3fe8fea7a3f2de5db05703c70587e19ef4f7cad73ab58dff25b226f2b", 0xb8}], 0x2, &(0x7f0000003600)=[@sndinfo={0x20, 0x84, 0x2, {0x2, 0x4, 0xffffffffffffffe1, 0x0, r5}}, @sndrcv={0x30, 0x84, 0x1, {0xd3, 0x22, 0x2, 0x100000000, 0x7, 0x10001, 0x200, 0x4db, r6}}, @sndinfo={0x20, 0x84, 0x2, {0x4, 0x0, 0x9, 0x9, r7}}, @sndinfo={0x20, 0x84, 0x2, {0x3ff, 0x8000, 0x1ff, 0x9, r8}}], 0x90}], 0x5, 0x20000000) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r9, 0x29, 0xcb, &(0x7f0000000180), 0x4) openat$hwrng(0xffffffffffffff9c, &(0x7f0000003900)='/dev/hwrng\x00', 0x242, 0x0) [ 1869.683069][T12983] binder: 12980:12983 got transaction with invalid data ptr [ 1869.697406][T12983] binder: 12980:12983 transaction failed 29201/-14, size 24-0 line 3180 09:51:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000100)=0x4, 0x4) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x3, 0x280) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r2, 0xc0305302, &(0x7f00000000c0)={0x100000000, 0x200, 0x10000, 0x2, 0x80000000, 0x7b7}) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000040)=0x3ff, 0x4) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1869.734618][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:26 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = fcntl$dupfd(r0, 0x406, r0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000000)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000080)={0xa, 0x4, 0xfa00, {r2}}, 0xc) 09:51:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000500000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:26 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x10000000053, 0x0, &(0x7f00000000c0)=0x1cb) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1869.952774][T13099] binder: 13098:13099 got transaction with invalid data ptr [ 1869.975914][T13099] binder: 13098:13099 transaction failed 29201/-14, size 24-0 line 3180 [ 1870.003853][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000600000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1870.265535][T13350] binder: 13315:13350 got transaction with invalid data ptr [ 1870.286875][T13350] binder: 13315:13350 transaction failed 29201/-14, size 24-0 line 3180 [ 1870.318268][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000700000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1870.577159][T13607] binder: 13566:13607 got transaction with invalid data ptr [ 1870.590486][T13607] binder: 13566:13607 transaction failed 29201/-14, size 24-0 line 3180 [ 1870.606251][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:26 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x2, 0x10040) ioctl$CAPI_SET_FLAGS(r1, 0x80044324, &(0x7f0000000040)=0x1) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:27 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000a00000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:27 executing program 5: r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x3, 0x101400) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x4, @local, 'veth0_to_hsr\x00'}}, 0x1e) r1 = socket$inet_udplite(0x2, 0x2, 0x88) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:27 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:27 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000140), &(0x7f0000000180)=0x4) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:27 executing program 4: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) fdatasync(r0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r1, 0x29, 0xcb, &(0x7f0000000180), 0x4) [ 1871.091798][T13824] binder: 13820:13824 got transaction with invalid data ptr [ 1871.129838][T13824] binder: 13820:13824 transaction failed 29201/-14, size 24-0 line 3180 09:51:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0xff, 0x1}) [ 1871.200953][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:27 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000001200000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000001800000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000002000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:28 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="7472616e733d66642c7266646e15d083d303d459d373f4933e5d10d99d728762f03fa8eb564f58392afca4cfed636ae234514310a30f2ec12d7eaf0dbc43d2ae3a46955d967fccd81accac6f77bd", @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',version=9p2000.u,smackfsdef=mime_type,\x00']) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) sendmsg$IPVS_CMD_DEL_DEST(r0, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4080}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="800000001ebd4b8e0f8575275bc3f0659bcbefd1c16bf403c1505df4", @ANYRES16=0x0, @ANYBLOB="00022bbd7000ffdbdf250700000044000300080001000000000014cf770076657468305f746f5f626f6e640000001400020069713665727370616e30000000000000080001000200000008000300010000000600020008000800fb0a0000140001000800080000080000080001000000"], 0x80}}, 0x80) syz_execute_func(&(0x7f0000000900)="994a2ae92c05f2450f7cc44c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e91000000110fc401dd73d83bc4a265aa104b26660f38091e420fa2631bc421045f4607c421dd589fc4e10bf8e447f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd7ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f000000f76cef0a5cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") ioctl$BLKPG(r2, 0x1269, &(0x7f00000001c0)={0x9, 0x0, 0xbf, &(0x7f00000002c0)="84f53bc0df1d208f3662132a6dcd109038227c586f73fa2b60e442efd7ac6d4b9775e0e219aef57627d87c5a69d818b32066b378cd30e5c495124abc603904cb3ffa7ae4c78a7206bad8478cbaec04cda8b064a13390bc9a698b83993919d2e81a78cd40d35bdda120d1767a8121d7bf0ede0e116ac66d1fd4a3bdc9c505539cd163266453791dc39acc2f207ebc9bdbba77da2e5ca5fa1c9c8335dade70260db65cd22daaab29e8cc604f7b9c4892e11489ab755a2ca00815a7dfd9827fa1"}) 09:51:28 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:28 executing program 4: creat(&(0x7f0000000000)='./file0\x00', 0x10) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000040)) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000003f00000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:28 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:28 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x180, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000180)=@assoc_id=0x0, &(0x7f00000001c0)=0x4) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000240)={r3, 0x2}, &(0x7f0000000280)=0x8) r5 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r5, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") getsockopt$inet_sctp_SCTP_DELAYED_SACK(r5, 0x84, 0x10, &(0x7f00000002c0)=@sack_info={r4, 0x8, 0x1}, &(0x7f0000000300)=0xc) 09:51:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008913, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x200000, 0x0) ioctl$TIOCSRS485(r1, 0x542f, &(0x7f0000000080)={0x1, 0x200, 0x9}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$TCSETX(r1, 0x5433, &(0x7f00000000c0)={0xfff, 0x8000, [0x81, 0x8, 0x9, 0x5, 0x6], 0x10001}) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000004800000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1872.942232][T14994] binder_transaction: 4 callbacks suppressed [ 1872.942243][T14994] binder: 14986:14994 got transaction with invalid data ptr [ 1872.977367][T14994] binder_transaction: 4 callbacks suppressed [ 1872.977385][T14994] binder: 14986:14994 transaction failed 29201/-14, size 24-0 line 3180 09:51:29 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getsockopt$inet_buf(0xffffffffffffffff, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:29 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) ftruncate(r2, 0x7) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x20fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1873.064688][ T3269] binder_release_work: 4 callbacks suppressed [ 1873.064696][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000004c00000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1873.389347][T15139] binder: 15115:15139 got transaction with invalid data ptr [ 1873.415335][T15139] binder: 15115:15139 transaction failed 29201/-14, size 24-0 line 3180 [ 1873.458784][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000006000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1873.700503][T15421] binder: 15420:15421 got transaction with invalid data ptr [ 1873.721122][T15421] binder: 15420:15421 transaction failed 29201/-14, size 24-0 line 3180 [ 1873.739282][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:30 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:30 executing program 4: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000080)=0x1) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r1, 0x29, 0xcb, &(0x7f0000000180), 0x4) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000000)={0x0, 0xffffffffffffffc1, 0x8, 0x2, 0x11, 0x4, 0x0, 0x4, 0x10000, 0x1}) 09:51:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000100)={0x80000000, 0x0, 0x10000, 0x6}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000140)={0x7, r3, 0x1, 0x6}) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f00000000c0)={0x4, r4, 0x0, 0x5}) 09:51:30 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000006800000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:30 executing program 1: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) ioctl$sock_SIOCSIFBR(r2, 0x8941, &(0x7f0000000180)=@add_del={0x2, &(0x7f0000000140)='nr0\x00'}) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") ioctl$FS_IOC_ENABLE_VERITY(r1, 0x6685) 09:51:30 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x80000000, 0x8000) ioctl$SG_GET_PACK_ID(r2, 0x227c, &(0x7f0000000140)) ioctl$SG_GET_PACK_ID(r2, 0x227c, &(0x7f0000000080)) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) fsetxattr$security_smack_entry(r2, &(0x7f00000000c0)='security.SMACK64IPIN\x00', &(0x7f0000000100)='(ppp1^\x00', 0x7, 0x2) [ 1874.093593][T15547] binder: 15530:15547 got transaction with invalid data ptr [ 1874.133282][T15547] binder: 15530:15547 transaction failed 29201/-14, size 24-0 line 3180 [ 1874.172416][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:30 executing program 4: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 09:51:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000006c00000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:30 executing program 1: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/dlm_plock\x00', 0x40000, 0x0) write$UHID_CREATE(r0, &(0x7f0000000480)={0x0, 'syz0\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000400)=""/77, 0x4d, 0x800, 0x2, 0x8000, 0x9}, 0x120) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)=':\x00') r2 = eventfd2(0x3, 0x80801) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = dup2(r1, r3) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x132224) ioctl$KDDELIO(r2, 0x4b35, 0x4) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r4, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") bind$vsock_stream(r4, &(0x7f00000001c0)={0x28, 0x0, 0xffffffff, @host}, 0x10) lsetxattr$trusted_overlay_upper(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='trusted.overlay.upper\x00', &(0x7f0000000780)=ANY=[@ANYBLOB="00fb020201aed2a0c549a925adeeb719b28bca30ddc499084330889318675843c904f6cf2ba78592fef7c70006072ebb31980e3fbc30c4b9ffc51e13b213489ec5abd92cfa829813f0118b72e42692d801000000ea702bc3e5797f0847b0fba311561d7da23ac8647a1906000742d042de1edc44ee4181c97921217c45f6058c8ca667d5dfbcb7040011f800000000000000049b79c576049827cdd4be7c41549d886f2becc93d86f85fece8a480b58fab24983f87d184a85a18763d67eadd530bb9c1b826f86ffbc08fde1e7d592fcf9168bd619919e6e8efe55c95cec2326b8b2b7f9d94da27ad1d4eb02dfa8bc427dd202a0703dd3a6384961efa7534d110145436716fce0e1465c94094f3cf7069c63495675fc9da6460b1184ca116be9ea6ff23590be15d18891ae3e7097b72eec3bfde9762414280d0b62596b5c2256ab1b2bb9b980f6054c7ca7a4d3f44ecba52582c4f5a3882d6943120492751c071ac9b77a89f5d3f66a118628eb603512a45e0a05f2e5a63ccd6b4119ecd44175b5dfddb79c8ff10c67deb0d"], 0x102, 0x2) getsockopt$X25_QBITINCL(r3, 0x106, 0x1, &(0x7f0000000240), &(0x7f0000000280)=0x4) [ 1874.430587][T15858] binder: 15857:15858 got transaction with invalid data ptr [ 1874.464917][T15858] binder: 15857:15858 transaction failed 29201/-14, size 24-0 line 3180 [ 1874.491862][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000007400000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1874.728850][T16048] binder: 16024:16048 got transaction with invalid data ptr [ 1874.755042][T16048] binder: 16024:16048 transaction failed 29201/-14, size 24-0 line 3180 [ 1874.781268][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000007a00000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1875.060215][T16262] binder: 16251:16262 got transaction with invalid data ptr [ 1875.077377][T16262] binder: 16251:16262 transaction failed 29201/-14, size 24-0 line 3180 [ 1875.104345][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x4000) getsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl(r1, 0x3ff, &(0x7f0000000040)="7181bd20d4b9e9ceb19c6de0925512a48c8a40c5c82d1c9da334397d9423c497cff24a06ca93d2e4aeee60eb6517c0e1be9e4c6c4a0428c9e69438848aafae567a3605ff66eb6d4eb974f363cb3cba859632d47cb089dad1") ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f00000001c0)={&(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5}) 09:51:31 executing program 4: r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x9, 0x0) syz_read_part_table(0x4, 0x6, &(0x7f00000004c0)=[{&(0x7f00000000c0)="9a06594ef2127c7de2e994", 0xb, 0x8}, {&(0x7f0000000100)="9c852db2881029061d1adf95ead2068c5d3f29e10d0c047fe86df9a5ad0887db97c7d5f9794756581b4a7508919e34a72c569fe8f0824d8528", 0x39, 0x3}, {&(0x7f00000001c0)="2dc9270689842b157215bc4793cd7f917537aa50da8003550bd560b6ac0e94ae5bd18df19fc8b758e38e5d724e0c73bd54bd36592965599aa9d2b5c1cdbe4ed1aaccf21e9ce9c0992c219a94f60aa71a376a3db0a340aed221c464a22ef22b7ccf681eda8ac734541df7a1ea115b2fc70401dafba6f20c6b9a95e982d8c53c51a8fb95f78934020a0c8aa9c61d48e9d0c29399909e95f4ab805f762a4e95339f4b679de4a8cfc2f9de45bb1391725536b16e7debdb72846198b6d9a609c31a032cf4b40765a8628fd03e870f666ce6784526db3c2f2d95ba7b2bc8e06ca3098eed2a3ffa38cd26745fb3b7", 0xeb, 0x1}, {&(0x7f00000002c0)="0c7e4494063088bdad1066269f04815083a01c676bed68d2f2ae8550ea42458b6f2026d6d7678ab823ae2cbf6d60b2110b52a6a6acc92c743b59f8afc15b82608f28ded2e27ddbb86cfd489441cb949e4e54bd63b0144553cc0ffefd9de253a9460d2753d8e4a6a4f340b4d65d829b7d813b1f9d42e7099a60585246a32dd1293fe3ce92b9d4fe8135aa8013066b", 0x8e, 0x5}, {&(0x7f0000000380)="e19c51b4bb7f67f8cf834c91a122d046af079251b172f200a9b0bfeb90e44ba7b639b6c4319b319472a5b98fc7ef4fdc2212314236225f5ea8d774f3cb9f31a8959871a61c87d3f6e2681af1858bdf4d2957cff0e2822e79c7328c732b39d8bafb2fa71f92cdab721a639fbed5b4c35111ed9d64f040e85c5e61902950b77b2a05379e3b151b002cf9527363ff1dff50ffe42a6f0506e78a87c8723e", 0x9c, 0x6}, {&(0x7f0000000440)="4e0d80324ccba0dcf3195faa2694372519e961808a58235859096f342afdc851c1fe9b7d3b6e2234863fd70be9d94fbee80f63f9e8caac7bafd09152684bfa63eb870e3368d2ba45cd5bbb23f24dbc69510c67e6f5fefe5e1bdeac85ea9c635bf383b6f3d15b285a2e", 0x69, 0x200}]) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r2, 0x29, 0xcb, &(0x7f0000000180), 0x4) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r0, 0xc0305615, &(0x7f0000000080)={0x0, {0x704f712b, 0x79d}}) 09:51:31 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:31 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000fffffdfd00000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:31 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000140)={{0xa, 0x4e24, 0x2, @mcast1, 0x400}, {0xa, 0x4e24, 0xffffffff, @mcast2, 0xb8}, 0x10001, [0x2, 0xfffffffffffffffd, 0x580a, 0x1ff, 0x8, 0x4, 0xaa]}, 0x5c) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) r3 = add_key(&(0x7f00000001c0)='cifs.idmap\x00', &(0x7f0000000240)={'syz', 0x1}, &(0x7f0000000280)="bf19b71d3d8b43e93568d14bd309e07876337ea2dd5cf09111d4e98d17bfb09bab154f0e48", 0x25, 0x0) r4 = request_key(&(0x7f00000002c0)='logon\x00', &(0x7f0000000300)={'syz', 0x2}, &(0x7f0000000340)='#wlan0system-\x00', 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, 0x0, &(0x7f0000000380)=@chain={'key_or_keyring:', r4, ':chain\x00'}) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1875.596788][T16380] binder: 16376:16380 got transaction with invalid data ptr [ 1875.608325][T16380] binder: 16376:16380 transaction failed 29201/-14, size 24-0 line 3180 [ 1875.621636][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="1a0004e249c505f378106f") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1875.703700][T16383] Dev loop4: unable to read RDB block 2 [ 1875.737349][T16383] loop4: unable to read partition table 09:51:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000060ff00000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1875.814438][T16383] loop4: partition table beyond EOD, truncated [ 1875.891670][T16383] loop_reread_partitions: partition scan of loop4 () failed (rc=-5) [ 1875.961213][T16698] binder: 16696:16698 got transaction with invalid data ptr [ 1875.985057][T16698] binder: 16696:16698 transaction failed 29201/-14, size 24-0 line 3180 [ 1876.024443][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:32 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x40, 0x0) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1ff, 0x0, 0x3}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x14000, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r2, 0xc040563d, &(0x7f0000000040)={0x1, 0x0, 0x103, 0x4, {0x4, 0x6, 0x0, 0xe2}}) 09:51:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000fdfdffff00000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1876.336255][T16808] binder: 16803:16808 got transaction with invalid data ptr [ 1876.360081][T16808] binder: 16803:16808 transaction failed 29201/-14, size 24-0 line 3180 [ 1876.403150][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000400000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:32 executing program 4: setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcb, &(0x7f0000000180), 0x4) socket$inet6(0xa, 0x8000b, 0x8) 09:51:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x6, 0x2) r2 = dup(r1) accept$ax25(r2, &(0x7f0000000180)={{0x3, @bcast}, [@rose, @bcast, @null, @rose, @default, @null, @bcast, @bcast]}, &(0x7f0000000140)=0x48) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r3 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r3, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:32 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:33 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:33 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x10, &(0x7f0000000180)=0xffff, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) fcntl$F_GET_FILE_RW_HINT(r2, 0x40d, &(0x7f0000000380)) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) sysfs$2(0x2, 0xffffffff, &(0x7f0000000300)=""/123) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video2\x00', 0x2, 0x0) write$binfmt_elf64(r0, &(0x7f00000001c0)={{0x7f, 0x45, 0x4c, 0x46, 0x80000000, 0x7fffffff, 0x10000, 0x8e28, 0x1, 0x3, 0x3f, 0x7, 0xb8, 0x40, 0x264, 0x0, 0x4, 0x38, 0x2, 0x200, 0xffffffff, 0x2}, [{0x7, 0x7, 0x100000001, 0x2, 0xb4, 0x8, 0x9, 0xfeb}], "ac157dd3181080ddba7f33b7dadafaadac2182a3c07677481c3f9cbdac70d3dfe1b5bfdc5bdd98d1b83e9f6be4f0b683c0120f0ac93ae5005b452a24a2ce3a2a562759e74e9114ba1681d99241a4b58822bc70351bf4444df147cfed67a80a417569eaacac8558afcd3fe7746b0a35e0ffae36fbfee18ad1c1077ed1ef20676fe9228ba1964bc526d4"}, 0x101) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") syz_init_net_socket$ax25(0x3, 0x5, 0x6) 09:51:33 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x1, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000140), &(0x7f0000000240)=0x6) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x6, 0x5, 0x4, 0x2, 0x7d75, 0x1}) ioctl$KVM_GET_CLOCK(r1, 0x8030ae7c, &(0x7f0000000100)) setsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000280)=0x1, 0x1) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f00000000c0)={0x0, @aes128, 0x2, "8e86fab08f02c655"}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f00000001c0)={'security\x00', 0x2, [{}, {}]}, 0x48) write$P9_RMKDIR(r1, &(0x7f0000000040)={0x14, 0x49, 0x2, {0x0, 0x2, 0x5}}, 0x14) 09:51:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000ffffffffff600000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:33 executing program 5: stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_mreq(r0, 0x0, 0x24, &(0x7f0000000100)={@local, @dev={0xac, 0x14, 0x14, 0x20}}, 0x8) r1 = accept4(r0, 0x0, &(0x7f0000000280), 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket$inet(0x2, 0xa, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') 09:51:33 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) creat(&(0x7f0000000340)='./file0\x00', 0x48) r1 = openat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x40000, 0x1) getsockname$inet(r1, &(0x7f00000002c0), &(0x7f0000000300)=0x10) r2 = syz_open_dev$media(&(0x7f00000001c0)='/dev/media#\x00', 0x10000, 0x400) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r2, 0x28, 0x1, &(0x7f0000000240)=0x2, 0x8) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = dup2(r0, r3) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x132224) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r4, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r4, 0x84, 0x12, &(0x7f0000000140)=0x72f, 0x4) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") ioctl$SG_GET_SG_TABLESIZE(r4, 0x227f, &(0x7f0000000180)) [ 1877.204241][T17334] syz-executor.5 uses obsolete (PF_INET,SOCK_PACKET) 09:51:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000740000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000ffefffffff7f0000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:34 executing program 4: 09:51:34 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000940000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:34 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x20000, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000040)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000080)=0x1c) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f00000000c0)={r2, 0x2}, 0x8) [ 1878.129881][T17858] binder_transaction: 4 callbacks suppressed [ 1878.129891][T17858] binder: 17856:17858 got transaction with invalid data ptr [ 1878.162494][T17858] binder_transaction: 4 callbacks suppressed [ 1878.162513][T17858] binder: 17856:17858 transaction failed 29201/-14, size 24-0 line 3180 [ 1878.201053][ T3269] binder_release_work: 4 callbacks suppressed [ 1878.201061][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:34 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:34 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet6_dccp_buf(r2, 0x21, 0xf, &(0x7f0000000140)="04a2fca2fa63c7c7084839b85f3583d3b58a71b0d42fe6b79f5a9dff90584c3224f6c1bdd1f9d4137762b9d1c40e508a6a96d6bed75a226095cfd88c9d6aad01ee74e4e967a143629d8621ce4fc425aa16884063b2c210fd65512b714af02180942843e8a478527593dbf3ab2a73ab67edd71f6186e7f5ec37d868ae8158ed55ce66d32a6495c93944a757", 0x8b) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000240)="0adc1f123c123f319bd050565ad38ae45f2913ae042fcf71011821dfc76d8cd38ee0e1eca9afc86505dedc7542fc7cfee9bd2908745fa070105c643b4c579cf49012ffaf0ef658b7a90dc2e70a3137acfcf4106c528a6c2b47e8ee5aa547e34395856d4594f5cb356e86387bad104910499c9871f854bd7a07fe52390e7f99b4646d8186b2cca336c81573cfe3d06821b6b59ebfa5f17ba3632b4ebd89e8898b") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) r2 = dup(r0) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f00000000c0)=0x224564, 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x34) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000080)=0x1c) 09:51:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000715000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1878.566462][T17976] binder: 17971:17976 got transaction with invalid data ptr [ 1878.580826][T17976] binder: 17971:17976 transaction failed 29201/-14, size 24-0 line 3180 [ 1878.598372][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000070c000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1878.818117][T18174] binder: 18173:18174 got transaction with invalid data ptr [ 1878.836881][T18174] binder: 18173:18174 transaction failed 29201/-14, size 24-0 line 3180 [ 1878.857541][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:35 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x57, 0x20240) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_PORTS(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x12400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x400, 0x70bd2a, 0x25dfdbfb, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) write$FUSE_GETXATTR(r1, &(0x7f00000001c0)={0x18, 0x0, 0x5, {0x5}}, 0x18) 09:51:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x2000, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:35 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000050d000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1879.317473][T18488] binder: 18487:18488 got transaction with invalid data ptr [ 1879.336626][T18488] binder: 18487:18488 transaction failed 29201/-14, size 24-0 line 3180 [ 1879.363415][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:35 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x1fffffffffffff50) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000001004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0xe, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) accept4$packet(0xffffffffffffff9c, &(0x7f00000000c0)={0x11, 0x0, 0x0}, &(0x7f0000000100)=0x14, 0x80800) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000140)={@local, @empty, r2}, 0xc) 09:51:35 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1879.637878][T18593] binder: 18591:18593 got transaction with invalid data ptr [ 1879.687504][T18593] binder: 18591:18593 transaction failed 29201/-14, size 24-0 line 3180 [ 1879.735799][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000002004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1880.070363][T18807] binder: 18806:18807 got transaction with invalid data ptr [ 1880.086732][T18807] binder: 18806:18807 transaction failed 29201/-14, size 24-0 line 3180 09:51:36 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0xfffffd14) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x4802, 0x0) r2 = msgget(0x1, 0x100) msgctl$MSG_STAT(r2, 0xb, &(0x7f0000000100)=""/84) getresuid(&(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)=0x0) ioctl$TUNSETOWNER(r1, 0x400454cc, r3) [ 1880.111145][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x30300, 0x0) ioctl$VIDIOC_SUBDEV_G_CROP(r2, 0xc038563b, &(0x7f0000000080)={0x1, 0x0, {0x3, 0x10b, 0xe7f, 0xe1}}) 09:51:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000003004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:36 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x5}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f00000001c0)={r1, 0x4a, "11fb344d1f4eb40a2a5797597cb3837cef71257d24eaa7f25b68c7d2aefcf727e10f903d6df66b84594594914f5ee6863c7a2704270d5e79338f17c91b1cdfd1ae0318b2e127255d1a5b"}, &(0x7f0000000240)=0x52) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) syz_open_procfs(r2, &(0x7f0000000080)='net/packet\x00') r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r3, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:36 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:36 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x3, 0x2) ioctl$KVM_GET_MSRS(r1, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{}]}) [ 1880.356958][T18919] binder: 18916:18919 got transaction with invalid data ptr [ 1880.397014][T18919] binder: 18916:18919 transaction failed 29201/-14, size 24-0 line 3180 [ 1880.425748][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000004004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:36 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000140), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_UNLOCK(r2, 0x4008642b, &(0x7f0000000240)={r3, 0x4}) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000180)={0x8, 0x5, 0x3, 0x0, 0x18, 0x67, 0x7, 0x7fffffff, 0x6, 0xfff}) [ 1880.734571][T19234] binder: 19233:19234 got transaction with invalid data ptr [ 1880.745662][T19234] binder: 19233:19234 transaction failed 29201/-14, size 24-0 line 3180 [ 1880.761731][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:37 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfffffffffffffffa, 0x2040) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000000c0)={@empty, @empty, 0x0}, &(0x7f0000000100)=0xc) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x20, &(0x7f0000000140)={@initdev, @rand_addr, 0x0}, &(0x7f00000001c0)=0xc) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0}, &(0x7f0000000240)=0x14) recvmmsg(r0, &(0x7f0000003ac0)=[{{&(0x7f0000000380)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f00000009c0)=[{&(0x7f0000000400)=""/75, 0x4b}, {&(0x7f0000000480)=""/204, 0xcc}, {&(0x7f0000000580)=""/92, 0x5c}, {&(0x7f0000000600)=""/159, 0x9f}, {&(0x7f00000006c0)=""/248, 0xf8}, {&(0x7f00000007c0)=""/23, 0x17}, {&(0x7f0000000800)=""/227, 0xe3}, {&(0x7f0000000900)=""/139, 0x8b}], 0x8, &(0x7f0000000a40)=""/194, 0xc2}}, {{&(0x7f0000000b40)=@in={0x2, 0x0, @multicast2}, 0x80, &(0x7f0000003000)=[{&(0x7f0000000bc0)=""/10, 0xa}, {&(0x7f0000000c00)=""/69, 0x45}, {&(0x7f0000000c80)=""/60, 0x3c}, {&(0x7f0000000cc0)=""/142, 0x8e}, {&(0x7f0000000d80)=""/60, 0x3c}, {&(0x7f0000000dc0)=""/4096, 0x1000}, {&(0x7f0000001dc0)=""/145, 0x91}, {&(0x7f0000001e80)=""/135, 0x87}, {&(0x7f0000001f40)=""/4096, 0x1000}, {&(0x7f0000002f40)=""/191, 0xbf}], 0xa, &(0x7f00000030c0)=""/56, 0x38}, 0x9}, {{&(0x7f0000003100)=@nl, 0x80, &(0x7f00000031c0)=[{&(0x7f0000003180)=""/54, 0x36}], 0x1, &(0x7f0000003200)=""/158, 0x9e}, 0x3f}, {{&(0x7f00000032c0)=@sco, 0x80, &(0x7f0000003480)=[{&(0x7f0000003340)=""/29, 0x1d}, {&(0x7f0000003380)=""/178, 0xb2}, {&(0x7f0000003440)=""/29, 0x1d}], 0x3}, 0x5d09d008}, {{0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f00000034c0)=""/25, 0x19}, {&(0x7f0000003500)=""/218, 0xda}, {&(0x7f0000003600)=""/189, 0xbd}, {&(0x7f00000036c0)=""/193, 0xc1}], 0x4}, 0x80000000}, {{&(0x7f0000003800)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000003a40)=[{&(0x7f0000003880)=""/145, 0x91}, {&(0x7f0000003940)=""/189, 0xbd}, {&(0x7f0000003a00)=""/55, 0x37}], 0x3, &(0x7f0000003a80)=""/48, 0x30}, 0x100000000000}], 0x6, 0x40000000, &(0x7f0000003c40)={0x0, 0x1c9c380}) accept$packet(0xffffffffffffff9c, &(0x7f0000003c80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000003cc0)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000003dc0)={{{@in=@multicast2, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@remote}}, &(0x7f0000003ec0)=0xe8) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000280)={0x0, @aes128, 0x0, "5556d4492b3c7ad1"}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000003f00)={'vcan0\x00', 0x0}) accept$packet(0xffffffffffffffff, &(0x7f0000004000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004040)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000050c0)={{{@in=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@multicast1}}, &(0x7f00000051c0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000052c0)={{{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@initdev}}, &(0x7f00000053c0)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000006800)={{{@in=@broadcast, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast2}}, &(0x7f0000006900)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000006c80)={{{@in=@empty, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000006d80)=0xe8) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x23, &(0x7f0000006e00)={@local, @initdev, 0x0}, &(0x7f0000006e40)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000006e80)={{{@in6=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@local}}, &(0x7f0000006f80)=0xe8) getsockname$packet(0xffffffffffffffff, &(0x7f0000006fc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000007000)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000007040)={{{@in=@empty, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}}}, &(0x7f0000007140)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000073c0)={{{@in6=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@loopback}}, &(0x7f00000074c0)=0xe8) getsockname$packet(0xffffffffffffffff, &(0x7f0000007500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000007540)=0x14) accept$packet(0xffffffffffffffff, &(0x7f0000007580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000075c0)=0x14) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000088c0)={0x0, @loopback}, &(0x7f0000008900)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f000000bc00)={'bridge_slave_1\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f000000c380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f000000c340)={&(0x7f000000bc40)={0x6d4, r2, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [{{0x8, 0x1, r3}, {0xb8, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r4}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}]}}, {{0x8, 0x1, r6}, {0xb0, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x800}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}]}}, {{0x8, 0x1, r8}, {0x78, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x401}}}]}}, {{0x8, 0x1, r10}, {0xd0, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x36bc752c}}, {0x8, 0x6, r11}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xf1}}, {0x8, 0x6, r12}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r13}, {0x13c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r14}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x77}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff9}}, {0x8, 0x6, r15}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}]}}, {{0x8, 0x1, r16}, {0x160, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r18}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0xd9}}}, {0x74, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x44, 0x4, [{0x978f, 0x10000, 0x3ff, 0xfffffffffffffffd}, {0x1ab0, 0x1, 0x6, 0x7}, {0x5, 0x5, 0x41, 0x3}, {0x8000, 0x9, 0x3f, 0x3ff}, {0xfffffffffffffff9, 0x1, 0x80, 0x7}, {0x20, 0x0, 0x7, 0x2a8}, {0x0, 0x100000001, 0xfffffffffffffff8, 0x7}, {0x6, 0x3ff, 0x39c8, 0x1}]}}}]}}, {{0x8, 0x1, r19}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xd146}}}]}}, {{0x8, 0x1, r20}, {0xf8, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r21}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r22}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r23}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x3c7d0f5f}}}]}}]}, 0x6d4}, 0x1, 0x0, 0x0, 0x1}, 0x4040080) 09:51:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x0, 0x0) accept$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000001c0)=0x14) r3 = dup(r0) bind$xdp(r1, &(0x7f0000000200)={0x2c, 0x4, r2, 0x2c, r3}, 0x10) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") mq_timedsend(r3, &(0x7f00000000c0)="677a78d124803351f434370b976deb63f74ec82b5c71aa8254bd30ea2dbea7bc17e330a39b64dfecdc6ec56ea580ab0eb0f927f62af10367a0dcfbc50e9746b1ff28b1a61cd4fdd7b585882f722303bb692864ac16e07289713f70eb2cf08d98f4b5b4b462f88935d4048fd47966a6104d3cceda10989a05f062a7f24d10050b3cb7932c6adb988048d3", 0x8a, 0x29, &(0x7f0000000240)={0x0, 0x1c9c380}) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x40000, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r4, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:37 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000005004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000040)='\x00', &(0x7f0000000080)='trusted.overlay.nlink\x00', &(0x7f00000000c0)={'U-', 0x237}, 0x28, 0xf0263c5f5ea6d5cd) r2 = syz_open_dev$mouse(&(0x7f0000000280)='/dev/input/mouse#\x00', 0x9, 0x2000) sendmsg$kcm(r2, &(0x7f0000001140)={&(0x7f0000000880)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x4, 0x4, 0x2, 0x4, {0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xf}}}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000900)="0d616f883ec5", 0x6}, {&(0x7f0000000940)="958aa4a512f61ff94bf5b9b023114bead03aef7d51f24e94ae6413d90e1949", 0x1f}, {&(0x7f0000000980)="ae06e7e918f199cf54885a03b43e9fbda9d310aabda869b3fa7c", 0x1a}, {&(0x7f00000009c0)="e0338150564b063f682f25a155b5f74ecb299c61ffc7078a615d8053ad7900280e5f8923d6fc57d9dc285cf76807837645fb5471275a6d023211a3ac64d986b183676c1ffc9c5df84297d96b06b91d259183716a5486b04b50", 0x59}, {&(0x7f0000000a40)="003e1b54616b25", 0x7}, {&(0x7f0000000a80)="68b45ba53fce48738335177c6ae94f5e6807804579189af25c1789279b0f0a717858be27dd9e30c417d7065b296893594c5d660d399a2fe6ac756dad7c897b33cbbaad19395935f5e382bafbb02bc8f41d7b9d10daa0", 0x56}, {&(0x7f0000000b00)="d69e6e68357f86a59c322ba711206ba6d4996ad960e76738c462d1898feec9cbb892c5bfaccc9ba5dd81ea49c768406b7aa7966703cdddd0f49808bc2e97", 0x3e}, {&(0x7f0000000b40)="e5f945fa88e88dab7881058363edfb43ad440bb58ce389044a47f08776fa7c71bc8b0c60aca2be0e37692634e7d3384b9f8fad54eede7d6e3d1c4d9f27efcc172f04a9bfccd08ac3", 0x48}, {&(0x7f0000000bc0)="c319b683a476a8845eeb567863875dbb79b49147d4bd79ad67b47effddb365ad1e459bf11b590dc655f7d12f330cba3730b8386881c1f0e9e0de548b0f5b087e9e36c5ba5332b1fb417a908cd6e1f07c6cc11afaa69f35fce16ed2edd58c0b98a5366dbbd17950abc4243e0fff363f61dee1053471b7673ba8deaf4eb5bebaeb58836905ee8938286526c27cc09b164091f07e24522083688dcb99b39858dc50b259c3d59f0b60a352968ea7330d9c9edd98e58bd4ff4e3f612b960a4978986709f520c959ae43d03e", 0xc9}], 0x9, &(0x7f0000000d80)=[{0xf8, 0x101, 0x57f, "b0c8830282504001a1aa87466742f67b89b29ff053bd9c7dff43011d846bba3eb43cd8f66f070d70d6fa2aa40ab6edae7cd0768d322d8f6e46c35f0f63d8f8f8daaaf196e193adff102face013fe59dbac2fbb08603b34b95b9746c4ff7ae3309c514fab0b5c68b1a0373caead7d1661103a4b57bd21ffb5e378bd773ebb9fd1f8ded788cf6dba5b8226df3f8b2910a051681f1e3e3a461299e351c21d3c9e51b71b8df36ba4760daa51643a4cee21518a0746b7cffa37d2854adf808e16244733d69f1b3be778b4705507552bad49ebfce617f71aa6917780990638424d87ea1e856249544d46f6"}, {0x18, 0x10f, 0x4, "564911a85a5239ba"}, {0xd8, 0x112, 0x4, "ce3220c7b5f929aeef883684b399cf1801476454d9d0ef6a7640d82d02a24724577c713d0763e540ae7bc41ad3bd0c920ccd8f78c43c089eda738a04fce836645d2206b33212d134bea3bda8e3ae85bd33f6e0298434750bab1e9c9e0ab9874eeeca40ca6169a12fcf91638f27381f7bcfbde828aa08d9900453deb226d52ee0c50f3331ebc3ce99fb62eee63ffebc4e563b102d293410146eb4fc05d67854cf67fdd2a4e8645835d56c1b2a02f449884ac1ff25dca6c5e2bae5fb3cd7022fdf925612d879"}, {0x88, 0x1ff, 0x9, "fc2c64e5768a4faef560aa2b5aced4ec84253e36adee54d8b293f84b0e5d95628093ae25d7d807ed1eae0b5858b8a4fecf6245abbc246a2180a0f07da012418fce360746eaa8d341a8b9ed406469cb9aa041a58c29b23f154b39d05439d6cb8b890ddbe4fccbcc827b125a34e9a29c564527dfcd3129"}, {0x40, 0x10f, 0x3f, "eebd755b86d1d97cf591937608c0b646212a25dffc511360931a946c263e4187dc4761aca24c53fd1dcddc74f8713fc5"}, {0x108, 0x107, 0x32, "3cc29f31862da95f3ae6df1aa8aee438cebd2c3a63bcf481b256e083a810d8c838075e43fc9ef9d5e6fe5a9f469833561e68d67cde01916862129de83c7b375077128d5c4ec6c343ee52120944994c32e3b787e60c55cadbd70600fb9379ed1227cb38d81afeb0711551e5b0669b500006f6a159763c1253db40ff955f9e6f73f90734cbf69ca4f937a5e824533f2e7d7747eb779bf2fefeeff2a4e9277b61e54031b8252530eb8162d223efda9c1f20d8d004aeb7793213522b8c638a32b445b098619a336520d1fb39472500defe72c0e5e8e7244a0f075e308e61ac7750250b1ff11a8f553d2a40623662b8c3a3b07f8f402da15a1d10"}], 0x3b8}, 0x801) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f0000000140)='./file0\x00', 0x7, 0xa, &(0x7f00000006c0)=[{&(0x7f0000000180)="87903c482175b2265e21c2186f0e2b190c7c68bd4ede02df2e528cc2f26c95f1b3848cfe8144c9453ee84b0bd33969750260a504c2e08f0b4b0da13efbb837c58b0fa2877416e586b029d9b6b63801baad0c4e1b0137900870e7110b67a93dd88cc58857f4ec31728a23ad28ced8dc765c6aed78c13163e34abb07cad6ca82bace1cd79cd83c7dcb11d27a76048d262d36007b750f8ee0425e7fc18bb865b4a715779144c69eeadab4a8ed9e82afe83facbde6fa3ae4677adf955a66bf895d38609ebab4e8eb9929fda2983ca4c0063f771bc39ec5441b66f137adcd38fd3c8161ddd06978906cff9d5959", 0xeb, 0x5}, {&(0x7f0000000280), 0x0, 0xd5}, {&(0x7f00000002c0)="e9f0eccd431c3d4b4534b316fb72040062998758c80ba64f7c4c37e04540817a8c7b6c7a60696e022537fbb2bfe5157fe0364e3a9073deea09d0b1026dad7f329afd6711b350c5562269a4dc8a87053cc049b6081b06de20abe71007db01e0aa8c3c88623b8de6eee889eb9aad27aca103f44813b11beeae5a29e66c9fb698a4ac84c54288b8f3ab485500d93abd7344f01ecbed70a6a0f22edc6d", 0x9b, 0x8121}, {&(0x7f0000000380)="87f4b0ac1b264d2dc2761054e3c2255297cc4f74b1cba98270bfd0ce264a4d1e989a54c0a989e826ee46538db5b44f3cc73f96b0adfa316faea1c1ee4adddb3c4ed04927f4b63e69ada1d531e4141df3eb4e10d963bd5c8c364e0e77a9835b58", 0x60, 0x8}, {&(0x7f0000000400)="1d140dd8b7cafd65de212eaded260126007e40b7f6c6f234608cee236b547d19495bbef435a5d7736948b169ce5b564fe2f0d988aaeda6848adec67a8e17426182241ee0253b5385f1bb9a484edd7c303daccc2dc75ea190ab43274121993766fcc4f91a9a68a26fb7f6a33dc68ccac8ffb36f93708939c636a7ec309ef32caa8802a378e6ed3b44e85ef86d28e40b25485eb23fa95591788048286745c2f4212c1b51ef2df1905fb3afa2f5e83d2397353fcddeba91bc4eeadaefc13ba62356cd2f998da8aa9da7b70c115b86238dd4a42db81c1d0f70826b146317d32d790b03ea25a64f147813dbb8c4e0d807", 0xee, 0x9}, {&(0x7f0000000500)="e58c2995853015aec33d720479d4d0bd5fe92f183e6514c18d5b5f84787bcc6214035d0499d61699874ffec899bae578fd05694f242ab46786ba6f", 0x3b, 0x1}, {&(0x7f0000000540)="385139b129fa3b5bf4a83bb3cea90cbcdc8a6275d280168d46221d0d0ecdf27f70c23c01cefc65", 0x27, 0x31b4}, {&(0x7f0000000580)="fbbf737901df78e77650758615c80cddba1bda38794cb0dd7e94a6e2aa1aada421b0bde2a161d92aba9da0e0f7a18b0a3e816212056f", 0x36, 0xdb9d}, {&(0x7f00000005c0)="f40f784d9df502d7a88e788f2c1e46a1972ce082ea4a44d642c226cd43d73d993518a7a746daee71dc1e53ea33559b6354665c605e4a47e81ed7e80b8016235e433f854531bba63ddf157d01bbd99bcf6971fbfe5464d7333c8d3dfd0bdec062d5a5c67a6dc0e3c44aa3f707ad07c8b39325be4b76814ecbcb088116633f25432f87c493b9bfad6a5aa82f56d841b81f6d51a91ec4241df2cb5adb068f1b249f", 0xa0, 0x8}, {&(0x7f0000000680)="f6492a782d681548643e9ab3ff04ab5b2ff5c5d9cb575e92f0eaeff5fd8cd86c75f4052ca7548839251e", 0x2a, 0x81}], 0x1010000, &(0x7f00000007c0)={[{@noacl='noacl'}, {@ignore_local_fs='ignore_local_fs'}, {@nosuiddir='nosuiddir'}, {@localflocks='localflocks'}, {@noacl='noacl'}], [{@appraise_type='appraise_type=imasig'}, {@func={'func', 0x3d, 'KEXEC_INITRAMFS_CHECK'}}, {@obj_role={'obj_role', 0x3d, 'vboxnet0'}}, {@subj_role={'subj_role', 0x3d, '\'user'}}, {@hash='hash'}, {@dont_appraise='dont_appraise'}]}) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) [ 1881.058528][T19433] binder: 19411:19433 got transaction with invalid data ptr [ 1881.093181][T19433] binder: 19411:19433 transaction failed 29201/-14, size 24-0 line 3180 [ 1881.137767][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000006004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1881.300342][T19617] gfs2: invalid mount option: appraise_type=imasig [ 1881.334480][T19617] gfs2: can't parse mount arguments [ 1881.451992][T19712] binder: 19703:19712 got transaction with invalid data ptr [ 1881.471193][T19712] binder: 19703:19712 transaction failed 29201/-14, size 24-0 line 3180 [ 1881.491600][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000007004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:37 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x2, 0x2) ioctl$VIDIOC_G_FBUF(r1, 0x8030560a, &(0x7f0000000040)={0x1, 0x2, &(0x7f00000001c0)="143228ee38f0b90a17b05d16ad340297105f3d7adfeaafe6d817cdc7203a4004991ec992adb7d7af1206f7d29a9bfdb37dc82e51e1efff5247001d85e27c64579e5b5213cec04175bbfbac1b00d363dfa5d82d8315cf78776263e2a8827bbeec405250fc391f3e3d0d329ccf080c86b181dee40ff172248c5af1e995a37db2b8f91209a73abffb127f0b23808395681649061668d43a27238dd32bd1e6c6b36065e019ff7b239f5e517d01f9d9b3cd6d3a1912bb9d851edb83930495ebdda96c44b5ccfc1d5890b39d33118984249f05af9de56f0374de43e87668cd9479ff3cf27259b8c6f8bf45dc1ecc227b9d55a0364c3a373586ba1dfde3a9fe12da03a554eaebc19d37116fcf1bc5332bc565a2ac7d4a11da95a4fc9a80ce8d32c1ba31c671b64d66f9f9e49f135d88dc9ace679a07820811d83563c382874c1c63aa29c6c07675c2a72310b2c77cfc5471d5064e7f40a3bfc516c8a6bf991243acd213c268dba6515c1f89047292b8723424cd51ac3f8e7e7f61d85311de0d3d958bd97332d035a0c3afb08bb59d9e8d048dd52399701347e18571bf86f4d7d04586c6d09818360e568e8fcb64524868aafb003657656038bc3ec7bd988f51c6acfb3fa5fdf3228d31dcc57ecaec59208051aff08bd173c72c6f813c99d17aadbd9296ae02f4c4b3cc58c3262425fe8732c9f8709c0355d3668e45c237e94de2bc2d00765aa98596337277c48da5a1bddeba4e88408ac640afca106457e671fe2386f7ddc6013c4407522e10f3322b16af0d04e5a4763a605ed2c7b6e117009c32f0a2b0c643fddad5ab6fe3dcc45d5bfa6e16339a18f8923dba34d027b6e3a31ebfe938766e789478cf2d7803d546474544e27200e3bb910143f8a1d13ab3f3b239bdec1a3eed45552f73de4be379a83b4809a1a284b1249f16f6b0a83b801bf15b2c3175ac3ed48957406d6ba2f4ab33242c9ffe1b2e0586cdf0f3ae0dd5c326963c5386549e7f77f94bf95968985e4d5d7d1d8a0ce595b2be37b7675f8fd7d2394ac1f9330b33c23fee8d5f19541016d3db9dc56ac9ffdbf0e69751f50bc53a932ed9899b7f7973c4dfc3c331c301af2a681a8915460ab40ef50bc823907f674aff03543ca81fd162684475e06b969d283595c23504b0224b3ba579c0c6a515ecff763e5d3d331fa3aee68204929df2d326eeeafd798494f3a8528cdbd7375f9fc2001e5bb530a3ac894f965ae2a809c16b668387480e38756aae4791080801770a53294d49b48be5e30bfe5a164dc119d4c56e224fc57ab9f2f5669700dc53650fca1817465947afc8be2da58ff1f0f8aaac71196b03ea51fd00067ee5a17d46e7947aa46d8b2510d26385677f09e8f4e8e89314d21ee14f4d5dd867a62de927d1afeebfaca8446249ed5505ed9364a85ce4310c7bedb834fe758137ea9a96dda474b5fb79208d6bbb4be9995db6c13bc9863eead33bb73a81785214f86ffdefcf650eaca378e77a8dc0f7224311d0163a8bd4c803d48e529e0115f08e282834d7388a87e9d009e6715fcb7748f96e0e5c9b7a9431a4c16565e6cfd0e74ecaf24a81977094adf60cb836f82e99b6f1ad27028ae59c65fab411e0360758062e009e3167bfcc506067865de173a7b715065cafca64ada787529cc522fef7493d64ca9a096bfc2571ea9ccfbac3f2fa4b6998aae210a984137b80f0741049aeb0d931201aeaade4d318ca00d54cc52be660b9e77735356ecf1db1a49e395a3243a6e00227805a284d542e9940510fe176f3c97334a0e34cbe3b12f228d620dfef90d9d29170e10444f9a16a1876e31dbec27ca28fe40100ee7e5e6a58be5d834dfd8e50dadd6a4a350334dbe0ea7345cd7a0d5972f34155361f32f42087f9154b1bd833bedffbc6147de0fe1b6a00a4fb04d19da25386c4c1f07dc254d63d838d9de8e637f90da468a128281793d29679320dd396de7b49bbeb17815989ad0000f1b07c3f33046dc862f887c0a19df62e639561676b70ee9b9b0dff1ea818bda4157d9a0c0897cd4b35381fc9b59ce91c6452b59882ef91181a3d29aa92fa51990e69b60598404c309ccb164a57b9526f1c40b4a862f8e6593ec71292de54c7a2f0b3e234c1eac054b229affeb5861c4b176b4f257646d5e1404a9430402e624685bde18a7af92bfb87f94097b8c711d7993d4bebfd73cb5542f9a8e8fe176163a657f647fd702710c1e2e3d1d8c8467835e62165acfc4b9a83600c4286185d6d9e2afc191f9b86b8800c87fa0d1b5ebea7000a4039cdb4fb12f2613605049781a07887981c74142f7d3b665cb18cfebe562327d10a35c5dfea197b3d0f03cf8648981b7f3a5663c448ac0fa39d9a7e173b7c8445430892c067640d774fc9c62b069b20e8503c7ad50cfbd87766a186cc01b1f82f3dac5932b01b08efb00467dc66e5ea252c2fe69dd05035574448ecffc111f49ba2fd3b00427d011ea35de8530e4ea87475b2584ee09ba88539966acdfea07e47e2697113f0774baef5fec48016b174ba219cb7bf7d0f0558233b7accde2fa0f134ff0ca77b776e51e06778ea09ba573599e146e42043cff4ae29fdc11c8dcf2b7c6c3f44c265801d2b0a0cec58380da2bfd54aa0c81ca15e52688e5036125e9cfc6b5ac2cb72345d1bec0bef977a917a213e12ad9d7d0bd71922c35afd43086b9a1c62938ee79425ba35dafb4da7fe043b556ac814c6f965b055d04994a20a0ec1908c82f63dcc969db3e59aef6f3a6441091c0fa065807778f3c5cafca33e736f15fd6b52cf4fafb4e92e24b4e8e8f13ce215fa5ad9339cc1477d99e9397cc8a075ebd1b551aabe054449ddaf3e50289f10c59ef8c93ea3bc9a8c4be96fb514e5644ef45bdfba509df73a804b99ad87deafb4a74b0f41014ade1a29d3cb49f7aab2b4d2fca7ba975375d58836953538328030a97292c2c50a33d6952bbe63ba2d7f3b84ab32d5ad4975cbee75ffc290153dc0f16d716435a348562357a75d84e894b68aea5d4de18cb5ae140e179dd8952767e1bc0b09ed252cc4a42ce3658eeded9454a7456609ef7a8669b1f48a05dbc12d237672b86cee00ad0fe26e0caa0086efee292109807e0dc36f7390bb2aaa48480d8e7d37d9b2fb718d9af9b07431f5052f02029c857c10756543833c5be784457ba7b92c013cb3a88547dbb9f32702c20013d517439f91cec63204b9b71e0339347dc4f54758845c84593483933032d02c0306418d6c82c592e70958065160395bf0335720f224c33c3143c8ea3438e165c254fff205b1bb800ebdf176279050852231fefee04074969a2a30d7366e81722774b06523f386e5e3d333d86d86ce1b2054b70f43b443ca8ef446a4f98750b169b91f593468c86cd5cc627f20a053349aefb6701c06818d43ae09d1d7a2cee2582a5dea549e17cd5e8418ff7034d2b497763a1432ed3ca2f7801f07721a06ef89f78fe476faec0547f010cc804b26b80bca7f5ce80d5ef981d12cb895040a137fc3da52c6bdeb09082c74d2b344a3a3ac0ddab5a83f6a73a94befd7784a17d3623bdee63716aff52d45e0f44992cbd6c60d3bc8996fdb62693d137a47ab852f714a5b92fa3e1e4bf39498c49d4c427192837eb981314dc136267cc81b4ecc8b2a3fe30c0a21487824193505cd49333b3ff5f0c139824ba4ba8b8591ec126205d7ccef0443291d24d5eb52d0e7fb0d7a3b65176c00af3f6f5599e7183cbb7b29fbdaa455067e348e633b7b2553ae2e9cc1aaba6a384e919c381fc40d31d57250db558709e6f18fb72279e63c51084c41751bf0681d2b33428cc13e457fabb97de66c24838afedcb1a2b9113545320c7461ed2d332ccc1d44ada574f96036d6111658ac0c1197216c101eaac2e0fce6c71f89b0007f8a6117ec6dbb62bf47984ae91217ca302ea81c673351ca99a56e8e451aa8cce6e426916339f0e17b3880f4f7d08ebad55cde4ff22467bdc290b814ada9230d8e6cccb945a309cabaa37b44732e09fac9f69791457281644c61c9734557411fbfb2a69054de0d5c078f4a47115639905208487da87342a4952547e0c9cd1448889fae7758597f8203b82810807cf384efc5422678ad9f387975166b5d53fb9779caba65d22b26af5e3414f0f1c09cc01bf3cfa0592995eb9e825b9582da5468495a882ae253501caad37a73b62580135ba4101716bf9aabcc4dc7d9d29e7b6837cdc86ba5e85d0abc96e4762e8147619bf539f3100f24959ab46b7001ccc9c9129324641a1aef8265aedf3ff27c73049e9658c09b056c2b9691fb2fc1232749b76cd1a09c873bc3e59f95f785d5ff1fc7d3ea6d817406702ca2f18bbf772c77c7345560201eddfcc2cda438d788fceaca7975d4e6b975bc0e5d4728524ee4b13a346940dc344af9af63342caf233d78356ea7d3d534d256eed26610544d1ed2ff2d6ab1babbee8a4f1b55b82a245f0f87a7eba10cf11d1dcf452aba94ff3674b53d87784df575bb87450141ab405f06b8c143de7f0731f4f9917053e6e282d6426797892bdeba81fe0088326272de9892677f5e1535243818b74db5d9ce9280c39a1365b0fed7d6674776c2b476f382e66c5c2ca7200eb0b9eb32a520e9eb7faf2d917112d51c566b0c0446c689d5afbba24b47de0156418ab1f0545ae2e49130d2d9e482da4bebd7500fe19ce6a7b148941d7459adbc81f6f214f6e5b2082bece4179813f66e66a702b307e46b833e0ee8a0667ecbe1bdf8a894c3c188887b742c916242a11b3503a7a7303a691814e0e350d1742effe39f1df17a4758f0245d5b000b0dc6154e8f6fc65ee1e307f42ede7c5dd62179b01a082f02624e32ee7b5460314515bcd7c14b8a9ee99dfa006b4dceccebcf5ac11c51b84698ec5f1fb85e5297bc8d64388443d882aa1f72d4df8be440fc6e8250a745e151ff76ba673840ded7b795b827f140c8ce31cd52814605c18b135037514c7eb3d415b00d6c4da1d12e58cdd06ce5cddc2465bda907737eceea9aa8c0bbd8c6a286211af11f0a44cc2d9a2e1d00140425a77adaf6403540e9efa31c8617399f2ae17f184ede7f11ffc35db6b87917da6843772c13a42125d828a7378b081b1273b5d3ad3596d1334dbb806e4e466cd7e78740358c2712cced2c67afcdb2c7ffd7695461b3cf81b283ed58b0f2e4833415774f4677b7f747c98180133742f080fb86d50d5acf29833e9d7bb41e3b7ebe40078b5e38fd68f12946eabbd2cb350873ddeccd4f3434d58dab0135c90925517e686ad665958d603228cb8fe3520aea542dcfc9f17202493d9ffceaf8d26bfcfe0b765f86420e23e2ebc8d5b2876d1bfb5ccd684108bfcd7e0e81890bbf964dbf5f1475b6c62e9080513689c2c9fd5521c206e894ec6e0b08fac95529bfbb60f804f800b3838689a2e262bf6736b862baff750c5bbada49a699ed7bf3ed5faf61de58729a354adb3da6e36b677164497f892c63acc3d1b297eafdc48df6152059393ea95cf0381c7a2bbcd7afd9f75d2c426924c6bcf9ebb16f07b29ba502d6e0734ffb12fb649f26dc9a1531e8d7972bfb295771639c0fdfdc77ee7ade44a488dff1584b69b7c9eabc695d7116e41381018f13d9ad2af9536ce706f1d572dd38ad4604e22f1785a602da0019682717cbc5c05bfac2f18d6b40eee1de72c2d1493510d7be20507fa614c0769b12da9aff605aa94e01976e54280085ad73d2f7b9e5fac768ad558d9a6adedb4b28104f94584b74946f2580273dde9ac1460dd6d8cbe279bc7378524c04684c", {0x156, 0x3, 0x303d705f, 0x3, 0x8000000000000, 0x401, 0xb, 0x6}}) [ 1881.587862][T19549] gfs2: invalid mount option: appraise_type=imasig [ 1881.610899][T19549] gfs2: can't parse mount arguments 09:51:37 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:37 executing program 5: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) r3 = syz_open_dev$vbi(&(0x7f00000000c0)='/dev/vbi#\x00', 0x3, 0x2) clock_gettime(0x10000000000, &(0x7f0000000300)={0x0, 0x0}) futex(&(0x7f00000001c0)=0x1, 0x80, 0x1, &(0x7f0000000240)={r4, r5+30000000}, &(0x7f0000000280)=0x1, 0x0) ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000140)={0x4, 0x5, 0x4, 0x800, {r1, r2/1000+10000}, {0x2, 0x1, 0x5, 0x7, 0x100, 0x3, "70af0ce2"}, 0x7, 0x3, @planes=&(0x7f0000000100)={0x1, 0x8, @fd=r3, 0x7}, 0x4}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) prctl$PR_CAPBSET_DROP(0x18, 0x23) ioctl(r6, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket$inet(0x2, 0x4000000000000001, 0x0) 09:51:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) r1 = dup(r0) ioctl$CAPI_MANUFACTURER_CMD(r1, 0xc0104320, &(0x7f0000000300)={0x5, &(0x7f00000002c0)="3945b098ceb6554b5699fa5fb1982cc20a912e9451feab25601ada1f957de048ec86565d84c87fbef9e0e77f717955c5b7885e"}) connect$inet6(r0, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) ioctl$KDGETMODE(r3, 0x4b3b, &(0x7f0000000340)) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x200000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r4, 0x10, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000380)) 09:51:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000a004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f00000001c0)={0x54a4, 0x5, 0x5}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) r3 = socket$inet(0x2, 0x805, 0x3f) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x7}, &(0x7f0000000080)=0x8) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, 0x7530}, 0x10) setsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f0000000180)={r4, 0x54, 0x4, 0x4}, 0x10) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f00000000c0)={0x80000001, 0x4, 0x0, 0x3, 0x266f, 0x125, 0xfffffffffffffe00, 0x9, r4}, &(0x7f0000000100)=0x20) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:38 executing program 4: 09:51:38 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:38 executing program 5: r0 = accept4$nfc_llcp(0xffffffffffffff9c, &(0x7f0000000040), &(0x7f00000000c0)=0x60, 0x800) r1 = dup2(r0, r0) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000200)={0x2, &(0x7f0000000100)=[{0x4, 0x6, 0x800, 0x400}, {0x7, 0x1, 0xaa2, 0x8}]}) syz_open_dev$mouse(&(0x7f0000000140)='/dev/input/mouse#\x00', 0x8, 0x8000) r2 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x2, 0x200000) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000180)={0x9, 0x11, 0x5, r0}) tee(r0, r3, 0x3, 0xf) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r5 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r5, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000012004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:38 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xd2a, 0x40800) ioctl$VIDIOC_G_INPUT(r1, 0x80045626, &(0x7f0000000040)) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 09:51:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0xfffffffffffffffe, 0x40000) recvfrom$netrom(r1, &(0x7f0000000080)=""/250, 0xfa, 0x1, &(0x7f0000000180)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x2}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}, 0x48) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000240), &(0x7f0000000280)=0xb) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x1, 0x200000) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000018004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:39 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:39 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = accept$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000240)=0x1c) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000280)={0x7, [0x80000001, 0x0, 0x156, 0x7fff, 0x7, 0x80000001, 0x20]}, 0x12) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm-monitor\x00', 0x400040, 0x0) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000300)) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x1, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x4, 0x8}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f00000000c0)={r4, 0xb8, "595c8d27ee1d9c04846b2bb7a3deeecc9ac2371b3aec7a1726ba1bb5b9b8d449468c0ffad464e19b72feb2cce59c9d3d8e1a0b3712f20aba0fec542523cff3be571e436ba6e7a48f1d22c8dfb11ad11ba28abe93a6b6f3c1b53fe3d350e27b46d4a5b249fc9c82e2399ba0a7e471798eb7fe2eb10922cf57a8f3cdc2edcc316103a895d4ebbfbdb5f248ef611e11cd03a9295701f6750fa650292e29a2547472defd540ecf4d6f3eaa5643f5e4628d2b7198ed462c0d7856"}, &(0x7f00000001c0)=0xc0) 09:51:39 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x180000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0xd1, 0x4000) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=""/157}) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) get_thread_area(&(0x7f00000000c0)={0x7, 0x20000800, 0x400, 0xfffffffffffff81d, 0x0, 0x20, 0x8, 0xffffffffffffffd4, 0xf0, 0x1f}) r3 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x1, 0x20040) ioctl$TIOCMGET(r3, 0x5415, &(0x7f0000000300)) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000280)='/proc/thread-self/attr/current\x00', 0x2, 0x0) getsockopt$inet_buf(r2, 0x6, 0x1a, 0x0, &(0x7f00000002c0)) 09:51:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000020004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000003f004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1883.455162][T21039] binder_transaction: 5 callbacks suppressed [ 1883.455173][T21039] binder: 21038:21039 got transaction with invalid data ptr [ 1883.486511][T21039] binder_transaction: 5 callbacks suppressed [ 1883.486529][T21039] binder: 21038:21039 transaction failed 29201/-14, size 24-0 line 3180 [ 1883.513004][ T7899] binder_release_work: 5 callbacks suppressed [ 1883.513012][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:39 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:39 executing program 4: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='\x00', 0xffffffffffffff9c}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0x1, 0xb189, 0x3, 0x8, 0x2, 0x1, 0x405, [], 0x0, 0xffffffffffffff9c, 0x249, 0x8}, 0x3c) r0 = socket$caif_stream(0x25, 0x1, 0x1) r1 = dup2(0xffffffffffffff9c, r0) ioctl$TUNGETFILTER(r1, 0x801054db, &(0x7f0000000000)=""/218) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000200)=0x4, 0x4) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r2, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) accept$inet(r0, &(0x7f0000000040)={0x2, 0x0, @initdev}, &(0x7f0000000080)=0x10) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x11, 0x2) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f00000000c0)={'icmp6\x00'}, &(0x7f0000000100)=0x1e) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x0, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000180)={0xb, 'syz1\x00', 'syz0\x00', 'syz0\x00', 0xa8, 0x80, 0x6, 0x7, 0x9, 0xff, "624b3238dbb9680beac06fdecc22806ba457cda9b91597a3b22e4253b6861a8fe05a4bade35df6379c9e8d9c5fae4d1f782f3b956a9c7dfc44e664c7bf64208e247335f697e9bdbdadd4ed1b1eabb17fb06a57a11b066d9e2cdaf40d056d37215c7fedc0eeb03ea6a59148ac24e935c0c8d092559a1419e5a2c86c941db57548661f5ca24b2daa76729b817bad0e7adc7bb5ab78dd94a167c3ad280ee8af3874465f35ff87eb700f"}, 0x1c0) 09:51:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000048004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1883.736824][T21151] binder: 21148:21151 got transaction with invalid data ptr [ 1883.775771][T21151] binder: 21148:21151 transaction failed 29201/-14, size 24-0 line 3180 [ 1883.806329][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000004c004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ppp\x00', 0x8800, 0x0) r2 = dup2(r0, r1) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000180), &(0x7f00000001c0)=0x4) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1884.077985][T21357] binder: 21346:21357 got transaction with invalid data ptr [ 1884.097286][T21357] binder: 21346:21357 transaction failed 29201/-14, size 24-0 line 3180 [ 1884.119461][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x8087c, 0x0) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000080)={0x97, 0xfffffffffffffffe, 0x8}) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r2, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:40 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000060004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1884.476155][T21485] binder: 21466:21485 got transaction with invalid data ptr [ 1884.529187][T21485] binder: 21466:21485 transaction failed 29201/-14, size 24-0 line 3180 [ 1884.544011][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000068004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:40 executing program 4: r0 = shmget$private(0x0, 0x1000, 0x1040, &(0x7f0000ffe000/0x1000)=nil) r1 = geteuid() getresgid(&(0x7f00000000c0)=0x0, &(0x7f0000000100), &(0x7f0000000140)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0xc) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = gettid() fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000300)={0x0, 0x0}) shmctl$IPC_SET(r0, 0x1, &(0x7f0000000340)={{0x80000001, r1, r2, r3, r4, 0x20, 0x65bbefbc}, 0x5, 0x3, 0x8001, 0x6, r5, r6, 0x2}) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x10001, 0x40) ioctl$EVIOCGSW(r7, 0x8040451b, &(0x7f0000000040)=""/100) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r8, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:40 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6100) [ 1884.759437][T21675] binder: 21674:21675 got transaction with invalid data ptr [ 1884.784884][T21675] binder: 21674:21675 transaction failed 29201/-14, size 24-0 line 3180 [ 1884.801725][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:41 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:41 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_proto_private(r0, 0x89ef, &(0x7f0000000080)="3fc12b644cfad617b38014ba368c9ee84816483462b3039c668b0b60a22b78fc0f6b60f46e1024243971ab8bd165f420cdd82b7066ac716335fa773e2318e462c815544dd985bbe8d6014952ff8e7e0c064102167ef95baf942797df8155ad49175f5fb06c1b7db5bf27edbdf97a286df499db7f263a99cb5c87939270a545144e582396795cf64f99a4b224ffbe19bb20d40a22c2593d0714a64a2f160097836a1fb16f16a485a93794600fc7adafecaf23c1bbd94a0df1") r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101, 0x0) ioctl$SIOCX25GFACILITIES(r1, 0x89e2, &(0x7f0000000040)) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) ioctl$VIDIOC_G_SELECTION(r1, 0xc040565e, &(0x7f0000000140)={0x7, 0x100, 0x2, {0x2a8, 0x101, 0x2, 0x8}}) 09:51:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = socket(0x100000000a, 0x1, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000080), 0xfffffffffffffffd) sendto$inet(r1, 0x0, 0xc8, 0x0, 0x0, 0x2d7) connect$inet6(0xffffffffffffffff, 0x0, 0x0) 09:51:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000006c004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:41 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x8000, 0x0) getsockopt$packet_int(r2, 0x107, 0x0, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r3 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1885.222421][T21896] binder: 21885:21896 got transaction with invalid data ptr [ 1885.233911][T21896] binder: 21885:21896 transaction failed 29201/-14, size 24-0 line 3180 [ 1885.248594][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000074004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1885.425239][T22101] binder: 22100:22101 got transaction with invalid data ptr [ 1885.441000][T22101] binder: 22100:22101 transaction failed 29201/-14, size 24-0 line 3180 09:51:41 executing program 5: seccomp(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xffffffff}]}) r0 = openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/attr/current\x00', 0x2, 0x0) fadvise64(r0, 0x0, 0x0, 0x0) [ 1885.512435][ T3269] binder: undelivered TRANSACTION_ERROR: 29201 09:51:41 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000007a004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1885.837897][ T26] audit: type=1326 audit(1556877102.035:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22208 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45bc0a code=0xffff0000 [ 1885.858008][T22320] binder: 22317:22320 got transaction with invalid data ptr [ 1885.873775][T22320] binder: 22317:22320 transaction failed 29201/-14, size 24-0 line 3180 [ 1885.903650][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000080004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:42 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000100)) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000040)=""/139) [ 1886.072729][T22423] binder: 22422:22423 got transaction with invalid data ptr [ 1886.135579][T22423] binder: 22422:22423 transaction failed 29201/-14, size 24-0 line 3180 09:51:42 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1886.215037][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000fffffdfd004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1886.435881][ T26] audit: type=1326 audit(1556877102.635:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22208 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45bc0a code=0xffff0000 09:51:42 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) getresgid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)=0x0) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getegid() getgroups(0x5, &(0x7f0000000300)=[0x0, 0xffffffffffffffff, 0xee01, 0xee00, 0xee01]) r7 = getgid() r8 = getegid() setgroups(0x6, &(0x7f0000000340)=[r3, r4, r5, r6, r7, r8]) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") getsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000380)={@multicast1, @remote}, &(0x7f00000003c0)=0x8) [ 1886.507333][T22634] binder: 22633:22634 got transaction with invalid data ptr [ 1886.526790][T22634] binder: 22633:22634 transaction failed 29201/-14, size 24-0 line 3180 09:51:42 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x0, 0x0) lseek(r0, 0x3, 0x1) [ 1886.565663][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:42 executing program 5: r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000080)='.\x00', 0xfe) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') preadv(r1, &(0x7f00000004c0)=[{&(0x7f0000000400)=""/159, 0x9f}], 0x1, 0x0) preadv(r1, &(0x7f0000000700)=[{&(0x7f00000000c0)=""/106, 0x6a}], 0x1, 0x0) 09:51:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000007fffffffefff004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:43 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x800) ioctl$KVM_GET_LAPIC(r1, 0x8400ae8e, &(0x7f00000001c0)={"5de670046e01acbb1d33c99cc9240cb7fd6327a03b7a943e8a7582cfd2dc4b1c1c674d4702bcc161eea40b3d116a5485eb2818e207cd8807d398317ff6bcd74a0c3c7d36ea88cdc27dcdaf3b7ea09bd67b66ec2742033f2288dcd8e279dae21154c142ce690c43764a2a84c4a315b0158972bbd17ec9d7cceb29eb8575ac3bd93a68ed572a3c26df5cbc51c91a95b3356994c30ea2327bc7b16d946bad8c96f54f2894fd91e032024a64911f61813bdd7796da09ff093cf5e1481bb6502043f4d3945775f8be66b1bd1b8bbff9b5be5a665bdafc6aec531b9b18628fd09d7db0c9982e24a6424d29cabde4d6f5e32936a9399876628a553ea07802592eac67d6bb6ab61d9057f03e7792c19b32484cfc25106784bea58d4ba4654a11d02bd80f5363ef3300dda50c3b99e1e3c440ec704055d8f9d3d322b682bc7d37ae7717c5e820228f212ae56c699cad85cccf419233e23ec788ea164bce840fb151fd9af7860f8e8306c459ed6ca03c3793e5f660c614e82f8c62876ce43fc35f43ca4f4ae1e5f94e63ef6f1de13a810f1cef083129d40ca07c2afa3f9b7c905cebdceef13d7d3a0d3eb832124b1b8d46dac3301c9e86bcf50c598ee1effa8853db3bcb49ce9556196dd149977d63eb22ee9b774713d80fb7fe62cff5abad6f64b70a444873eccc7d593deb9f2c49b96d70735e05b0794f2ed91ee0378f0331dbc2962e49c2b0847425d59224ac1f7441a9abcaaafbd19bb869bb02b5464d4b363fb1d38d77b98cb718f4059d9098be3581d7b2f95df90f6a38257363c800af5318b97c42b6c5c4964659b13df495225b4d3605fe4e7b965fe1f1e8386cda69aad7f2dd9e79a3e6acc835a6337f9820d8d65eb4975aaeb0c9fe9a02e363ee700e13df0212c7135bebec4dc47511f07dd5ca974f3a72f9c8001cebf643b512b978cbf439156ea60af7284aec780d4ab80ffc87b36a582aa47d117edbbbef23fe0621bdd485dde155260150d0d80b74be2b688b5055bb8a66d5e3459e35c069e960ce2a74b2af00303af425422bb2fc7689f96a40addd37fa6fb0d4049c0dc0b566fa0769ae2d4576e10e0b212a9c2022935cfe73a5e09dba837e62cb736dc7d6c561ec9f9d3e52469377d06cbfd0d20c45ebfe0b3ae852b6f7a46b0fa1b6f3278ed2fe887c918c1eb6ad854f3e20acd7a53742ef257b4e3c27209c9752b5f7ef5107b40dc169049827b6d12f5fcb2e759cf224ef02aee027a55256804a99caa9f004ae6e08fb4ae1b1a6a4a73d7c44d2344f004f4268a00d2fbf0f0346328e272b4ce25d375b9489e92b01585fdf639886470c866cf8ad6e92e23e96bbfc1cfc090c977e3a7ae6aeab416b6b475c2b5a91ec171d9b99c610e18988bcb418cfd301f6b8d5323ab4d9cac452627f6f42780650d75c9d86bca0ad65ee65dda843596266e85c7e"}) ioctl$VIDIOC_TRY_ENCODER_CMD(r1, 0xc028564e, &(0x7f00000000c0)={0x3, 0x1, [0xeb6, 0x40, 0x80000001, 0x400, 0x7, 0x2, 0x1, 0x10001]}) r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x1, 0x8080) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000040)={0xc, 0x3, 0x516}) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:43 executing program 5: mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000024000/0xc00000)=nil, 0xc00000, 0x8001, &(0x7f0000c28000)=0x800003f, 0xf1, 0x0) 09:51:43 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000ffffffff004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000040)='\x00', &(0x7f0000000080)='trusted.overlay.nlink\x00', &(0x7f00000000c0)={'U-', 0x237}, 0x28, 0xf0263c5f5ea6d5cd) r2 = syz_open_dev$mouse(&(0x7f0000000280)='/dev/input/mouse#\x00', 0x9, 0x2000) sendmsg$kcm(r2, &(0x7f0000001140)={&(0x7f0000000880)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x4, 0x4, 0x2, 0x4, {0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xf}}}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000900)="0d616f883ec5", 0x6}, {&(0x7f0000000940)="958aa4a512f61ff94bf5b9b023114bead03aef7d51f24e94ae6413d90e1949", 0x1f}, {&(0x7f0000000980)="ae06e7e918f199cf54885a03b43e9fbda9d310aabda869b3fa7c", 0x1a}, {&(0x7f00000009c0)="e0338150564b063f682f25a155b5f74ecb299c61ffc7078a615d8053ad7900280e5f8923d6fc57d9dc285cf76807837645fb5471275a6d023211a3ac64d986b183676c1ffc9c5df84297d96b06b91d259183716a5486b04b50", 0x59}, {&(0x7f0000000a40)="003e1b54616b25", 0x7}, {&(0x7f0000000a80)="68b45ba53fce48738335177c6ae94f5e6807804579189af25c1789279b0f0a717858be27dd9e30c417d7065b296893594c5d660d399a2fe6ac756dad7c897b33cbbaad19395935f5e382bafbb02bc8f41d7b9d10daa0", 0x56}, {&(0x7f0000000b00)="d69e6e68357f86a59c322ba711206ba6d4996ad960e76738c462d1898feec9cbb892c5bfaccc9ba5dd81ea49c768406b7aa7966703cdddd0f49808bc2e97", 0x3e}, {&(0x7f0000000b40)="e5f945fa88e88dab7881058363edfb43ad440bb58ce389044a47f08776fa7c71bc8b0c60aca2be0e37692634e7d3384b9f8fad54eede7d6e3d1c4d9f27efcc172f04a9bfccd08ac3", 0x48}, {&(0x7f0000000bc0)="c319b683a476a8845eeb567863875dbb79b49147d4bd79ad67b47effddb365ad1e459bf11b590dc655f7d12f330cba3730b8386881c1f0e9e0de548b0f5b087e9e36c5ba5332b1fb417a908cd6e1f07c6cc11afaa69f35fce16ed2edd58c0b98a5366dbbd17950abc4243e0fff363f61dee1053471b7673ba8deaf4eb5bebaeb58836905ee8938286526c27cc09b164091f07e24522083688dcb99b39858dc50b259c3d59f0b60a352968ea7330d9c9edd98e58bd4ff4e3f612b960a4978986709f520c959ae43d03e", 0xc9}], 0x9, &(0x7f0000000d80)=[{0xf8, 0x101, 0x57f, "b0c8830282504001a1aa87466742f67b89b29ff053bd9c7dff43011d846bba3eb43cd8f66f070d70d6fa2aa40ab6edae7cd0768d322d8f6e46c35f0f63d8f8f8daaaf196e193adff102face013fe59dbac2fbb08603b34b95b9746c4ff7ae3309c514fab0b5c68b1a0373caead7d1661103a4b57bd21ffb5e378bd773ebb9fd1f8ded788cf6dba5b8226df3f8b2910a051681f1e3e3a461299e351c21d3c9e51b71b8df36ba4760daa51643a4cee21518a0746b7cffa37d2854adf808e16244733d69f1b3be778b4705507552bad49ebfce617f71aa6917780990638424d87ea1e856249544d46f6"}, {0x18, 0x10f, 0x4, "564911a85a5239ba"}, {0xd8, 0x112, 0x4, "ce3220c7b5f929aeef883684b399cf1801476454d9d0ef6a7640d82d02a24724577c713d0763e540ae7bc41ad3bd0c920ccd8f78c43c089eda738a04fce836645d2206b33212d134bea3bda8e3ae85bd33f6e0298434750bab1e9c9e0ab9874eeeca40ca6169a12fcf91638f27381f7bcfbde828aa08d9900453deb226d52ee0c50f3331ebc3ce99fb62eee63ffebc4e563b102d293410146eb4fc05d67854cf67fdd2a4e8645835d56c1b2a02f449884ac1ff25dca6c5e2bae5fb3cd7022fdf925612d879"}, {0x88, 0x1ff, 0x9, "fc2c64e5768a4faef560aa2b5aced4ec84253e36adee54d8b293f84b0e5d95628093ae25d7d807ed1eae0b5858b8a4fecf6245abbc246a2180a0f07da012418fce360746eaa8d341a8b9ed406469cb9aa041a58c29b23f154b39d05439d6cb8b890ddbe4fccbcc827b125a34e9a29c564527dfcd3129"}, {0x40, 0x10f, 0x3f, "eebd755b86d1d97cf591937608c0b646212a25dffc511360931a946c263e4187dc4761aca24c53fd1dcddc74f8713fc5"}, {0x108, 0x107, 0x32, "3cc29f31862da95f3ae6df1aa8aee438cebd2c3a63bcf481b256e083a810d8c838075e43fc9ef9d5e6fe5a9f469833561e68d67cde01916862129de83c7b375077128d5c4ec6c343ee52120944994c32e3b787e60c55cadbd70600fb9379ed1227cb38d81afeb0711551e5b0669b500006f6a159763c1253db40ff955f9e6f73f90734cbf69ca4f937a5e824533f2e7d7747eb779bf2fefeeff2a4e9277b61e54031b8252530eb8162d223efda9c1f20d8d004aeb7793213522b8c638a32b445b098619a336520d1fb39472500defe72c0e5e8e7244a0f075e308e61ac7750250b1ff11a8f553d2a40623662b8c3a3b07f8f402da15a1d10"}], 0x3b8}, 0x801) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f0000000140)='./file0\x00', 0x7, 0xa, &(0x7f00000006c0)=[{&(0x7f0000000180)="87903c482175b2265e21c2186f0e2b190c7c68bd4ede02df2e528cc2f26c95f1b3848cfe8144c9453ee84b0bd33969750260a504c2e08f0b4b0da13efbb837c58b0fa2877416e586b029d9b6b63801baad0c4e1b0137900870e7110b67a93dd88cc58857f4ec31728a23ad28ced8dc765c6aed78c13163e34abb07cad6ca82bace1cd79cd83c7dcb11d27a76048d262d36007b750f8ee0425e7fc18bb865b4a715779144c69eeadab4a8ed9e82afe83facbde6fa3ae4677adf955a66bf895d38609ebab4e8eb9929fda2983ca4c0063f771bc39ec5441b66f137adcd38fd3c8161ddd06978906cff9d5959", 0xeb, 0x5}, {&(0x7f0000000280), 0x0, 0xd5}, {&(0x7f00000002c0)="e9f0eccd431c3d4b4534b316fb72040062998758c80ba64f7c4c37e04540817a8c7b6c7a60696e022537fbb2bfe5157fe0364e3a9073deea09d0b1026dad7f329afd6711b350c5562269a4dc8a87053cc049b6081b06de20abe71007db01e0aa8c3c88623b8de6eee889eb9aad27aca103f44813b11beeae5a29e66c9fb698a4ac84c54288b8f3ab485500d93abd7344f01ecbed70a6a0f22edc6d", 0x9b, 0x8121}, {&(0x7f0000000380)="87f4b0ac1b264d2dc2761054e3c2255297cc4f74b1cba98270bfd0ce264a4d1e989a54c0a989e826ee46538db5b44f3cc73f96b0adfa316faea1c1ee4adddb3c4ed04927f4b63e69ada1d531e4141df3eb4e10d963bd5c8c364e0e77a9835b58", 0x60, 0x8}, {&(0x7f0000000400)="1d140dd8b7cafd65de212eaded260126007e40b7f6c6f234608cee236b547d19495bbef435a5d7736948b169ce5b564fe2f0d988aaeda6848adec67a8e17426182241ee0253b5385f1bb9a484edd7c303daccc2dc75ea190ab43274121993766fcc4f91a9a68a26fb7f6a33dc68ccac8ffb36f93708939c636a7ec309ef32caa8802a378e6ed3b44e85ef86d28e40b25485eb23fa95591788048286745c2f4212c1b51ef2df1905fb3afa2f5e83d2397353fcddeba91bc4eeadaefc13ba62356cd2f998da8aa9da7b70c115b86238dd4a42db81c1d0f70826b146317d32d790b03ea25a64f147813dbb8c4e0d807", 0xee, 0x9}, {&(0x7f0000000500)="e58c2995853015aec33d720479d4d0bd5fe92f183e6514c18d5b5f84787bcc6214035d0499d61699874ffec899bae578fd05694f242ab46786ba6f", 0x3b, 0x1}, {&(0x7f0000000540)="385139b129fa3b5bf4a83bb3cea90cbcdc8a6275d280168d46221d0d0ecdf27f70c23c01cefc65", 0x27, 0x31b4}, {&(0x7f0000000580)="fbbf737901df78e77650758615c80cddba1bda38794cb0dd7e94a6e2aa1aada421b0bde2a161d92aba9da0e0f7a18b0a3e816212056f", 0x36, 0xdb9d}, {&(0x7f00000005c0)="f40f784d9df502d7a88e788f2c1e46a1972ce082ea4a44d642c226cd43d73d993518a7a746daee71dc1e53ea33559b6354665c605e4a47e81ed7e80b8016235e433f854531bba63ddf157d01bbd99bcf6971fbfe5464d7333c8d3dfd0bdec062d5a5c67a6dc0e3c44aa3f707ad07c8b39325be4b76814ecbcb088116633f25432f87c493b9bfad6a5aa82f56d841b81f6d51a91ec4241df2cb5adb068f1b249f", 0xa0, 0x8}, {&(0x7f0000000680)="f6492a782d681548643e9ab3ff04ab5b2ff5c5d9cb575e92f0eaeff5fd8cd86c75f4052ca7548839251e", 0x2a, 0x81}], 0x1010000, &(0x7f00000007c0)={[{@noacl='noacl'}, {@ignore_local_fs='ignore_local_fs'}, {@nosuiddir='nosuiddir'}, {@localflocks='localflocks'}, {@noacl='noacl'}], [{@appraise_type='appraise_type=imasig'}, {@func={'func', 0x3d, 'KEXEC_INITRAMFS_CHECK'}}, {@obj_role={'obj_role', 0x3d, 'vboxnet0'}}, {@subj_role={'subj_role', 0x3d, '\'user'}}, {@hash='hash'}, {@dont_appraise='dont_appraise'}]}) getsockopt$inet_buf(r1, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) 09:51:43 executing program 4: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000000)=ANY=[], 0x0) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x8000, 0x0) mount(0x0, 0x0, 0x0, 0x0, &(0x7f000000a000)) openat$autofs(0xffffffffffffff9c, 0x0, 0x101000, 0x0) flistxattr(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x230, &(0x7f0000007000)={@local, @random="cf2bb43c40b8", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @tcp={{0x0, 0x0, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x2}}}}}}, 0x0) unshare(0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x401, 0x0) ioctl$VIDIOC_S_PRIORITY(r3, 0x40045644, 0x2) [ 1887.319275][T23213] gfs2: invalid mount option: appraise_type=imasig [ 1887.352999][T23213] gfs2: can't parse mount arguments 09:51:43 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000060ffffffffff004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:44 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r1, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000004800000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000002000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1887.885287][T23489] binder: BINDER_SET_CONTEXT_MGR already set [ 1887.908403][T23489] binder: 23487:23489 ioctl 40046207 0 returned -16 09:51:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000003000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:44 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:44 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x7, 0x200000) setsockopt$inet_sctp_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f00000001c0)=0x1, 0x4) ioctl$SNDRV_TIMER_IOCTL_STOP(r1, 0x54a1) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000040)={0x0, 0x7cb, 0xfca, 0x0, 0x400, 0x9, 0x6, 0xa82f498, {0x0, @in6={{0xa, 0x4e20, 0x6, @rand_addr="531df5d268c12ed9e82aafad45444ece", 0x2}}, 0xb8da, 0x1, 0x3549d0b8, 0x5, 0xffffffff927e7fe4}}, &(0x7f0000000100)=0xb0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000140)={r2, 0x0, 0x7}, 0x8) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) write$P9_RFSYNC(r1, &(0x7f0000000200)={0x7, 0x33, 0x2}, 0x7) ioctl$TUNSETVNETBE(r1, 0x400454de, &(0x7f0000000240)=0x1) syz_extract_tcp_res$synack(&(0x7f0000000280), 0x1, 0x0) 09:51:44 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000004000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000005000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:44 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6(0xa, 0x80000, 0x1000) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) [ 1888.645742][T24020] binder_transaction: 7 callbacks suppressed [ 1888.645753][T24020] binder: 24019:24020 got transaction with invalid data ptr [ 1888.709162][T24020] binder_transaction: 7 callbacks suppressed [ 1888.709180][T24020] binder: 24019:24020 transaction failed 29201/-14, size 24-0 line 3180 09:51:45 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1888.785388][ T4724] binder_release_work: 7 callbacks suppressed [ 1888.785397][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:45 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)={0x1}) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000240)='/dev/btrfs-control\x00', 0x20000, 0x0) r3 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) write$FUSE_STATFS(r3, &(0x7f0000000180)={0x60, 0x0, 0x8, {{0x0, 0x3, 0xf36, 0xd80, 0x9, 0x8, 0x2, 0x66fbfd1d}}}, 0x60) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000006000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1889.037414][T24131] binder: 24130:24131 got transaction with invalid data ptr [ 1889.064284][T24131] binder: 24130:24131 transaction failed 29201/-14, size 24-0 line 3180 09:51:45 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x20, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x2901, 0x0) ioctl$VIDIOC_PREPARE_BUF(r1, 0xc058565d, &(0x7f0000000080)={0xcdd, 0x7, 0x4, 0x8000e000, {0x0, 0x7530}, {0x4, 0xb, 0x1000000, 0x0, 0x1, 0x5, "a5f2296f"}, 0x667b, 0xf7814afe9eb92a4, @fd=r2, 0x4}) [ 1889.092895][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000007000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:45 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1889.356426][T24453] binder: 24416:24453 got transaction with invalid data ptr [ 1889.369208][T24453] binder: 24416:24453 transaction failed 29201/-14, size 24-0 line 3180 [ 1889.388848][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000a000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:45 executing program 4: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x181700, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000140)={0x0, @speck128, 0x1, "72119f5454ededce"}) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mount(&(0x7f00000001c0)=ANY=[@ANYBLOB='./fileq\x00'], &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='bfs\x00', 0x100000, &(0x7f0000000280)='security.ima\x00') ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f00000002c0)={{0x12000, 0x0, 0xc, 0x80, 0x4, 0x2, 0x1, 0x800, 0x5, 0x1, 0x7, 0x7f}, {0x0, 0xd000, 0xb, 0x6f8, 0x0, 0xfffffffffffffff9, 0x7, 0x5, 0x7, 0x7dffbd01, 0x1, 0x80000001}, {0x1000, 0xf004, 0xa, 0x80000001, 0x0, 0x7ff, 0x3, 0xe08, 0xff, 0x5, 0x1, 0x6}, {0x10000, 0x1, 0xb, 0x2, 0x20, 0x8001, 0x7fffffff, 0x3, 0x7, 0x1, 0x70e177bf, 0x3}, {0xf000, 0x0, 0x0, 0x5, 0xfffffffffffffc00, 0x80000000, 0x80, 0x90, 0x20, 0x7d11, 0x200, 0x1}, {0x11000, 0x1f000, 0xb, 0x5, 0x6, 0xffffffffffffffb2, 0x80000001, 0x1ff, 0x1, 0x7, 0x200, 0x93d7}, {0x3000, 0x4000, 0x0, 0x4, 0xc2, 0x4, 0x9, 0x81, 0x7, 0x5, 0x101, 0x40}, {0x5002, 0xf000, 0x1e, 0x1, 0x6, 0xffffffff, 0x8, 0x9, 0x6, 0x6, 0x10000, 0x81}, {0x16000, 0x1}, {0x4000, 0x15002}, 0x4000000a, 0x0, 0x1001, 0x202000, 0x0, 0x1, 0xd002, [0x9, 0x8, 0x7fff, 0x1]}) setsockopt$inet6_int(r1, 0x29, 0xca, &(0x7f0000000180), 0xfffffffffffffe3b) setxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.ima\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="b05800001b65a1ea042e000000000097"], 0x10, 0x1) [ 1889.580806][T24646] binder: 24645:24646 got transaction with invalid data ptr 09:51:45 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1889.639288][T24646] binder: 24645:24646 transaction failed 29201/-14, size 24-0 line 3180 [ 1889.662226][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000012000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:46 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f00000006c0)={0x0, 0xde, "8977c50a880ca96e74f0f06fc715181b9af0a97cf5defd4f38f66d11d56433c8dc14b51a612a79b063219827492a7bb1831048898d45e5478b825dd1bb5a6968118463a5311fdcc1856d8f66b0e8935955227be9108ca4cb86c668ca1677332f93bb13e43ee502368d0a47db950e4c685a84b398d31227fada4c661f7f7e05304d53a044f996fe28d28f04323520758613eed6f687d019f6efa7dedc735a0f0f395ddb3569f88cce3a698344a535225b12e6e5c20f15b655edff7c55d6fe28d3e59a2726c943fb8a2433c7967b03ae4a3231540e27799d39d208321a1387"}, &(0x7f0000000140)=0xe6) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000180)=@assoc_value={r3, 0x7f}, 0x8) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) write$uinput_user_dev(r2, &(0x7f0000000240)={'syz1\x00', {0xfda6, 0x9, 0x1, 0x461}, 0xd, [0x9, 0x2, 0x3, 0x8, 0x40000000000000, 0x41, 0x3, 0x7, 0x81, 0xe67, 0x4, 0x79bd, 0x26a, 0x9, 0x1000, 0x100, 0x4, 0x3, 0x7, 0x80, 0x4, 0x1, 0xd84e, 0x6, 0x800, 0xe72, 0x0, 0x1, 0x3, 0x72, 0xfffffffffffffffe, 0xd7, 0x0, 0x27, 0xffffffff, 0x6, 0x4, 0x6, 0x401, 0x7, 0x1f, 0x9, 0x7, 0x6, 0x81, 0x3, 0x6, 0x9, 0x22, 0x1, 0x139, 0x7f, 0xd984, 0x2, 0x2, 0x7, 0x3, 0x68c, 0x3, 0x40, 0xbbb, 0x2, 0x28f0, 0x3], [0xe21, 0x6, 0x5, 0x20, 0xccb, 0xcc, 0x6, 0xd5a, 0xd92d, 0x20, 0xfffffffffffffcd4, 0x2, 0xf39, 0x3f, 0x5, 0x7, 0xb8b, 0x2, 0xafa, 0x8000, 0x3, 0xe0, 0x5, 0x3, 0x6, 0x48, 0x0, 0x9, 0x1ffe0, 0x7fff, 0x9, 0x9a, 0xfffe000000000000, 0x8, 0x5, 0x4, 0xff, 0xa435, 0x20, 0x6, 0x8001, 0x65d44d3e, 0x5, 0x7, 0x2, 0x1d0770ac, 0x5, 0x8001, 0x0, 0x0, 0xfffffffffffffff8, 0x1000, 0xfd, 0x7, 0xff, 0x3, 0x8, 0x7, 0xdbe, 0x5, 0x2, 0x10000, 0x6, 0x8], [0x3, 0x4, 0x7, 0xeb7, 0x4, 0x8001, 0x3f, 0x2, 0xfffffffffffffffb, 0x1f, 0x81, 0x8, 0xffff, 0x1000, 0xfffffffffffffbff, 0x1, 0xfffffffffffffffc, 0xfff, 0xfffffffffffffff9, 0x70, 0xfffffffffffffffd, 0x4, 0xd26c, 0xa9, 0x2, 0x5, 0x7, 0x7f, 0x20, 0x1fce, 0x683, 0xfffffffffffff800, 0xd682, 0x800, 0x3, 0x0, 0x7, 0x4000000, 0x100, 0x0, 0x100, 0x71, 0x709, 0x7, 0x0, 0x8000, 0x200, 0x3, 0x0, 0x5, 0x1, 0x10001, 0x1, 0x5f, 0x7ff, 0x8001, 0x9ee, 0x2, 0x6, 0x1, 0x6, 0x5, 0x8, 0x4], [0x7d0, 0x8, 0x80000000, 0x0, 0x7, 0x100000001, 0x2, 0xaf3, 0xfffffffffffff180, 0x7, 0xfff, 0x7, 0x86, 0x7, 0x9, 0x1fe00000000, 0x10001, 0x6, 0x9, 0x7, 0x3, 0x7, 0x200, 0x1, 0x0, 0x7fffffff, 0x1, 0x7, 0x2, 0x101, 0x3, 0x2, 0xffff, 0x0, 0x7, 0x101, 0x7, 0x7, 0x3, 0xfffffffffffffff7, 0x20, 0xffffffffffffffee, 0x1000, 0x1, 0x1000, 0x1, 0x101, 0x8, 0x6, 0x800, 0x2, 0xa8f, 0x8, 0x0, 0x10000, 0xff, 0x80000000, 0x8, 0x8, 0x7ff, 0x0, 0x6, 0xffff, 0x1]}, 0x45c) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1889.907740][T24826] binder: 24786:24826 got transaction with invalid data ptr [ 1889.929440][T24826] binder: 24786:24826 transaction failed 29201/-14, size 24-0 line 3180 [ 1889.951545][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:46 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_sctp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:46 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000018000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1890.133340][T25046] binder: 25036:25046 got transaction with invalid data ptr [ 1890.173819][T25046] binder: 25036:25046 transaction failed 29201/-14, size 24-0 line 3180 [ 1890.207330][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000048000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1890.419012][T25256] binder: 25216:25256 got transaction with invalid data ptr [ 1890.443974][T25256] binder: 25216:25256 transaction failed 29201/-14, size 24-0 line 3180 09:51:46 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000000)=ANY=[], 0x0) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x8000, 0x0) mount(0x0, 0x0, 0x0, 0x0, &(0x7f000000a000)) openat$autofs(0xffffffffffffff9c, 0x0, 0x101000, 0x0) flistxattr(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x230, &(0x7f0000007000)={@local, @random="cf2bb43c40b8", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @tcp={{0x0, 0x0, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x2}}}}}}, 0x0) unshare(0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x401, 0x0) ioctl$VIDIOC_S_PRIORITY(r3, 0x40045644, 0x2) [ 1890.480601][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000004c000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:46 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000140), &(0x7f0000000180)=0xc) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:47 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000080), &(0x7f00000000c0)=0x4) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='lp\x00', 0x3) [ 1890.779048][T25489] binder: 25488:25489 got transaction with invalid data ptr [ 1890.793603][T25489] binder: 25488:25489 transaction failed 29201/-14, size 24-0 line 3180 [ 1890.819132][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:47 executing program 5: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000000)=ANY=[], 0x0) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x8000, 0x0) mount(0x0, 0x0, 0x0, 0x0, &(0x7f000000a000)) openat$autofs(0xffffffffffffff9c, 0x0, 0x101000, 0x0) flistxattr(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x230, &(0x7f0000007000)={@local, @random="cf2bb43c40b8", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @tcp={{0x0, 0x0, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x2}}}}}}, 0x0) unshare(0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x401, 0x0) ioctl$VIDIOC_S_PRIORITY(r3, 0x40045644, 0x2) 09:51:47 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000060000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1891.118363][T25754] binder: 25747:25754 got transaction with invalid data ptr [ 1891.172448][T25754] binder: 25747:25754 transaction failed 29201/-14, size 24-0 line 3180 [ 1891.197391][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:47 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x242100, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000080)={0x1, r2, 0x1}) 09:51:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000068000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1891.397028][T25926] binder: 25917:25926 got transaction with invalid data ptr 09:51:47 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:47 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1891.463376][T25926] binder: 25917:25926 transaction failed 29201/-14, size 24-0 line 3180 [ 1891.519051][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000006c000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:48 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr, 0xfffffffffffffffc}, 0x1c) socket$inet_udplite(0x2, 0x2, 0x88) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e21, 0x6, @empty}, 0x1c) r1 = dup2(r0, r0) ioctl$KVM_ASSIGN_SET_INTX_MASK(r0, 0x4040aea4, &(0x7f0000000000)={0x7, 0x18, 0xfffffffffffffff8, 0x2, 0x8}) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)={0x8}) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000140)=0x5) getsockopt$inet6_int(r1, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f00000004c0)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") getsockopt$packet_int(r0, 0x107, 0x1f, &(0x7f0000000100), &(0x7f0000000180)=0x4) 09:51:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000074000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000007a000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:48 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80000, 0x8a) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e24, 0x1f, @mcast1, 0x3d4}}, 0x8, 0xdc0d, 0x0, 0x6, 0xffffffffffff67b2}, &(0x7f0000000100)=0x98) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000140)={r2, 0x0, 0xffffffffffffff3d, 0x1f}, &(0x7f00000001c0)=0x10) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) 09:51:48 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000030000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:48 executing program 4: ustat(0x7ff, &(0x7f0000000100)) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x200, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000080)) sync_file_range(r1, 0x6, 0x5, 0x5) ioctl$DRM_IOCTL_RM_MAP(r1, 0x4028641b, &(0x7f0000000000)={&(0x7f0000ffd000/0x2000)=nil, 0x8, 0x5, 0x8, &(0x7f0000ffd000/0x1000)=nil, 0xfffffffffffffc44}) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x9b) ioctl$TCGETS2(r1, 0x802c542a, &(0x7f00000000c0)) ioctl$sock_inet_SIOCSIFBRDADDR(r1, 0x891a, &(0x7f0000000140)={'bridge_slave_0\x00', {0x2, 0x4e22, @remote}}) 09:51:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000050000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1892.683992][T26751] Unknown ioctl 35147 09:51:48 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1892.709655][T26751] Unknown ioctl 1076388891 09:51:49 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000240)={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f00000002c0)={r3, 0x2, 0x40}, 0x8) r4 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r4, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") getgroups(0x1, &(0x7f0000000300)=[0xffffffffffffffff]) r6 = getgid() setregid(r5, r6) write(r4, &(0x7f0000000140)="fa44f52f633c6ee993cf9f883a0d90899457f1fbafecaecb58821c47f7370f9f553bf81e816c2684c4a1b166110c68137a692c2d565bf71976ed871a8cfd8ba9a9daafde625ad09cb4083c1ca462830f841b943a7d49fb9397397d6ef066a80c98dcb269677178020c720e672870e9920e6b4caaa4f4c9994569f4fb4ba9177d32cac50a253b04253a122adbe2b15f2f7c3c56bb1eb4e6ad4b43fde40a12426d0f8611b6e4415f56467a4e52d4bc9a4751ff788700aacb9ae83a8b4da1", 0xbd) 09:51:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000060000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:49 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x1, &(0x7f0000000180), 0x4) r1 = socket(0xb, 0x800, 0x8) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x2400, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_DMA(r2, 0xc0406429, &(0x7f0000000200)={r3, 0x8, &(0x7f00000000c0)=[0xcc7, 0xfffffffffffffffa, 0x6, 0xff, 0x2, 0xffc00, 0xffffffff80000000, 0x0], &(0x7f0000000100)=[0x68c], 0x42, 0x8, 0x401, &(0x7f0000000140)=[0x6, 0xffffffff, 0x8, 0x4, 0x7, 0x9, 0x1, 0x1], &(0x7f00000001c0)=[0x100, 0x10000]}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) bind$bt_hci(r2, &(0x7f0000000280)={0x1f, r4, 0x2}, 0xc) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000000)=0x9, 0x4) 09:51:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000070000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x301000, 0x0) setsockopt$sock_void(r0, 0x1, 0x3f, 0x0, 0x0) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000a0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:49 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) mknod(&(0x7f00000001c0)='./file0\x00', 0x4000080, 0xd) socketpair(0x3, 0x2, 0x4, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000200), &(0x7f0000000240)=0xc) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000040)={0xdf, {{0xa, 0x4e20, 0x1, @empty, 0x3}}, {{0xa, 0x4e24, 0xff, @local, 0x40}}}, 0x108) 09:51:49 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000120000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1893.796034][T27693] binder_transaction: 8 callbacks suppressed [ 1893.796044][T27693] binder: 27692:27693 got transaction with invalid data ptr [ 1893.830389][T27693] binder_transaction: 8 callbacks suppressed [ 1893.830408][T27693] binder: 27692:27693 transaction failed 29201/-14, size 24-0 line 3180 09:51:50 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x80000, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/wireless\x00') r3 = memfd_create(&(0x7f0000000080)='\x00', 0x7) r4 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x7f, 0x0) r5 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-monitor\x00', 0x103000, 0x0) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/mixer\x00', 0x40, 0x0) r7 = syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0xf7, 0x101800) r8 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0x5, 0x40000) r9 = openat$zero(0xffffffffffffff9c, &(0x7f0000000240)='/dev/zero\x00', 0x200, 0x0) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, &(0x7f0000000280)={0x0, 0x8, [{r2, 0x0, 0xfffff000}, {r3, 0x0, 0x4000, 0x2000}, {r4, 0x0, 0x12000, 0x8000}, {r5, 0x0, 0x1000000, 0xfffffffff0000000}, {r6, 0x0, 0xfffffffff0000000, 0x100000000}, {r7, 0x0, 0x0, 0x100000000}, {r8, 0x0, 0x0, 0x1000}, {r9, 0x0, 0x100010000c000, 0x8000}]}) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) openat$null(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/null\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r2, &(0x7f0000000380)={0x4}) [ 1893.870385][ T7899] binder_release_work: 8 callbacks suppressed [ 1893.870393][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000040)=""/33, &(0x7f00000000c0)=0x21) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bd070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000014000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000000)="360fae08670f01d1b8c80e8ee0f2a566b9af0300000f320fc75ac70f019af5ffba210066ed0fc79e9c5ebaa000b80118ef", 0x31}], 0x1, 0x0, 0x0, 0xfffffffffffffdb9) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x7) getsockopt$inet_buf(r4, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) accept4(r4, 0x0, &(0x7f0000000100), 0x80000) 09:51:50 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000180000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCMBIC(r2, 0x5417, &(0x7f0000000180)=0x800) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f00000001c0)={'team_slave_1\x00', {0x2, 0x4e23, @empty}}) connect$inet6(r0, &(0x7f0000000080), 0x1c) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000a00)=@broute={'broute\x00', 0x20, 0x5, 0x780, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000280], 0x0, &(0x7f0000000240), &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000d00000010000000000369703665727370616e30000000000000726f736530000000000000000000000076657468315f746f5f7465616d00000076657468315f746f5f68737200000000aaaaaaaaaa26ffffffff0000ffffffffffffffff00ff00ff0000d000000050010000c80100007374617465000000000000000000000000000000000000000000000000000000080000000000000001000000000000003830325f330000000000000000000000000000000000000000000000000000000800000000000000fc00000107040000434c41535349465900000000000000000000000000000000000000000000000008000000000000001f000000000000004c45440000000000000000000000000000000000000000000000000000000000280000000000000073797a310000000000000000000000000000000000000000000000010300000001800000000000004e464c4f470000000000000000000000000000000000000000000000000000005000000000000000b8be00000500ff0000000000c529c426273b27cc06feb57128acbe01e89981e01d07510aa3bec046422ec0c2273510caf23f875d25280bbf0c1f2ee7caa366dd6dc7be52e0ae139bc782b5e60000000000000000000000000000007e2d000000000000000000000000000000000000000000000001000000feffffff020000001f00000020000000892f626f6e645f736c6176655f3100000000626373663000000000000000000000006263736630000000000000000000000067726530000000000000000000000000000000000000ffffffffffffffffffffffffffffffff000000007000000070000000a8000000646e61740000000000000000000000000000000000000000000000000000000010000000000000000180c20000000000ffffffff000000000900000008000000fbfb73797a6b616c6c6572310000000000006772657461703000000000000000000065727370616e3000000000000000000062726964676530000000000000000000ffffffffffffffffffffffffaaaaaaaaaa1bffff00000000000070000000a0000000d000000000000000000000000000000000000000000000000000000000000000000000000800000000000000fbffffff00000000434f4e4e5345434d41524b0000000000000000000000000000000000000000a008000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000f56f2c16020000001900000053000000885f697036677265300000000000000000006c6170623000000000000000000000007465616d5f736c6176655f30000000007663616e300000000000000000000000aaaaaaaaaa1100ffffff00ff0180c200000263ff00ffffff0000b000000028020000780200006d61726b5f6d000000000000000000000000000000000000000000000000000018000000000000008000000000000000f73600000000000001010000000000005345434d41524b000000000000000000000000000000000000000000000000000801000000e8ffff00000000000000002f7573722f7362696e2f6375707364000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004552524f5200000000000000000000000000000000000000000000000000000020000000000000006e49a8c2c19e073c39e7d55077d463af889b76049bd2167fcb2bcc8b885600004c45440000000000000000000000000000000000000000000000000000ed0000280000000000000073797a300000000000000000000000000000000000000000000000010800000009000000000000000300000006000000e8bf6263736630000000000000000000000076657468305f746f5f626f6e640000006c61706230000000000000000000000073797a6b616c6c657230000000000000aaaaaaaaaaaa0000ffffffff0180c200000eff00ff00ff000000c000010000000100000000006e66616363740000000000000000000000000000000000000000000000000000280000000000000073797a30000000000000000000000000000000000000000000000000000000007fffffffffffffff4e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000300000001fc000000000000e3b22d340c0397200fe770866d6a788a1818b2ff0f8b99b0c72ff2bece1e6ed2f641e867f06cbcb965cb47af8bd343c1504008c44e8d01465f997500e4e616c20000000000000000"]}, 0x7f8) r4 = dup2(r0, r3) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r4, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000ac0)='/dev/mISDNtimer\x00', 0x200000, 0x0) 09:51:50 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xa, &(0x7f0000000000)=0x9, 0x4) setsockopt$inet6_int(r0, 0x29, 0xcb, &(0x7f0000000180), 0x4) [ 1894.431390][T27928] binder: 27909:27928 got transaction with invalid data ptr [ 1894.438786][T27928] binder: 27909:27928 transaction failed 29201/-14, size 24-0 line 3180 09:51:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000040)=""/33, &(0x7f00000000c0)=0x21) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f319bd070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000014000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, &(0x7f0000000000)="360fae08670f01d1b8c80e8ee0f2a566b9af0300000f320fc75ac70f019af5ffba210066ed0fc79e9c5ebaa000b80118ef", 0x31}], 0x1, 0x0, 0x0, 0xfffffffffffffdb9) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x7) getsockopt$inet_buf(r4, 0x6, 0x18, 0x0, &(0x7f0000000000)=0x107) accept4(r4, 0x0, &(0x7f0000000100), 0x80000) 09:51:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) bind$xdp(r2, &(0x7f00000001c0)={0x2c, 0x2, r3, 0x38, r2}, 0x10) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1894.540675][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000200000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000700000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:51 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1894.875624][T28159] binder: 28145:28159 got transaction with invalid data ptr [ 1894.918505][T28173] binder: BINDER_SET_CONTEXT_MGR already set [ 1894.938626][T28159] binder: 28145:28159 transaction failed 29201/-14, size 24-0 line 3180 [ 1894.947277][T28173] binder: 28167:28173 ioctl 40046207 0 returned -16 [ 1895.018399][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:51 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000003f0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000700000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1895.283682][T28441] binder: 28440:28441 got transaction with invalid data ptr [ 1895.312923][T28441] binder: 28440:28441 transaction failed 29201/-14, size 24-0 line 3180 [ 1895.363369][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:51 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1895.441975][T28495] binder: BINDER_SET_CONTEXT_MGR already set [ 1895.462155][T28495] binder: 28455:28495 ioctl 40046207 0 returned -16 09:51:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000400000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000700000000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1895.654347][T28651] binder: 28650:28651 got transaction with invalid data ptr [ 1895.679278][T28651] binder: 28650:28651 transaction failed 29201/-14, size 24-0 line 3180 [ 1895.727553][T28654] binder: BINDER_SET_CONTEXT_MGR already set [ 1895.764653][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 [ 1895.771229][T28654] binder: 28653:28654 ioctl 40046207 0 returned -16 09:51:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000480000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:52 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000240)={{{@in=@multicast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast1}}, &(0x7f0000000140)=0xe8) ioctl$sock_inet6_SIOCDELRT(r2, 0x890c, &(0x7f0000000180)={@ipv4={[], [], @remote}, @empty, @ipv4={[], [], @loopback}, 0x0, 0xfffffffffffffff7, 0xfffffffffffffff7, 0x0, 0xfff, 0x100001, r3}) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1895.986766][T28956] binder: 28955:28956 got transaction with invalid data ptr [ 1896.004915][T28956] binder: 28955:28956 transaction failed 29201/-14, size 24-0 line 3180 [ 1896.037941][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:52 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) prctl$PR_GET_NAME(0x10, &(0x7f0000000300)=""/184) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_x25_SIOCDELRT(r2, 0x890c, &(0x7f00000003c0)={@remote={[], 0x2}, 0xd, 'bridge0\x00'}) r3 = dup2(r0, r1) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000004c0)={0x0, @in6={{0xa, 0x4e22, 0x8, @local, 0x3}}}, &(0x7f0000000580)=0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000001c0)={r4, 0x0, &(0x7f0000000440)}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000280)={r5, 0x100000000}, &(0x7f00000002c0)=0x8) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000004c0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1896.344399][T29069] binder: 29068:29069 got transaction with invalid data ptr [ 1896.362685][T29069] binder: 29068:29069 transaction failed 29201/-14, size 24-0 line 3180 [ 1896.385646][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:52 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = syz_open_dev$radio(&(0x7f0000000140)='/dev/radio#\x00', 0x2, 0x2) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000600000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1896.658545][T29180] binder: 29179:29180 got transaction with invalid data ptr [ 1896.678656][T29180] binder: 29179:29180 transaction failed 29201/-14, size 24-0 line 3180 [ 1896.704314][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:52 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000ff600000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1896.973269][T29391] binder: 29390:29391 got transaction with invalid data ptr [ 1896.985484][T29391] binder: 29390:29391 transaction failed 29201/-14, size 24-0 line 3180 [ 1896.999892][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000680000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:53 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xd4, &(0x7f0000000180), 0x4) 09:51:53 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f00000001c0), 0x132407) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000180)=0xda2, 0x4) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r2, 0xc0305302, &(0x7f0000000140)={0x1, 0x2, 0x3, 0x1, 0xff, 0xcd}) [ 1897.235396][T29594] binder: 29593:29594 got transaction with invalid data ptr [ 1897.250960][T29594] binder: 29593:29594 transaction failed 29201/-14, size 24-0 line 3180 [ 1897.267420][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:53 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000006c0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:53 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000740000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:53 executing program 5: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0xd0, &(0x7f0000000180), 0x4) 09:51:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000007a0000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:54 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:55 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000940000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r1, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:55 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:55 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1898.951863][T30229] binder_transaction: 3 callbacks suppressed [ 1898.951873][T30229] binder: 30226:30229 got transaction with invalid data ptr [ 1898.985160][T30229] binder_transaction: 3 callbacks suppressed [ 1898.985177][T30229] binder: 30226:30229 transaction failed 29201/-14, size 24-0 line 3180 [ 1899.055021][ T7899] binder_release_work: 3 callbacks suppressed [ 1899.055029][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:55 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000004000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1899.371254][T30340] binder: 30339:30340 got transaction with invalid data ptr [ 1899.408033][T30340] binder: 30339:30340 transaction failed 29201/-14, size 24-0 line 3180 [ 1899.441588][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000715000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1899.644444][T30442] binder: 30441:30442 got transaction with invalid data ptr [ 1899.665773][T30442] binder: 30441:30442 transaction failed 29201/-14, size 24-0 line 3180 [ 1899.691763][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000d05000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1899.931687][T30748] binder: 30742:30748 got transaction with invalid data ptr [ 1899.949907][T30748] binder: 30742:30748 transaction failed 29201/-14, size 24-0 line 3180 09:51:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = syz_open_dev$midi(&(0x7f00000002c0)='/dev/midi#\x00', 0x8, 0x40800) setsockopt$packet_buf(r1, 0x107, 0xd, &(0x7f00000003c0)="ae585f6014e7ae04455899bfb867c8f8711f9d7da42a9776da524bc400118d6cb95593680e1fb06e6bbdd66baded4ed4f4e2b08ecaecce4b7f566c06a01966741f9919fc0b13a662193acf8e8a14b9e7721940c50ca0be1b2d0856489c76146f1877371e4c4c82be5efd09e6d8ff6b1d346272f30d1470919ea6ba5dbb68329a3cc0f1e4e13c542560f190494b1ed1f0f371b5bc436f6721a7101b6807a13a152cbd75502f0bd50e", 0xa8) r2 = socket$inet_udplite(0x2, 0x2, 0x88) fcntl$dupfd(r2, 0x406, r2) r3 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) flistxattr(r0, &(0x7f0000000140)=""/133, 0x85) ioctl$BLKRAGET(r3, 0x1263, &(0x7f0000000100)) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000500)={0xce, 0xff, 0x2, 0xfffffffffffffffb, 0x4, 0x7}) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280)='nbd\x00') getsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f0000000480), &(0x7f00000004c0)=0x10) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000340)={&(0x7f0000000240), 0xc, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="a32317ee20000000", @ANYRES16=r4, @ANYBLOB="000128bd7000fcdbdf25020000000c82c8e6778a3d58bf06d26f"], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) syz_execute_func(&(0x7f0000000880)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aac40195d5204a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf881b3076622076622f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec4e2c9b67281c3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aac44211023fc4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") sendto$rose(r3, &(0x7f0000000000)="7f3d11ff066c7cce9186b168a3b54bdefab6fe6cbe4e00b854cda8d932121765bcecbf13b0d20f186257dcba58b6", 0x2e, 0x8040, &(0x7f0000000040)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, 0x2, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x40) [ 1899.986702][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:56 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:51:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000c07000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1900.164221][T30857] binder: 30854:30857 got transaction with invalid data ptr [ 1900.192796][T30857] binder: 30854:30857 transaction failed 29201/-14, size 24-0 line 3180 [ 1900.227451][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:56 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:56 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:51:56 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000507100000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1900.610286][T31068] binder: 31063:31068 got transaction with invalid data ptr [ 1900.636467][T31068] binder: 31063:31068 transaction failed 29201/-14, size 24-0 line 3180 09:51:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x42280, 0x0) ioctl$VIDIOC_DBG_G_REGISTER(r1, 0xc0385650, &(0x7f0000000180)={{0x2, @addr=0x81}, 0x8, 0x1ff, 0x7}) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000280), 0x0) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1900.668254][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:57 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000007400000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:57 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1900.981905][T31280] binder: 31277:31280 got transaction with invalid data ptr [ 1901.010606][T31280] binder: 31277:31280 transaction failed 29201/-14, size 24-0 line 3180 [ 1901.051523][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000009400000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1901.341238][T31485] binder: 31484:31485 got transaction with invalid data ptr [ 1901.392741][T31485] binder: 31484:31485 transaction failed 29201/-14, size 24-0 line 3180 [ 1901.418028][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:51:57 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getsockopt$inet_buf(0xffffffffffffffff, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:51:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000070c000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:57 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) [ 1901.720869][T31813] binder: 31730:31813 got transaction with invalid data ptr [ 1901.763131][T31813] binder: 31730:31813 transaction failed 29201/-14, size 24-0 line 3180 [ 1901.799915][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:58 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:58 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getsockopt$inet_buf(0xffffffffffffffff, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:51:58 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000140), 0x0) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$SIOCAX25GETINFO(r2, 0x89ed, &(0x7f0000000140)) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) ioctl$TIOCSTI(r2, 0x5412, 0xe2fe) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000050d000000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:58 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") getsockopt$inet_buf(0xffffffffffffffff, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1902.124564][T32107] binder: 32087:32107 got transaction with invalid data ptr [ 1902.144505][T32107] binder: 32087:32107 transaction failed 29201/-14, size 24-0 line 3180 [ 1902.162369][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:51:58 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000001000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000002000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:58 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:51:58 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:59 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:51:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000003000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:59 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:51:59 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) rmdir(&(0x7f0000000140)='./file0\x00') connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x800, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:51:59 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:51:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000004000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:59 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:51:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000005000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:51:59 executing program 5: r0 = socket$unix(0x1, 0x2, 0x0) r1 = socket$unix(0x1, 0x800000000005, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) listen(r1, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) connect(r2, &(0x7f0000931ff4)=@un=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) r3 = accept(r1, 0x0, 0x0) sendmsg$unix(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) close(r0) 09:51:59 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:51:59 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:00 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000006000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:00 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1904.158059][ T799] binder_transaction: 5 callbacks suppressed [ 1904.158070][ T799] binder: 793:799 got transaction with invalid data ptr [ 1904.179229][ T799] binder_transaction: 5 callbacks suppressed [ 1904.179247][ T799] binder: 793:799 transaction failed 29201/-14, size 24-0 line 3180 [ 1904.216227][ T7899] binder_release_work: 5 callbacks suppressed [ 1904.216237][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:00 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x200002, 0x0) 09:52:00 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000440)='/dev/zero\x00', 0x2, 0x0) setsockopt$inet_tcp_buf(r1, 0x6, 0x1a, &(0x7f0000000180)="edd38d9870996976837346f93e8af33ce4128c04d3b7d0", 0x17) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000800}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x58, r4, 0x300, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x44, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000380)={0x0, 0x60}, &(0x7f00000003c0)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000400)={r5, 0x2}, 0x8) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:52:00 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000007000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1904.510622][ T907] binder: 903:907 got transaction with invalid data ptr 09:52:00 executing program 4: socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r0, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1904.555110][ T907] binder: 903:907 transaction failed 29201/-14, size 24-0 line 3180 [ 1904.596372][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:52:00 executing program 5: syz_execute_func(&(0x7f0000001500)="c4e379614832072be91cb9980f05f7a6aae28920aec4a37bf0c50141e2e922ebc4a2c4214e5eacf495a63680ebc482813c450043ca079f18e564d11bd11bfa00003d136c000000f2d2d6c461dc57b1e67d0b25c4a1f16296a1000000fac46279132fe10f1e2f160f41fec4227d1c93956e0000676beeeec422c1afcc8f49f895df366642ee0f97be08000000f04780060040b1b272724cb4bac4a31149a00700000024a39f419f1fedc4e279440f380bcf1fc4a18dd2f41ec4647168c4c19dfb96f88e00000f3a16288866460fe6e16bd10499660f383ca3300a0000660f15404c768b8b8b27c4a279c461d15f15f2ffffffd0f6d5d5e1d8a1a12a9791dfcc42dddbdbc42279b66765833baa32f500028f6a78106f65030000004074d266413a01f2424f48060f30c442fd21b19b0b000038389800dd66f3440fbc1201dcc443e15fbe0910000000c4e21d471ef30faed0a7400f1869bed0818194d800092ddd8fe700dbd6007bf2c4e2f921c022ba22baa9a700002e366464462acc828282b9080000000dc4e27d0ed2800036b2aad9c7497849781bf378470f73dc024c59c44145594900660f65d0360f560657662e660f560ba858edd9fb8cc4da3cb0b0616976df430f12a2d08212d4e5c5c421fb5a1747cc474cf9dfe0c421f15a0cdac421fd29fa002d08000000009b5d8ea7a7282856754464650f1b88000000814157c403791d5cf402cc39c4c1cdc28a0000000000c4c36d4b7b0e32c4a2750831c44109f89700008020") getuid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) stat(0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000780)={0x0, 0x0, 0x10001}) 09:52:00 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000a000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1904.869947][ T1133] binder: 1130:1133 got transaction with invalid data ptr [ 1904.906060][ T1133] binder: 1130:1133 transaction failed 29201/-14, size 24-0 line 3180 [ 1904.942551][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:01 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000012000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1905.291241][ T1352] binder: 1350:1352 got transaction with invalid data ptr [ 1905.357558][ T1352] binder: 1350:1352 transaction failed 29201/-14, size 24-0 line 3180 09:52:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1905.403997][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000018000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000140)={{0x0, 0x2, 0x50a, 0x3, 0x100}, 0x8, 0x6}) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e22, 0x4, @remote, 0x100000001}}}, &(0x7f00000001c0)=0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000300)={r3, @in6={{0xa, 0x4e24, 0x8aa, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x5}}, 0x10000, 0x9}, 0x90) 09:52:01 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:01 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:01 executing program 5: socket$inet(0x2, 0x0, 0x0) syz_execute_func(&(0x7f0000000700)="c4e379614832074a2be91cb9980f05f7a6aae28920aec4a37bf0c50141e2e922ebc4a2c42281a7a56ea74dae1ceb262fc4c6cd97e664d11bc421fa6f3d136c000000f2d2dec461dc57b1e67d0b25c6c583417916d61abed61abedbe1491e2f160f41fe4cbec5c54d0f2c718f56676beeee8f2870b63b309df8f86dc483057f6e3e5340b267f34cb4ba6681f9935499fa6c1fed6c1feda8271ec4647168c4c19dfb96f88e00000f3a16288836e70f8babf27f0000536bd10499660f383ca3300a0000efef768b8b8b27c4a27921f940abd8a1a12ad764cc42dfdb4066bd0ffe383baa32d467460f3300028f6a78106f65030000004074d266413a010f0f30ca30cac442fd21b19b0b0000f267a1c900000000ddc4411171f200c4e3c10c090e6e4f01dcdc6298c9c949f1a79ad0818194d800092ddd8f0b00c4a17ae64295007bf21c1c22ba22baa9a700002e3664644626cc4683b9080000000dc4e27d0ed2b2aad9c741af78470f73dc024c593e40d9f50f001e570000a858edc4037d092101c42119da3cb011000000e5c5c421fb5a1747cc474cf9f2400f118b7b000000c4216f5a0cdac421fd29fa002d08000000009b5d8ea7a7282856fe0564650f1b88000000a0a041574974ecd5c4c1cdc28a0000000000c5a2750831c44109f89700008020") [ 1905.773825][ T1467] binder: 1464:1467 got transaction with invalid data ptr [ 1905.842453][ T1467] binder: 1464:1467 transaction failed 29201/-14, size 24-0 line 3180 [ 1905.880281][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:02 executing program 5: socket$inet(0x2, 0x0, 0x0) syz_execute_func(&(0x7f0000000700)="c4e379614832074a2be91cb9980f05f7a6aae28920aec4a37bf0c50141e2e922ebc4a2c42281a7a56ea74dae1ceb262fc4c6cd97e664d11bc421fa6f3d136c000000f2d2dec461dc57b1e67d0b25c6c583417916d61abed61abedbe1491e2f160f41fe4cbec5c54d0f2c718f56676beeee8f2870b63b309df8f86dc483057f6e3e5340b267f34cb4ba6681f9935499fa6c1fed6c1feda8271ec4647168c4c19dfb96f88e00000f3a16288836e70f8babf27f0000536bd10499660f383ca3300a0000efef768b8b8b27c4a27921f940abd8a1a12ad764cc42dfdb4066bd0ffe383baa32d467460f3300028f6a78106f65030000004074d266413a010f0f30ca30cac442fd21b19b0b0000f267a1c900000000ddc4411171f200c4e3c10c090e6e4f01dcdc6298c9c949f1a79ad0818194d800092ddd8f0b00c4a17ae64295007bf21c1c22ba22baa9a700002e3664644626cc4683b9080000000dc4e27d0ed2b2aad9c741af78470f73dc024c593e40d9f50f001e570000a858edc4037d092101c42119da3cb011000000e5c5c421fb5a1747cc474cf9f2400f118b7b000000c4216f5a0cdac421fd29fa002d08000000009b5d8ea7a7282856fe0564650f1b88000000a0a041574974ecd5c4c1cdc28a0000000000c5a2750831c44109f89700008020") 09:52:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000020000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1906.200663][ T1693] binder: 1636:1693 got transaction with invalid data ptr [ 1906.235143][ T1693] binder: 1636:1693 transaction failed 29201/-14, size 24-0 line 3180 [ 1906.267641][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:02 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:02 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/28, 0x2c2) syz_execute_func(&(0x7f0000000540)="f241904a2be9c4a11f5cd8980f053ef3aec4a37bf0c50141e2e9460f0f89868b0000aa983821a30000262fa6f352428690666161664e3292a16379637902000000fddec45af635dc55b1e6172525000e8166470f3a0dd38580e2859ecff0410f117b0969e08f4cbec5c54de90d47e82c718f56afc421f9709d59be0be726f24ca70f1ba660085e1f0f6616f0438f34b267f36ab4c40141555d00564105ba16f2ae440fbc7b1f10ce00fefe41ff500909c4e17d2f777b8f897c806f3546de2a66dee4aec4213a5fc0660f38de8e85e1f3268f899892d7c401a5d926120700f4470f01c23830f34e0f2c9e21b34a08bb3cbb3c022091916af3420f2a52000f634df6456cd0818194d8004451dd480588f4410f12ca66460f3828b8cb0000001cffc4c3bd7c6d8300c401722d94f07200000064e42ec4a17c1002970691064181dd603dddead9c70f485c5e2e1926f571912cb143c09e00080000042cb1fc8374fb0a07c401f1eb27f247aceced36660f38058b976192361d09f5e597c4214c74ddc4625dba0f47cc47cc459cc4217917480065bc2d080000006766440f637bfc389f9f060f0f47d2aa080000004401a9bb0000420b31f5bd9d6175dd44880cbc00000000") 09:52:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000003f000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1906.580813][ T1917] binder: 1913:1917 got transaction with invalid data ptr [ 1906.619021][ T1917] binder: 1913:1917 transaction failed 29201/-14, size 24-0 line 3180 09:52:02 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1906.634760][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:52:03 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000000)={0x0, 0xc57, 0x4, [0xe7bd, 0x1, 0x9, 0x0]}, &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f00000001c0)={r3, 0x20}, 0x8) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f00000004c0)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c46542f107af0f000000005fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") setsockopt$inet6_tcp_buf(r0, 0x6, 0x1d, &(0x7f0000000100)="153fab9c71763134591b8ae396f4c69e8620c1ce2a0cfcab2e04defd1f2cad15bb7b8395a986e3ac8645da58bb0987adc83f37d83870074f8a1d80bca1b4d76ea2cd7181cf49d66efc75d3d9ddb3517eb157c27af33b7664894d4d4a4222abd877e0a5db8f3105ba27881e95d1e770b7000fe3cf4a1095923e15f4a1aa0538209df6880699ecc813ab6966f5a92f2dc6b61371018ff9fc113be9", 0x9a) 09:52:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000048000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:03 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1907.004100][ T2033] binder: 2028:2033 got transaction with invalid data ptr [ 1907.024200][ T2033] binder: 2028:2033 transaction failed 29201/-14, size 24-0 line 3180 [ 1907.071146][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000004c000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:03 executing program 1: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x8000, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x40, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0xa, 0x5383113d, 0x100000001, 0x200, 0x3f, r0, 0x8, [], 0x0, r1, 0x3ff, 0xffffffff}, 0x3c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x3, 0x4) connect$inet6(r3, &(0x7f0000000080), 0x1c) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = dup2(r2, r4) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r5, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) fcntl$getown(r3, 0x9) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1907.353365][ T2240] binder: 2238:2240 got transaction with invalid data ptr [ 1907.372887][ T2240] binder: 2238:2240 transaction failed 29201/-14, size 24-0 line 3180 [ 1907.393300][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:52:03 executing program 5: syz_execute_func(&(0x7f0000000700)="c4e379614832074a2be91cb9980f05f7a6aae28920aec4a37bf0c50141e2e922ebc4a2c42281a7a56ea74dae1ceb262fc4c6cd97e664d11bc421fa6f3d136c000000f2d2dec461dc57b1e67d0b25c6c583417916d61abed61abedbe1491e2f160f41fe4cbec5c54d0f2c718f56676beeee8f2870b63b309df8f86dc483057f6e3e5340b267f34cb4ba6681f9935499fa6c1fed6c1feda8271ec4647168c4c19dfb96f88e00000f3a16288836e70f8babf27f0000536bd10499660f383ca3300a0000efef768b8b8b27c4a27921f940abd8a1a12ad764cc42dfdb4066bd0ffe383baa32d467460f3300028f6a78106f65030000004074d266413a010f0f30ca30cac442fd21b19b0b0000f267a1c900000000ddc4411171f200c4e3c10c090e6e4f01dcdc6298c9c949f1a79ad0818194d800092ddd8f0b00c4a17ae64295007bf21c1c22ba22baa9a700002e3664644626cc4683b9080000000dc4e27d0ed2b2aad9c741af78470f73dc024c593e40d9f50f001e570000a858edc4037d092101c42119da3cb011000000e5c5c421fb5a1747cc474cf9f2400f118b7b000000c4216f5a0cdac421fd29fa002d08000000009b5d8ea7a7282856fe0564650f1b88000000a0a041574974ecd5c4c1cdc28a0000000000c5a2750831c44109f89700008020") syz_execute_func(&(0x7f0000000b00)="c4e379614832074a2be924f593980f053ef3aec4a37bf0c50141e2e90f6839c4437d3934e905262ff34290660f8fc978c65e1b1b63f1707802a60000f2d2c461fb12c736266765f241e109dc55b1e6250000c48251364669fa88008800859ecf491e2f16c2e54c80184cddcd8f56c42239b84900cc42319ebb70fe6581f0430dc0b267f34cb4ba1c585641564105ba16f2aec4018dfafbc423ed6cb83d0000fe7341ff50098f6838ee0a00c4c2799ff28f69609b5687a8e1430fae277cd8d8a1a12ad764b5c1c4213a5fc05fc18d308e8ed4f20f12e40000f440646666413a0f3930ca30ca5b5bc4a1adf289c1cedc065f0221c82b032b0309e20000c4c2801dc481fa1691e4a30000c4a149deac665f00000049e8e9368f684895a3000000803fad467c4700a59ad08181d800f0092d9d8f0b00c4a17ae64295807b1cffd2fb2e36646466264683b9080000000df3423ae2660f18eec4075ec4c2712e51f5014cf7b3ddaccd58c442790e1c44edd48127e4d11249e5a2a992af4c4e0b0ba1389f9f92008000008047910002c1045c0b47cc47ccf92ff265460f940665002d08000000c40208f35824420fae06aa5e0f4401a9bb000042c441cbd1ecd53131fbf30f1b94d8a4ffffff") 09:52:03 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000060000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) setsockopt$inet_group_source_req(r1, 0x0, 0x31, 0x0, 0x0) [ 1907.790455][ T2456] binder: 2452:2456 got transaction with invalid data ptr [ 1907.805441][ T2456] binder: 2452:2456 transaction failed 29201/-14, size 24-0 line 3180 09:52:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000280)={0x1f, {0xffffffffffffffff, 0x1ff, 0x3}}, 0xa) write$P9_ROPEN(r1, &(0x7f0000000000)={0x18, 0x12}, 0x18) recvfrom$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1907.846389][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000068000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:04 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:04 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:04 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) 09:52:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000006c000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:04 executing program 1: r0 = syz_open_dev$cec(&(0x7f0000000140)='/dev/cec#\x00', 0x1, 0x2) getsockopt$netrom_NETROM_T2(r0, 0x103, 0x2, &(0x7f0000000180)=0x4, &(0x7f00000001c0)=0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r1, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x40200200, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:52:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000074000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:05 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000007a000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:05 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) [ 1909.265322][ T3478] binder_transaction: 3 callbacks suppressed [ 1909.265332][ T3478] binder: 3474:3478 got transaction with invalid data ptr [ 1909.293629][ T3478] binder_transaction: 3 callbacks suppressed [ 1909.293648][ T3478] binder: 3474:3478 transaction failed 29201/-14, size 24-0 line 3180 [ 1909.326140][ T7899] binder_release_work: 3 callbacks suppressed [ 1909.326149][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000fffffdfd000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1909.548320][ T3691] binder: 3690:3691 got transaction with invalid data ptr [ 1909.584742][ T3691] binder: 3690:3691 transaction failed 29201/-14, size 24-0 line 3180 [ 1909.641242][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:05 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000060ff000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1909.893086][ T3804] binder: 3801:3804 got transaction with invalid data ptr [ 1909.927538][ T3804] binder: 3801:3804 transaction failed 29201/-14, size 24-0 line 3180 09:52:06 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clock_gettime(0x7, &(0x7f0000000140)) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-monitor\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f00000001c0)=0x5, 0x4) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") [ 1909.982858][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000fdfdffff000000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:06 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) [ 1910.264747][ T4119] binder: 4111:4119 got transaction with invalid data ptr [ 1910.293953][ T4119] binder: 4111:4119 transaction failed 29201/-14, size 24-0 line 3180 [ 1910.321650][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:06 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000004000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:06 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1910.747539][ T4320] binder: 4316:4320 got transaction with invalid data ptr [ 1910.812114][ T4320] binder: 4316:4320 transaction failed 29201/-14, size 24-0 line 3180 [ 1910.865040][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000ffffffffff6000004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:07 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319b") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1911.165789][ T4527] binder: 4526:4527 got transaction with invalid data ptr 09:52:07 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1911.276181][ T4527] binder: 4526:4527 transaction failed 29201/-14, size 24-0 line 3180 09:52:07 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) 09:52:07 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 1911.447029][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20}, 0xfffffe5d) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000240)={0x0, 0x0, 0x3, 0x0, [], [{0x800, 0xffffffffffffffff, 0x401, 0x3, 0x9, 0x6}, {0x6, 0x1e7, 0x10000, 0x7, 0x5, 0x1ff}], [[], [], []]}) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:52:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000007400004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:08 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1911.847338][ T4843] binder: 4830:4843 got transaction with invalid data ptr [ 1911.872553][ T4843] binder: 4830:4843 transaction failed 29201/-14, size 24-0 line 3180 [ 1912.005246][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:52:08 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000ffefffffff7f00004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:08 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x19f, 0x0) [ 1912.392880][ T5058] binder: 5057:5058 got transaction with invalid data ptr [ 1912.412133][ T5058] binder: 5057:5058 transaction failed 29201/-14, size 24-0 line 3180 [ 1912.442882][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:08 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd0") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:08 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x19f, 0x0) 09:52:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000009400004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:08 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:09 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x19f, 0x0) [ 1912.773706][ T5286] binder: 5219:5286 got transaction with invalid data ptr [ 1912.789917][ T5286] binder: 5219:5286 transaction failed 29201/-14, size 24-0 line 3180 [ 1912.811162][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000007150004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x1040020, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000240)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d80000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:52:09 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) [ 1913.068168][ T5543] binder: 5512:5543 got transaction with invalid data ptr [ 1913.089046][ T5543] binder: 5512:5543 transaction failed 29201/-14, size 24-0 line 3180 09:52:09 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) [ 1913.122019][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:52:09 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000070c0004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:09 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) 09:52:09 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x0, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:09 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) 09:52:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000050d0004f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:10 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:10 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) 09:52:10 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) mmap(&(0x7f0000008000/0xe000)=nil, 0xe000, 0x4, 0x400000024012, r2, 0x0) mremap(&(0x7f0000014000/0x1000)=nil, 0x1002, 0x2000, 0x3, &(0x7f0000008000/0x2000)=nil) r3 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0xbbd1c) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r3, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:52:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000014f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:10 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x0, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000024f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1914.439720][ T6487] binder_transaction: 3 callbacks suppressed [ 1914.439740][ T6487] binder: 6469:6487 got transaction with invalid data ptr [ 1914.480272][ T6487] binder_transaction: 3 callbacks suppressed [ 1914.480289][ T6487] binder: 6469:6487 transaction failed 29201/-14, size 24-0 line 3180 [ 1914.501265][ T4724] binder_release_work: 3 callbacks suppressed [ 1914.501273][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:52:10 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:10 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) 09:52:10 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x0, 0x0) getsockopt$inet_buf(r1, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:10 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$TIPC_IMPORTANCE(0xffffffffffffffff, 0x10f, 0x7f, &(0x7f0000000280)=0xdb8a, 0x4) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x8000000000010810, 0xffffffffffffffff, 0x6) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) openat$nullb(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/nullb0\x00', 0x41, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x3, 0x80) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000001c0)={0x10001}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup2(r0, r2) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000340)={0x10001, 0x8, 0x8, 0x4}, 0x10) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r0, 0x29, 0x50, 0x0, &(0x7f0000000300)) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000380), 0x4) syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x56d7, 0x40c000) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") openat$audio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/audio\x00', 0x800, 0x0) 09:52:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000034f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1914.799700][ T6635] binder: 6629:6635 got transaction with invalid data ptr [ 1914.859437][ T6635] binder: 6629:6635 transaction failed 29201/-14, size 24-0 line 3180 [ 1914.922236][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:11 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) 09:52:11 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000044f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:11 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:11 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) [ 1915.405413][ T6949] binder: 6946:6949 got transaction with invalid data ptr [ 1915.431629][ T6949] binder: 6946:6949 transaction failed 29201/-14, size 24-0 line 3180 [ 1915.494641][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000054f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:11 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) [ 1915.746499][ T7246] binder: 7224:7246 got transaction with invalid data ptr [ 1915.762109][ T7246] binder: 7224:7246 transaction failed 29201/-14, size 24-0 line 3180 [ 1915.786381][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:52:12 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:12 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) ioctl$SG_SET_TIMEOUT(r1, 0x2201, &(0x7f00000002c0)=0x2) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = syz_open_dev$sndpcmc(&(0x7f00000001c0)='/dev/snd/pcmC#D#c\x00', 0xfff, 0x0) setsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, &(0x7f0000000240)=0x2, 0x4) r4 = dup2(r0, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x3ffffffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000140)) signalfd4(r3, &(0x7f0000000300)={0x3}, 0x8, 0x800) getsockopt$inet6_int(r4, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:52:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000064f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:12 executing program 5: perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) 09:52:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) [ 1916.200475][ T7370] binder: 7368:7370 got transaction with invalid data ptr [ 1916.207731][ T7370] binder: 7368:7370 transaction failed 29201/-14, size 24-0 line 3180 [ 1916.296386][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:12 executing program 5: perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) 09:52:12 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000074f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:12 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x6, 0x12, 0x0, &(0x7f0000000000)=0x107) 09:52:12 executing program 5: perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) [ 1916.769202][ T7693] binder: 7687:7693 got transaction with invalid data ptr [ 1916.838462][ T7693] binder: 7687:7693 transaction failed 29201/-14, size 24-0 line 3180 [ 1916.909940][ T4724] binder: undelivered TRANSACTION_ERROR: 29201 09:52:13 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) 09:52:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000a4f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1917.132466][ T7960] binder: 7945:7960 got transaction with invalid data ptr [ 1917.165779][ T7960] binder: 7945:7960 transaction failed 29201/-14, size 24-0 line 3180 [ 1917.205446][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:13 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:13 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) syz_execute_func(&(0x7f0000000140)="c4c3196afd80660fdd07c481875fe4c461dd7d2dd4000000407fa9c4439969990a00000006c4a3314b78df03def3c4830d6afd0026660f518eeea7c8d8") r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) socket$nl_netfilter(0x10, 0x3, 0xc) shutdown(r1, 0x0) getsockopt$inet6_int(r1, 0x29, 0x4e, 0x0, &(0x7f0000000180)) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000300)={0x0, 0xea, "71d509b6feeeb07599a16a6d29e5ebc8e82ee3976d277356bcb5ecacf1d20da17ce6024ab12e5497347862d82c05eb0e6197e71cdff15c40fd56baf99ebd5dae07b230ebde3608d18389232b8268dbc337d5987d4e5dfd244d2575b4ad25264f0cfe89b903c3183f3b8436558f77ce84fc51712bb000c85945751e411baeffcb475fbc6ecaf575204b23b52386f79c8c5c9a6df0c042adcdca7b5ff9d1cd0bba67d2c2130788c013973dddef89d9bffc2224bfba43f253372ab8d42fed0021b40ca27eae00397ef56dfd9490d5c1555b662c4a6157260f55b4705ce661f76dd089ec0e4cd0ae405262ce"}, &(0x7f0000000400)=0xf2) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={r3, 0x100}, 0x8) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000240)={0x0, 0x1000, 0x6, [0x4, 0x3f, 0x9bc6, 0x40, 0x7fffffff, 0x7]}, &(0x7f0000000280)=0x14) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f00000002c0)={r4, 0x3}, 0x8) 09:52:13 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x0, 0x0, &(0x7f0000000000)=0x107) 09:52:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000124f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:13 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) [ 1917.562072][ T8187] binder: 8160:8187 got transaction with invalid data ptr [ 1917.608280][ T8187] binder: 8160:8187 transaction failed 29201/-14, size 24-0 line 3180 [ 1917.644705][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:13 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) 09:52:14 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000184f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:14 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) 09:52:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x0, 0x0, &(0x7f0000000000)=0x107) [ 1918.032097][ T8431] binder: 8412:8431 got transaction with invalid data ptr [ 1918.059774][ T8431] binder: 8412:8431 transaction failed 29201/-14, size 24-0 line 3180 [ 1918.094040][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000204f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) 09:52:14 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) [ 1918.390376][ T8728] binder: 8712:8728 got transaction with invalid data ptr [ 1918.415679][ T8728] binder: 8712:8728 transaction failed 29201/-14, size 24-0 line 3180 [ 1918.454955][ T7899] binder: undelivered TRANSACTION_ERROR: 29201 09:52:14 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000027c0)='/dev/full\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000000)={0x3000000000000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0xc600, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x6000, 0x0, {0x4}}, 0x14}}, 0x0) 09:52:14 executing program 5: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x19f, 0x0) 09:52:14 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_buf(r1, 0x6, 0x0, 0x0, &(0x7f0000000000)=0x107) 09:52:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000003f4f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1918.891971][ T8887] ================================================================== [ 1918.900405][ T8887] BUG: KASAN: stack-out-of-bounds in update_stack_state+0x5de/0x5f0 [ 1918.908399][ T8887] Read of size 8 at addr ffff88802e12fea6 by task syz-executor.5/8887 [ 1918.916549][ T8887] [ 1918.918887][ T8887] CPU: 0 PID: 8887 Comm: syz-executor.5 Not tainted 5.1.0-rc7+ #98 [ 1918.926782][ T8887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1918.936842][ T8887] Call Trace: [ 1918.940144][ T8887] dump_stack+0x172/0x1f0 [ 1918.944486][ T8887] ? update_stack_state+0x5de/0x5f0 [ 1918.949817][ T8887] print_address_description.cold+0x7c/0x20d [ 1918.955822][ T8887] ? update_stack_state+0x5de/0x5f0 [ 1918.961032][ T8887] ? update_stack_state+0x5de/0x5f0 [ 1918.966246][ T8887] kasan_report.cold+0x1b/0x40 [ 1918.971029][ T8887] ? update_stack_state+0x5de/0x5f0 [ 1918.976242][ T8887] __asan_report_load8_noabort+0x14/0x20 [ 1918.981892][ T8887] update_stack_state+0x5de/0x5f0 [ 1918.986945][ T8887] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 1918.993558][ T8887] unwind_next_frame.part.0+0x1a9/0xa20 [ 1918.999117][ T8887] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 1919.005726][ T8887] ? find_held_lock+0x35/0x130 [ 1919.010510][ T8887] ? unwind_dump+0x100/0x100 [ 1919.015115][ T8887] unwind_next_frame+0x3b/0x50 [ 1919.019887][ T8887] __save_stack_trace+0x83/0x100 [ 1919.024841][ T8887] ? hrtimer_nanosleep+0x2a6/0x570 [ 1919.029968][ T8887] save_stack_trace_tsk+0x46/0x60 [ 1919.035001][ T8887] proc_pid_stack+0x1c4/0x2c0 [ 1919.039695][ T8887] ? dname_to_vma_addr.isra.0+0x3a0/0x3a0 [ 1919.045523][ T8887] ? kasan_check_read+0x11/0x20 [ 1919.050389][ T8887] proc_single_show+0xf6/0x170 [ 1919.055171][ T8887] seq_read+0x4db/0x1130 [ 1919.059445][ T8887] do_iter_read+0x4a9/0x660 [ 1919.063957][ T8887] ? dup_iter+0x260/0x260 [ 1919.068309][ T8887] vfs_readv+0xf0/0x160 [ 1919.072471][ T8887] ? lock_downgrade+0x880/0x880 [ 1919.077338][ T8887] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 1919.083416][ T8887] ? kasan_check_read+0x11/0x20 [ 1919.088292][ T8887] ? ksys_dup3+0x3e0/0x3e0 [ 1919.092730][ T8887] ? kasan_check_read+0x11/0x20 [ 1919.097595][ T8887] ? _copy_to_user+0xc9/0x120 [ 1919.102291][ T8887] ? __fget_light+0x1a9/0x230 [ 1919.106997][ T8887] do_preadv+0x1c4/0x280 [ 1919.111256][ T8887] ? do_readv+0x370/0x370 [ 1919.115598][ T8887] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1919.121068][ T8887] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1919.126539][ T8887] ? do_syscall_64+0x26/0x610 [ 1919.131231][ T8887] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1919.137305][ T8887] ? do_syscall_64+0x26/0x610 [ 1919.142004][ T8887] __x64_sys_preadv+0x9a/0xf0 [ 1919.146790][ T8887] do_syscall_64+0x103/0x610 [ 1919.151396][ T8887] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1919.157293][ T8887] RIP: 0033:0x458da9 [ 1919.161195][ T8887] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1919.180810][ T8887] RSP: 002b:00007f703517ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 1919.189246][ T8887] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000458da9 [ 1919.197239][ T8887] RDX: 000000000000019f RSI: 00000000200017c0 RDI: 0000000000000004 [ 1919.205229][ T8887] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1919.213304][ T8887] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f703517b6d4 [ 1919.221296][ T8887] R13: 00000000004c5afc R14: 00000000004d9e48 R15: 00000000ffffffff [ 1919.229809][ T8887] [ 1919.232140][ T8887] The buggy address belongs to the page: [ 1919.237784][ T8887] page:ffffea0000b84bc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 1919.246640][ T8887] flags: 0x1fffc0000000000() [ 1919.251247][ T8887] raw: 01fffc0000000000 0000000000000000 ffffffff00000101 0000000000000000 [ 1919.259840][ T8887] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 1919.268421][ T8887] page dumped because: kasan: bad access detected [ 1919.274833][ T8887] [ 1919.277159][ T8887] Memory state around the buggy address: [ 1919.282799][ T8887] ffff88802e12fd80: 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00 09:52:15 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000200)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r2, 0xc034564b, &(0x7f0000000180)={0x0, 0x353a5942, 0x3f, 0x20, 0x0, @discrete={0x8, 0x7}}) getsockopt$inet6_int(r2, 0x29, 0x50, 0x0, &(0x7f00000000c0)=0x2da) syz_execute_func(&(0x7f0000000000)="994a2ae92c05964c0f05bf05000000c4a37bf0c5e041e2e92f22e9aabb3c0000004a0fc7a4ea70db000000000f383a9e02000000110f4e5bc4a265aa104b26660f38091e2fa2631bc421045f4607c421dd589fc4e10bf8e426f2f045f619640f0f6f43a038fd52262e2e66450f7d64c60865f2ad0383397fd3ff3a0065f20f7cd8efa1a12ad764d38f53efaf6766f2ab440fec3f67ddea660f79cec462b1f72ec3c4899294d800000000000fc4634148f70000c2a0c10b00cca27a0e0fc442cd376d000f9f3c6436b2aa66450fc4650000c4e39978c104d9a1e8719e70ddcdcda2660f38346800c4e3295d4c3dc8a3c4c1045ccc7d75c4426507af0f0000000f5fd25cf3460f2ad0f30f5ea5a9a50000ffff660f79ca553131b83a00a2f1fbfb766208cf") 09:52:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x25, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000484f5a3cbf716d0a4c0000000018"], 0x0, 0x0, 0x0}) [ 1919.290873][ T8887] ffff88802e12fe00: 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 [ 1919.298946][ T8887] >ffff88802e12fe80: 00 f1 f1 f1 f1 00 00 f3 f3 00 00 00 00 00 00 00 [ 1919.307019][ T8887] ^ [ 1919.312143][ T8887] ffff88802e12ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1919.320224][ T8887] ffff88802e12ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1919.328295][ T8887] ================================================================== [ 1919.336363][ T8887] Disabling lock debugging due to kernel taint [ 1919.410328][ T8887] Kernel panic - not syncing: panic_on_warn set ... [ 1919.416985][ T8887] CPU: 1 PID: 8887 Comm: syz-executor.5 Tainted: G B 5.1.0-rc7+ #98 [ 1919.426278][ T8887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1919.436347][ T8887] Call Trace: [ 1919.439654][ T8887] dump_stack+0x172/0x1f0 [ 1919.443995][ T8887] panic+0x2cb/0x65c [ 1919.447899][ T8887] ? __warn_printk+0xf3/0xf3 [ 1919.452508][ T8887] ? update_stack_state+0x5de/0x5f0 [ 1919.457727][ T8887] ? preempt_schedule+0x4b/0x60 [ 1919.462606][ T8887] ? ___preempt_schedule+0x16/0x18 [ 1919.467737][ T8887] ? trace_hardirqs_on+0x5e/0x230 [ 1919.472785][ T8887] ? update_stack_state+0x5de/0x5f0 [ 1919.477992][ T8887] end_report+0x47/0x4f [ 1919.482167][ T8887] ? update_stack_state+0x5de/0x5f0 [ 1919.487379][ T8887] kasan_report.cold+0xe/0x40 [ 1919.492065][ T8887] ? update_stack_state+0x5de/0x5f0 [ 1919.497273][ T8887] __asan_report_load8_noabort+0x14/0x20 [ 1919.502918][ T8887] update_stack_state+0x5de/0x5f0 [ 1919.507953][ T8887] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 1919.514554][ T8887] unwind_next_frame.part.0+0x1a9/0xa20 [ 1919.520109][ T8887] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 1919.526711][ T8887] ? find_held_lock+0x35/0x130 [ 1919.531497][ T8887] ? unwind_dump+0x100/0x100 [ 1919.536498][ T8887] unwind_next_frame+0x3b/0x50 [ 1919.541272][ T8887] __save_stack_trace+0x83/0x100 [ 1919.546401][ T8887] ? hrtimer_nanosleep+0x2a6/0x570 [ 1919.551561][ T8887] save_stack_trace_tsk+0x46/0x60 [ 1919.556616][ T8887] proc_pid_stack+0x1c4/0x2c0 [ 1919.561309][ T8887] ? dname_to_vma_addr.isra.0+0x3a0/0x3a0 [ 1919.567050][ T8887] ? kasan_check_read+0x11/0x20 [ 1919.571917][ T8887] proc_single_show+0xf6/0x170 [ 1919.576688][ T8887] seq_read+0x4db/0x1130 [ 1919.580956][ T8887] do_iter_read+0x4a9/0x660 [ 1919.585462][ T8887] ? dup_iter+0x260/0x260 [ 1919.589894][ T8887] vfs_readv+0xf0/0x160 [ 1919.594061][ T8887] ? lock_downgrade+0x880/0x880 [ 1919.598932][ T8887] ? compat_rw_copy_check_uvector+0x3f0/0x3f0 [ 1919.605013][ T8887] ? kasan_check_read+0x11/0x20 [ 1919.609891][ T8887] ? ksys_dup3+0x3e0/0x3e0 [ 1919.614316][ T8887] ? kasan_check_read+0x11/0x20 [ 1919.619177][ T8887] ? _copy_to_user+0xc9/0x120 [ 1919.623876][ T8887] ? __fget_light+0x1a9/0x230 [ 1919.628573][ T8887] do_preadv+0x1c4/0x280 [ 1919.632834][ T8887] ? do_readv+0x370/0x370 [ 1919.637169][ T8887] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1919.642632][ T8887] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1919.648103][ T8887] ? do_syscall_64+0x26/0x610 [ 1919.652109][ T8952] kobject: 'rfkill2934' (000000000c500d14): kobject_add_internal: parent: 'phy2932', set: 'devices' [ 1919.652789][ T8887] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1919.652811][ T8887] ? do_syscall_64+0x26/0x610 [ 1919.664527][ T8952] kobject: 'rfkill2934' (000000000c500d14): kobject_uevent_env [ 1919.669645][ T8887] __x64_sys_preadv+0x9a/0xf0 [ 1919.669662][ T8887] do_syscall_64+0x103/0x610 [ 1919.669680][ T8887] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1919.669711][ T8887] RIP: 0033:0x458da9 [ 1919.675254][ T8952] kobject: 'rfkill2934' (000000000c500d14): fill_kobj_path: path = '/devices/virtual/mac80211_hwsim/hwsim2931/ieee80211/phy2932/rfkill2934' [ 1919.682083][ T8887] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1919.682091][ T8887] RSP: 002b:00007f703517ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 1919.682102][ T8887] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000458da9 [ 1919.682109][ T8887] RDX: 000000000000019f RSI: 00000000200017c0 RDI: 0000000000000004 [ 1919.682117][ T8887] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1919.682124][ T8887] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f703517b6d4 [ 1919.682146][ T8887] R13: 00000000004c5afc R14: 00000000004d9e48 R15: 00000000ffffffff [ 1919.725904][ T8952] ieee80211 phy2932: Selected rate control algorithm 'minstrel_ht' [ 1919.736244][ T8887] Kernel Offset: disabled [ 1919.796696][ T8887] Rebooting in 86400 seconds..