e(&(0x7f0000a62000/0x1000)=nil, 0x200000, 0x10200000008) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, &(0x7f0000000580)={0x0, @reserved}) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000500)=0xfffffffffffffff8, 0x4) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000640)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10000174a3ac8694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde318ead4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28b774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a800655d127de6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047526865c84f7cff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d8191643"}) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000080)=0x10000000002) ioctl$KVM_RUN(r3, 0xae80, 0x0) 23:01:52 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x200000000d8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0) close(0xffffffffffffffff) r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, &(0x7f0000000100)=@ethernet, &(0x7f0000000180)=0x80) socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r2 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) r3 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f0000000480)={0x2a36, 0x4000f75, 0x6, 0x0, 0x0, [], [], [], 0x7caa, 0x6}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, 0x0) setsockopt(r2, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r2, &(0x7f0000e5c000)={0x2, 0x4e20, @loopback}, 0x10) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) process_vm_writev(0x0, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/185, 0xb9}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) socket$kcm(0x10, 0x2, 0x10) ioctl$KVM_S390_UCAS_UNMAP(r3, 0x4018ae51, &(0x7f0000000040)={0x20}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) r4 = accept(r1, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b90200000005000000000000008e6763f270e14ff2c25ccc9ac85c0180000063c94d6b7227311eeb74413291bbeeea5c234d4807389013f7450d0000b5000000001b11d749a5a6dd04f317fa56e40d5618474aa1c59e84e2699ff1885b0361196f61b510f0d3a3fb8070da9e6bf4c50723e3b5976f29057246bab492e03cca508019156ce4c3d8ffbc02da4b1e71c0519276e8bb3b1b58e32e368e19174c18ab140f6f34809d98cc0bb793ca1c24290b465dbdd287010006000000000010a1a88dd3b66caad3901294ee361a8db74515ff628d31380b3edfb0f23410d40284209db8341921e58fd1ea1a8500b89382c68cf36b67166c359a16152076d13f9cd67fbdf6c26538776e0fd7379d062c6f615c79e63834479a9346a1b2c4c54c29ba1b65924f964796e5152ca8e6b89ba490cf685535de3f9a51e172735cd552afce7a0e374ef3ea141cff0fc1b2b1e8bd8f5aa7c7ac962506f0db93056df402edb2f5400c5f11555be14277b3297bf4889bcea72b74f71f40236f3640a6212c17fe360d4fd68f9ab750ca6912ece506f510fea93d1106c04c6f35cc732b05573b96d082b92ff22cc2a2e4e585013644ab2b5f976a12922bc54e9376bb7cbd7ba829d23f9f3df2d9e32914f909f62824bbe891d028ef5c47e0b88f56a996c80b7d08425249fc7e63dc12ca768aa4fe2973806c0c0a7ead0d6d61ff2540691db06322fe0d3b943ee422ea2e250774bd9fe352e066e4c4c93163005bcccf975deaef5dec1c0ef680f42c5e6d95ad0f1130e08f1cd5c8720fabcabbd1d1e711542d74c74711b648eb007498ee289fedbad3c151edeb2f7d1384c021ce57d4a9817ea20d613cc7e0514e3a53507ed125f01a024deb15e50f06e15b0035209b07beded0a4b19e0e6eb147a23022bc24562d4303f22422bfbf767bb1b7f0edb350bbd82bc1f5a85484faf70b3614656508227c8cab57d3e59ce5529832981be9270096c2659e10308f7d7bf83bc9f6d6f4be2056a8f79caaae060e74a33d15042e6898073788d7c155ee2f1fbf196f8416e04251080238df7ea59246582113b6df0cd1b38f23066003e5d00a517165a0c0ce18e1d40c099e90a8b06352664a3bd30ff7d8a0eb85f88f9254c9082788b2502cc11c3b21a2cb78fb05f6bd29aa27cff0eed2bf3c31a7196d843a9e40d65c8fde2c3b23"], 0x1}}, 0x0) sendmmsg(r2, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) gettid() [ 309.639793] binder: 14356:14358 unknown command 64 [ 309.653329] binder: 14356:14358 ioctl c0306201 20000600 returned -22 23:01:52 executing program 2: setxattr$security_evm(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.evm\x00', &(0x7f0000000200)=@ng={0x4, 0x4, "d2981bf3109012f5333ef4d51b18ed75"}, 0x12, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) symlink(&(0x7f0000000240)='./file1\x00', &(0x7f0000000280)='./file0/../file0\x00') r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000440)='/dev/autofs\x00', 0x10000, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r1, 0x80dc5521, &(0x7f0000000900)=""/92) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$jfs(&(0x7f00000002c0)='jfs\x00', &(0x7f0000000300)='./file1\x00', 0x624b, 0x8, &(0x7f0000000780)=[{&(0x7f0000000340)="6e549e6c29f4adbd3406ee43f0569c628d5c1d04e90e9dfe4fa61d0c7e9eb799cec97c0abde5c6f2cf9bc6136c5409f6641241f7352cd6a36d05f299c3626afb261e0a66f83dfb237f446e3d00bc5b26e969700e697573dfa5c189b34df8896666db74549e4ac67c9a955fe4b99a0729752595b1ac6203db4bf56297428227966604cb2032e94eeb747eed6d81559fadaaee6958", 0x94, 0x9}, {&(0x7f0000000400)="1dda5f443ae165d1067ed80db9749851d980be116a1a28c8afaa602bd0e19f", 0x1f, 0x7}, {&(0x7f0000000440), 0x0, 0x7}, {&(0x7f0000000480)="91796ddc2fac5856", 0x8, 0xfffffffffffffffc}, {&(0x7f00000004c0)="67631a7df88144821e0ebfd10bee", 0xe, 0x83}, {&(0x7f0000000500)="98970db513405276b63a5b6a62eddc65895311017be653cdc222c75d14e44a73d1158fd1175665ea6fff4541f96152bf9bc7c266bfe7a5dff1c0ef0746d26511efe07623568eb62ddea19d598aa8b78c55c09df2f8b875cf5d4028cb69622a5d35913c12ccec9401862977cac19b8d9b64e1d1fcce949614377af721e2229a855b546ab41d36eb108436b2b6316410c47e1e0979cb80ca7091d1dde0afe0b8a59790c1b43fcdd2f5daa11a7cf46ea1a091ffac3d05b40c1f4d2b20faa6ff4ecff62a272d3918bac3fcc5321d7f6e38e1d289b4fd23d5cd02a1a2e38dbe6e4daf", 0xe0, 0x4}, {&(0x7f0000000640)="bb5646f579d9b754afea86c5481664f97c757e9ba20886c09af1a90c285199624c31d86a8d9ac1de9afb8ca79dc70873906a8c567457d7a5da8794c1ecbe391f2469f952af5cb71555693660a4e3c23076dae3e3392625c5f6852f4ff99aa94a120823c3b60e9cadc1", 0x69, 0x200}, {&(0x7f00000006c0)="8306ec36dda22b07edd2b9bee63525a92f8c81ce30a9becc892fa83bc09952358c17baba1738ef28c1fed6e5dc319463dd9704a081da335324d0757202fddee01ffdc523856e0629906001aff7566ede97c377a4124bb4cbb59a28ac7cc8f6751f10577cb0c9c88afa6fbaa67a28ecc50fb4d3489f89b435d29e7ccb83df375d922517d619756156f71f65a986d9a94e97057acf4196e3167cad", 0x9a, 0x3}], 0x212a004, &(0x7f0000000840)={[{@errors_remount='errors=remount-ro'}, {@noquota='noquota'}, {@noquota='noquota'}, {@nointegrity='nointegrity'}, {@nodiscard='nodiscard'}, {@noquota='noquota'}, {@discard='discard'}, {@nodiscard='nodiscard'}, {@nointegrity='nointegrity'}], [{@subj_user={'subj_user', 0x3d, 'security.evm\x00'}}, {@dont_measure='dont_measure'}, {@fsmagic={'fsmagic'}}]}) iopl(0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 309.695604] syz-executor.2: vmalloc: allocation failure: 4096 bytes, mode:0x14280c0(GFP_USER|__GFP_ZERO), nodemask=(null) [ 309.741786] syz-executor.2 cpuset=syz2 mems_allowed=0-1 [ 309.764412] binder: 14373:14379 unknown command 64 [ 309.777863] CPU: 1 PID: 14341 Comm: syz-executor.2 Not tainted 4.14.146 #0 [ 309.784927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 309.794288] Call Trace: [ 309.796892] dump_stack+0x138/0x197 [ 309.800537] warn_alloc.cold+0x96/0x1af [ 309.804529] ? zone_watermark_ok_safe+0x2b0/0x2b0 [ 309.809412] ? _raw_spin_unlock_irq+0x28/0x90 [ 309.813918] ? __get_vm_area_node+0x27f/0x340 [ 309.818406] __vmalloc_node_range+0x3c3/0x6a0 [ 309.822885] ? check_stack_object+0x114/0x160 [ 309.827376] __vmalloc+0x44/0x50 [ 309.830742] ? bpf_prog_alloc+0x40/0x1e0 [ 309.834795] bpf_prog_alloc+0x40/0x1e0 [ 309.838664] bpf_prog_load+0x292/0xf30 [ 309.842531] ? find_held_lock+0x35/0x130 [ 309.846573] ? __bpf_prog_charge+0xc0/0xc0 [ 309.850792] ? lock_downgrade+0x6e0/0x6e0 [ 309.854927] ? kasan_check_write+0x14/0x20 [ 309.859143] ? _copy_from_user+0x99/0x110 [ 309.863284] SyS_bpf+0x433/0x2da8 [ 309.866731] ? lock_downgrade+0x6e0/0x6e0 [ 309.870860] ? bpf_prog_get+0x20/0x20 [ 309.874644] ? __sb_end_write+0xc1/0x100 [ 309.878688] ? vfs_write+0x104/0x500 [ 309.882382] ? SyS_write+0x15e/0x230 [ 309.886085] ? bpf_prog_get+0x20/0x20 [ 309.889877] do_syscall_64+0x1e8/0x640 [ 309.893760] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 309.898591] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 309.903771] RIP: 0033:0x459a29 [ 309.906942] RSP: 002b:00007f85dee02c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 309.914631] RAX: ffffffffffffffda RBX: 00007f85dee02c90 RCX: 0000000000459a29 [ 309.921882] RDX: 0000000000000048 RSI: 0000000020000100 RDI: 0000000000000005 [ 309.929142] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 309.936404] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f85dee036d4 [ 309.943652] R13: 00000000004bfe81 R14: 00000000004d1cf0 R15: 0000000000000004 [ 309.952715] audit: type=1400 audit(1569884512.750:63): avc: denied { name_bind } for pid=14371 comm="syz-executor.0" src=20000 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1 23:01:53 executing program 3: r0 = syz_open_dev$usbmon(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{0x0}], 0x1}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000080)={'sit0\x00', @ifru_flags}) close(0xffffffffffffffff) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000140)="240000001e0007041dfffd946f610500070000001f00000000000400080009", 0x1f}], 0x1}, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x802, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000002c0)={&(0x7f000019a000/0x1000)=nil, &(0x7f0000090000/0x2000)=nil, &(0x7f0000300000/0x4000)=nil, &(0x7f00004e8000/0x1000)=nil, &(0x7f000087f000/0xe000)=nil, &(0x7f000023d000/0x4000)=nil, &(0x7f0000bf0000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000295000/0x3000)=nil, &(0x7f000066e000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000180)="4b46fef689e57035b481bfd0ac549530b855a321f2a587ef6c556bea65f404db002b7615f6eac102367246a974668b4e2a4e35ea9fa149dff89e8c21f96c2e38968da5200d2d0f82ac5ff67c325bea3a6c48e88c684f4695d388be7be0f95e3e2fb2340426a0ae8d7efcf9f346795abe5b02e0d9429c344c184651d8ff9361d69951e103749daf7eb8a432469d175a842131f5ead6ed171104e65bff5410ac32328fcf871ecf6a785a17dcc0e4e43812c55f153717efda304a3678", 0xbb, r1}, 0x68) ioctl$VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f0000000340)={0x0, @pix_mp={0x4, 0x6, 0x3136564e, 0x9, 0xc, [{0xd59b, 0x5}, {0x100, 0xffffff01}, {0x4, 0x3}, {0x2797, 0xfffffff8}, {0x5, 0x4}, {0x9, 0xffff7fff}, {0x5, 0x7}, {0x70f, 0x80000001}], 0x0, 0x3, 0x6, 0x1, 0x2}}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000095dff8), 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) pwritev(r2, &(0x7f0000001380)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0) fallocate(r2, 0x20, 0x0, 0xfffffeff000) fallocate(r2, 0x10, 0x0, 0x10000101) 23:01:53 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 310.073856] binder: 14373:14379 ioctl c0306201 20000600 returned -22 23:01:53 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 310.298909] audit: type=1400 audit(1569884512.750:64): avc: denied { node_bind } for pid=14371 comm="syz-executor.0" src=20000 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:node_t:s0 tclass=dccp_socket permissive=1 23:01:53 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) close(r0) socket$vsock_dgram(0x28, 0x2, 0x0) io_setup(0x200, &(0x7f0000000140)=0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x20040, 0x0) bpf$MAP_CREATE(0x2, &(0x7f0000000040)={0x0, 0x0, 0x77fffb}, 0x3c) io_submit(r1, 0x343, &(0x7f0000000040)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x4}]) 23:01:53 executing program 2: timer_create(0x827baec7917c1e67, 0x0, &(0x7f0000000840)=0x0) timer_gettime(r0, 0x0) timer_getoverrun(r0) socket$pppoe(0x18, 0x1, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="0863104000000000060000000700000000000000"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000080)={0x0, 0x0, r5}) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpuacct.usage_all\x00', 0x0, 0x0) ioctl$RTC_PIE_OFF(r7, 0x7006) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000200)={r6, 0x0, r7}) [ 310.605977] binder: 14409:14416 unknown command 64 23:01:53 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 310.628523] audit: type=1400 audit(1569884513.120:65): avc: denied { name_connect } for pid=14371 comm="syz-executor.0" dest=20000 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1 [ 310.657693] binder: 14409:14416 ioctl c0306201 20000600 returned -22 [ 310.691546] dccp_close: ABORT with 1061 bytes unread 23:01:53 executing program 4: getpeername$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000100)=0x14) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x1, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={r0, 0xc0, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=0x1, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x5, 0x5}, 0x0, 0x0, &(0x7f0000000380)={0x3, 0x10, 0xfffffff7, 0x22}, &(0x7f00000003c0)=0xffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=0x7fff}}, 0x10) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000400)=ANY=[@ANYBLOB="090080aa00000000b6784240111071fea80f4bfccd7407a316017a61aeeba4e5a49a3f999649e8bdb37f184b92c93f0956968538aa679f911be1ec223121f802f6a457e8e745acdf3ce5a47e0f0c9da6002eda93bf74"], 0x8) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x80000102, 0x8972, 0xffffffffffffffff, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x108) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000240)={0x0, 0x80, "fcd0d4c8f04c596cff5d338bee748c9e2bcde27a6d9ecf06538baab4ba4f39b7c9f59d6095901ab75a17cfb3c1b612d4baa7cf63baa3bccc3f6462ed349ac65aae67917c2d181c0217f091c94d9f8bc3f81990197bc05c5a3d307a6184c8a605db078c4a55fffdb06d3d2aa8fc3f4c18cabac6d04284f69d40d179eaff86ce32"}, &(0x7f00000001c0)=0x88) socketpair$nbd(0x1, 0x1, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000540)) syz_open_dev$sndtimer(&(0x7f0000000180)='/dev/snd/timer\x00', 0x0, 0x40000) madvise(&(0x7f0000a7c000/0x4000)=nil, 0x4000, 0x12) madvise(&(0x7f0000a62000/0x1000)=nil, 0x200000, 0x10200000008) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, &(0x7f0000000580)={0x0, @reserved}) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000500)=0xfffffffffffffff8, 0x4) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000640)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10000174a3ac8694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde318ead4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28b774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a800655d127de6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047526865c84f7cff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d8191643"}) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000080)=0x10000000002) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 310.758925] Mem-Info: [ 310.762533] active_anon:238977 inactive_anon:201 isolated_anon:0 [ 310.762533] active_file:8568 inactive_file:12053 isolated_file:0 [ 310.762533] unevictable:0 dirty:223 writeback:0 unstable:0 [ 310.762533] slab_reclaimable:13304 slab_unreclaimable:109392 [ 310.762533] mapped:59383 shmem:247 pagetables:3130 bounce:0 [ 310.762533] free:1150129 free_pcp:244 free_cma:0 23:01:53 executing program 3: socket(0x11, 0x0, 0x0) dup(0xffffffffffffffff) syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x1, 0x2) ioctl$VIDIOC_LOG_STATUS(0xffffffffffffffff, 0x5646, 0x0) syz_open_dev$radio(0x0, 0x0, 0x2) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00') r0 = gettid() tkill(r0, 0x3c) chdir(0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) msync(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x94331c6b254b5f04) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x20000, 0x0) ioctl$VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f00000002c0)={0x2, @sdr={0x0, 0xfffffffb}}) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r7, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000040)='vegas\x00', 0x6) ioctl$FS_IOC_GETFSMAP(r7, 0xc0c0583b, &(0x7f00000002c0)=ANY=[]) sendto$inet(r7, &(0x7f00000012c0)=' ', 0x64c8, 0x3, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYRESOCT=r4, @ANYRES32, @ANYRES32=0x0, @ANYPTR64, @ANYRES32], 0x5}, 0x1, 0x0, 0x0, 0x40}, 0x1) [ 310.843821] Node 0 active_anon:949636kB inactive_anon:804kB active_file:34552kB inactive_file:47888kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:237432kB dirty:916kB writeback:8kB shmem:988kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 370688kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no 23:01:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x200000000d8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0) close(0xffffffffffffffff) r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, &(0x7f0000000100)=@ethernet, &(0x7f0000000180)=0x80) socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r2 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) r3 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f0000000480)={0x2a36, 0x4000f75, 0x6, 0x0, 0x0, [], [], [], 0x7caa, 0x6}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, 0x0) setsockopt(r2, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r2, &(0x7f0000e5c000)={0x2, 0x4e20, @loopback}, 0x10) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) process_vm_writev(0x0, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/185, 0xb9}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) socket$kcm(0x10, 0x2, 0x10) ioctl$KVM_S390_UCAS_UNMAP(r3, 0x4018ae51, &(0x7f0000000040)={0x20}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) r4 = accept(r1, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b90200000005000000000000008e6763f270e14ff2c25ccc9ac85c0180000063c94d6b7227311eeb74413291bbeeea5c234d4807389013f7450d0000b5000000001b11d749a5a6dd04f317fa56e40d5618474aa1c59e84e2699ff1885b0361196f61b510f0d3a3fb8070da9e6bf4c50723e3b5976f29057246bab492e03cca508019156ce4c3d8ffbc02da4b1e71c0519276e8bb3b1b58e32e368e19174c18ab140f6f34809d98cc0bb793ca1c24290b465dbdd287010006000000000010a1a88dd3b66caad3901294ee361a8db74515ff628d31380b3edfb0f23410d40284209db8341921e58fd1ea1a8500b89382c68cf36b67166c359a16152076d13f9cd67fbdf6c26538776e0fd7379d062c6f615c79e63834479a9346a1b2c4c54c29ba1b65924f964796e5152ca8e6b89ba490cf685535de3f9a51e172735cd552afce7a0e374ef3ea141cff0fc1b2b1e8bd8f5aa7c7ac962506f0db93056df402edb2f5400c5f11555be14277b3297bf4889bcea72b74f71f40236f3640a6212c17fe360d4fd68f9ab750ca6912ece506f510fea93d1106c04c6f35cc732b05573b96d082b92ff22cc2a2e4e585013644ab2b5f976a12922bc54e9376bb7cbd7ba829d23f9f3df2d9e32914f909f62824bbe891d028ef5c47e0b88f56a996c80b7d08425249fc7e63dc12ca768aa4fe2973806c0c0a7ead0d6d61ff2540691db06322fe0d3b943ee422ea2e250774bd9fe352e066e4c4c93163005bcccf975deaef5dec1c0ef680f42c5e6d95ad0f1130e08f1cd5c8720fabcabbd1d1e711542d74c74711b648eb007498ee289fedbad3c151edeb2f7d1384c021ce57d4a9817ea20d613cc7e0514e3a53507ed125f01a024deb15e50f06e15b0035209b07beded0a4b19e0e6eb147a23022bc24562d4303f22422bfbf767bb1b7f0edb350bbd82bc1f5a85484faf70b3614656508227c8cab57d3e59ce5529832981be9270096c2659e10308f7d7bf83bc9f6d6f4be2056a8f79caaae060e74a33d15042e6898073788d7c155ee2f1fbf196f8416e04251080238df7ea59246582113b6df0cd1b38f23066003e5d00a517165a0c0ce18e1d40c099e90a8b06352664a3bd30ff7d8a0eb85f88f9254c9082788b2502cc11c3b21a2cb78fb05f6bd29aa27cff0eed2bf3c31a7196d843a9e40d65c8fde2c3b23"], 0x1}}, 0x0) sendmmsg(r2, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) gettid() [ 310.968547] devpts: called with bogus options [ 311.005506] binder: 14409:14416 unknown command 64 [ 311.009355] Node 1 active_anon:0kB inactive_anon:0kB active_file:144kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 311.010771] binder: 14409:14416 ioctl c0306201 20000600 returned -22 23:01:54 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 311.340658] Node 0 DMA free:15908kB min:216kB low:268kB high:320kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB 23:01:54 executing program 2: r0 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0xff, 0xa0201) ioctl$DRM_IOCTL_GET_UNIQUE(r0, 0xc0106401, &(0x7f00000002c0)={0x5c, &(0x7f0000000240)=""/92}) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$cgroup_subtree(r0, &(0x7f0000000300)='cgroup.subtree_control\x00', 0x2, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="ad63104000000000000000000005c7ef00000000"], 0x0, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) r4 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/checkreqprot\x00', 0x101000, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r4, 0x80045700, &(0x7f0000000400)) sendfile(r2, r3, 0x0, 0x800000000024) write$FUSE_STATFS(r3, &(0x7f0000000340)={0x60, 0x7a325fb34dc365b, 0x7, {{0x1, 0x4, 0x8000, 0x288e, 0x7, 0x40, 0x380, 0x401}}}, 0x60) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x4) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="850000002f000000570000000000000095000000000000008cdc127c25b7bdae6034611996a1606c01b232687c5c8410d9e41ba59403b6f2c98abb98f0d7b31b7df17b73a5aae010ccb376e171aa882eb9fe9fe609a673305e50ce98a02d915f9edd0c8feaf67c9588b26306004500d0996a9c1e565953169320c43f42696921160845ac446e5a78ddf1b29ebfd57aad8bb05d6039f88cc13f84dc1af8fa60041157afa297c10c16022e829c34e5a4a1efc54122d0a8032550368d691366d07c2dcb2a62948ffd94a782d31902"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x2}, 0x10}, 0x70) [ 311.475592] lowmem_reserve[]: 0 2580 2580 2580 [ 311.521799] Node 0 DMA32 free:793872kB min:36468kB low:45584kB high:54700kB active_anon:957960kB inactive_anon:804kB active_file:34076kB inactive_file:49788kB unevictable:0kB writepending:980kB present:3129332kB managed:2644888kB mlocked:0kB kernel_stack:9920kB pagetables:12600kB bounce:0kB free_pcp:1164kB local_pcp:468kB free_cma:0kB [ 311.597544] lowmem_reserve[]: 0 0 0 0 [ 311.635836] Node 0 Normal free:0kB min:0kB low:0kB high:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB 23:01:54 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x0, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 311.677107] binder: 14454:14456 unknown command 64 [ 311.715836] binder: 14454:14456 ioctl c0306201 20000600 returned -22 [ 311.758542] devpts: called with bogus options 23:01:54 executing program 3: socket(0x11, 0x0, 0x0) dup(0xffffffffffffffff) syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x1, 0x2) ioctl$VIDIOC_LOG_STATUS(0xffffffffffffffff, 0x5646, 0x0) syz_open_dev$radio(0x0, 0x0, 0x2) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00') r0 = gettid() tkill(r0, 0x3c) chdir(0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) msync(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x94331c6b254b5f04) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x20000, 0x0) ioctl$VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f00000002c0)={0x2, @sdr={0x0, 0xfffffffb}}) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r7, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000040)='vegas\x00', 0x6) ioctl$FS_IOC_GETFSMAP(r7, 0xc0c0583b, &(0x7f00000002c0)=ANY=[]) sendto$inet(r7, &(0x7f00000012c0)=' ', 0x64c8, 0x3, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYRESOCT=r4, @ANYRES32, @ANYRES32=0x0, @ANYPTR64, @ANYRES32], 0x5}, 0x1, 0x0, 0x0, 0x40}, 0x1) [ 311.779446] binder: 14454:14458 unknown command 64 [ 311.786382] binder: 14454:14458 ioctl c0306201 20000600 returned -22 23:01:54 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$rxrpc(0x21, 0x2, 0x9) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x88001) sendfile(r0, r1, 0x0, 0x800000000024) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000600)) setresuid(0x0, r3, 0x0) lstat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ENTRY(r1, &(0x7f0000000540)={0x90, 0x0, 0x3, {0x4, 0x3, 0x6, 0x2, 0x0, 0x0, {0x3, 0xbcf0, 0x0, 0x1, 0xfff, 0x5, 0x0, 0x9, 0x9, 0x9, 0x1, r3, r4, 0x7, 0x8}}}, 0x90) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="85c0dd68670000007a0000000000000095202a71e7000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5335, &(0x7f0000000200)={0x3a, 0xf2c, 0x5, 'queue0\x00', 0xff}) r5 = syz_open_dev$mice(&(0x7f00000003c0)='/dev/input/mice\x00', 0x0, 0x40880) bind$alg(r5, &(0x7f0000000400)={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0x58) r6 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write$P9_RLERROR(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB="0a00000007020001002d7f67af97a060fe36966dc5e2d309252030670cfaa43a9db0cde5084314d8e0a3a216d0e9e83372774a5aa38f997f0107cfaec241c424f6a756c63a65b33bf7b0d325ec3c4faaceb0d9994576ae0a189f0d456ebf019e"], 0xa) r7 = syz_open_dev$vivid(&(0x7f00000000c0)='/dev/video#\x00', 0x1, 0x2) ioctl$VIDIOC_G_MODULATOR(r7, 0xc0445636, &(0x7f0000000340)={0x8, "ff06625f921e671e0d1b1e5eadbdb51230bbe49230fdfef34febbaa9563ab036", 0x10, 0x8001, 0x0, 0x10, 0x3}) 23:01:54 executing program 4: r0 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0xff, 0xa0201) ioctl$DRM_IOCTL_GET_UNIQUE(r0, 0xc0106401, &(0x7f00000002c0)={0x5c, &(0x7f0000000240)=""/92}) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$cgroup_subtree(r0, &(0x7f0000000300)='cgroup.subtree_control\x00', 0x2, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="ad63104000000000000000000005c7ef00000000"], 0x0, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) r4 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/checkreqprot\x00', 0x101000, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r4, 0x80045700, &(0x7f0000000400)) sendfile(r2, r3, 0x0, 0x800000000024) write$FUSE_STATFS(r3, &(0x7f0000000340)={0x60, 0x7a325fb34dc365b, 0x7, {{0x1, 0x4, 0x8000, 0x288e, 0x7, 0x40, 0x380, 0x401}}}, 0x60) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000080), &(0x7f00000000c0)=0x4) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="850000002f000000570000000000000095000000000000008cdc127c25b7bdae6034611996a1606c01b232687c5c8410d9e41ba59403b6f2c98abb98f0d7b31b7df17b73a5aae010ccb376e171aa882eb9fe9fe609a673305e50ce98a02d915f9edd0c8feaf67c9588b26306004500d0996a9c1e565953169320c43f42696921160845ac446e5a78ddf1b29ebfd57aad8bb05d6039f88cc13f84dc1af8fa60041157afa297c10c16022e829c34e5a4a1efc54122d0a8032550368d691366d07c2dcb2a62948ffd94a782d31902"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x2}, 0x10}, 0x70) [ 311.886178] lowmem_reserve[]: 0 0 0 0 [ 311.901807] Node 1 Normal free:3785696kB min:53420kB low:66772kB high:80124kB active_anon:0kB inactive_anon:0kB active_file:144kB inactive_file:0kB unevictable:0kB writepending:0kB present:3932160kB managed:3870208kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 311.936916] devpts: called with bogus options [ 311.963821] binder: 14475:14479 unknown command 64 23:01:54 executing program 3: socket(0x11, 0x0, 0x0) dup(0xffffffffffffffff) syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x1, 0x2) ioctl$VIDIOC_LOG_STATUS(0xffffffffffffffff, 0x5646, 0x0) syz_open_dev$radio(0x0, 0x0, 0x2) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00') r0 = gettid() tkill(r0, 0x3c) chdir(0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) msync(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x94331c6b254b5f04) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x20000, 0x0) ioctl$VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f00000002c0)={0x2, @sdr={0x0, 0xfffffffb}}) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r7, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000040)='vegas\x00', 0x6) ioctl$FS_IOC_GETFSMAP(r7, 0xc0c0583b, &(0x7f00000002c0)=ANY=[]) sendto$inet(r7, &(0x7f00000012c0)=' ', 0x64c8, 0x3, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYRESOCT=r4, @ANYRES32, @ANYRES32=0x0, @ANYPTR64, @ANYRES32], 0x5}, 0x1, 0x0, 0x0, 0x40}, 0x1) [ 311.990234] binder: 14475:14479 ioctl c0306201 20000600 returned -22 23:01:55 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f0000000280)=""/150, &(0x7f0000000340)=0x96) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) clock_gettime(0x0, &(0x7f0000003100)={0x0, 0x0}) recvmmsg(r2, &(0x7f0000002f80)=[{{&(0x7f00000004c0)=@ipx, 0x80, &(0x7f0000001bc0)=[{&(0x7f0000000540)=""/5, 0x5}, {&(0x7f0000001640)=""/131, 0x83}, {&(0x7f0000001700)=""/220, 0xdc}, {&(0x7f0000000580)=""/118, 0x76}, {&(0x7f0000001800)=""/135, 0x87}, {&(0x7f00000018c0)=""/56, 0x38}, {&(0x7f0000001900)=""/244, 0xf4}, {&(0x7f0000001a00)=""/191, 0xbf}, {&(0x7f0000001ac0)=""/219, 0xdb}], 0x9}, 0x40}, {{&(0x7f0000001c80)=@l2, 0x80, &(0x7f0000001e40)=[{&(0x7f0000001d00)=""/230, 0xe6}, {&(0x7f0000001e00)=""/44, 0x2c}], 0x2, &(0x7f0000001e80)=""/3, 0x3}, 0x3}, {{0x0, 0x0, &(0x7f0000002140)=[{&(0x7f0000001ec0)=""/207, 0xcf}, {&(0x7f0000001fc0)=""/35, 0x23}, {&(0x7f0000002000)=""/151, 0x97}, {&(0x7f00000020c0)=""/60, 0x3c}, {&(0x7f0000002100)}], 0x5}, 0x7fff}, {{&(0x7f00000021c0)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f0000002400)=[{&(0x7f0000002240)=""/200, 0xc8}, {&(0x7f0000002340)=""/156, 0x9c}], 0x2, &(0x7f0000002440)=""/63, 0x3f}, 0x9}, {{&(0x7f0000002480)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x80, &(0x7f00000027c0)=[{&(0x7f0000002500)=""/133, 0x85}, {&(0x7f00000025c0)=""/198, 0xc6}, {&(0x7f00000026c0)=""/242, 0xf2}], 0x3, &(0x7f0000002800)=""/125, 0x7d}, 0x3}, {{&(0x7f0000002880)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000002e40)=[{&(0x7f0000002900)=""/80, 0x50}, {&(0x7f0000002980)=""/114, 0x72}, {&(0x7f0000002a00)=""/251, 0xfb}, {&(0x7f0000002b00)=""/3, 0x3}, {&(0x7f0000002b40)=""/37, 0x25}, {&(0x7f0000002b80)=""/240, 0xf0}, {&(0x7f0000002c80)=""/160, 0xa0}, {&(0x7f0000002d40)=""/207, 0xcf}], 0x8, &(0x7f0000002ec0)=""/188, 0xbc}, 0x29}], 0x6, 0x14041, &(0x7f0000003140)={r3, r4+30000000}) 23:01:55 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x200000000d8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0) close(0xffffffffffffffff) r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, &(0x7f0000000100)=@ethernet, &(0x7f0000000180)=0x80) socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r2 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) r3 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f0000000480)={0x2a36, 0x4000f75, 0x6, 0x0, 0x0, [], [], [], 0x7caa, 0x6}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, 0x0) setsockopt(r2, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r2, &(0x7f0000e5c000)={0x2, 0x4e20, @loopback}, 0x10) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) process_vm_writev(0x0, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/185, 0xb9}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) socket$kcm(0x10, 0x2, 0x10) ioctl$KVM_S390_UCAS_UNMAP(r3, 0x4018ae51, &(0x7f0000000040)={0x20}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) r4 = accept(r1, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b90200000005000000000000008e6763f270e14ff2c25ccc9ac85c0180000063c94d6b7227311eeb74413291bbeeea5c234d4807389013f7450d0000b5000000001b11d749a5a6dd04f317fa56e40d5618474aa1c59e84e2699ff1885b0361196f61b510f0d3a3fb8070da9e6bf4c50723e3b5976f29057246bab492e03cca508019156ce4c3d8ffbc02da4b1e71c0519276e8bb3b1b58e32e368e19174c18ab140f6f34809d98cc0bb793ca1c24290b465dbdd287010006000000000010a1a88dd3b66caad3901294ee361a8db74515ff628d31380b3edfb0f23410d40284209db8341921e58fd1ea1a8500b89382c68cf36b67166c359a16152076d13f9cd67fbdf6c26538776e0fd7379d062c6f615c79e63834479a9346a1b2c4c54c29ba1b65924f964796e5152ca8e6b89ba490cf685535de3f9a51e172735cd552afce7a0e374ef3ea141cff0fc1b2b1e8bd8f5aa7c7ac962506f0db93056df402edb2f5400c5f11555be14277b3297bf4889bcea72b74f71f40236f3640a6212c17fe360d4fd68f9ab750ca6912ece506f510fea93d1106c04c6f35cc732b05573b96d082b92ff22cc2a2e4e585013644ab2b5f976a12922bc54e9376bb7cbd7ba829d23f9f3df2d9e32914f909f62824bbe891d028ef5c47e0b88f56a996c80b7d08425249fc7e63dc12ca768aa4fe2973806c0c0a7ead0d6d61ff2540691db06322fe0d3b943ee422ea2e250774bd9fe352e066e4c4c93163005bcccf975deaef5dec1c0ef680f42c5e6d95ad0f1130e08f1cd5c8720fabcabbd1d1e711542d74c74711b648eb007498ee289fedbad3c151edeb2f7d1384c021ce57d4a9817ea20d613cc7e0514e3a53507ed125f01a024deb15e50f06e15b0035209b07beded0a4b19e0e6eb147a23022bc24562d4303f22422bfbf767bb1b7f0edb350bbd82bc1f5a85484faf70b3614656508227c8cab57d3e59ce5529832981be9270096c2659e10308f7d7bf83bc9f6d6f4be2056a8f79caaae060e74a33d15042e6898073788d7c155ee2f1fbf196f8416e04251080238df7ea59246582113b6df0cd1b38f23066003e5d00a517165a0c0ce18e1d40c099e90a8b06352664a3bd30ff7d8a0eb85f88f9254c9082788b2502cc11c3b21a2cb78fb05f6bd29aa27cff0eed2bf3c31a7196d843a9e40d65c8fde2c3b23"], 0x1}}, 0x0) sendmmsg(r2, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) gettid() [ 312.030491] dccp_close: ABORT with 1061 bytes unread 23:01:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x200000000d8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0) close(0xffffffffffffffff) r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, &(0x7f0000000100)=@ethernet, &(0x7f0000000180)=0x80) socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r2 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) r3 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f0000000480)={0x2a36, 0x4000f75, 0x6, 0x0, 0x0, [], [], [], 0x7caa, 0x6}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, 0x0) setsockopt(r2, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r2, &(0x7f0000e5c000)={0x2, 0x4e20, @loopback}, 0x10) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) process_vm_writev(0x0, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/185, 0xb9}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) socket$kcm(0x10, 0x2, 0x10) ioctl$KVM_S390_UCAS_UNMAP(r3, 0x4018ae51, &(0x7f0000000040)={0x20}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) r4 = accept(r1, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b90200000005000000000000008e6763f270e14ff2c25ccc9ac85c0180000063c94d6b7227311eeb74413291bbeeea5c234d4807389013f7450d0000b5000000001b11d749a5a6dd04f317fa56e40d5618474aa1c59e84e2699ff1885b0361196f61b510f0d3a3fb8070da9e6bf4c50723e3b5976f29057246bab492e03cca508019156ce4c3d8ffbc02da4b1e71c0519276e8bb3b1b58e32e368e19174c18ab140f6f34809d98cc0bb793ca1c24290b465dbdd287010006000000000010a1a88dd3b66caad3901294ee361a8db74515ff628d31380b3edfb0f23410d40284209db8341921e58fd1ea1a8500b89382c68cf36b67166c359a16152076d13f9cd67fbdf6c26538776e0fd7379d062c6f615c79e63834479a9346a1b2c4c54c29ba1b65924f964796e5152ca8e6b89ba490cf685535de3f9a51e172735cd552afce7a0e374ef3ea141cff0fc1b2b1e8bd8f5aa7c7ac962506f0db93056df402edb2f5400c5f11555be14277b3297bf4889bcea72b74f71f40236f3640a6212c17fe360d4fd68f9ab750ca6912ece506f510fea93d1106c04c6f35cc732b05573b96d082b92ff22cc2a2e4e585013644ab2b5f976a12922bc54e9376bb7cbd7ba829d23f9f3df2d9e32914f909f62824bbe891d028ef5c47e0b88f56a996c80b7d08425249fc7e63dc12ca768aa4fe2973806c0c0a7ead0d6d61ff2540691db06322fe0d3b943ee422ea2e250774bd9fe352e066e4c4c93163005bcccf975deaef5dec1c0ef680f42c5e6d95ad0f1130e08f1cd5c8720fabcabbd1d1e711542d74c74711b648eb007498ee289fedbad3c151edeb2f7d1384c021ce57d4a9817ea20d613cc7e0514e3a53507ed125f01a024deb15e50f06e15b0035209b07beded0a4b19e0e6eb147a23022bc24562d4303f22422bfbf767bb1b7f0edb350bbd82bc1f5a85484faf70b3614656508227c8cab57d3e59ce5529832981be9270096c2659e10308f7d7bf83bc9f6d6f4be2056a8f79caaae060e74a33d15042e6898073788d7c155ee2f1fbf196f8416e04251080238df7ea59246582113b6df0cd1b38f23066003e5d00a517165a0c0ce18e1d40c099e90a8b06352664a3bd30ff7d8a0eb85f88f9254c9082788b2502cc11c3b21a2cb78fb05f6bd29aa27cff0eed2bf3c31a7196d843a9e40d65c8fde2c3b23"], 0x1}}, 0x0) sendmmsg(r2, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) gettid() [ 312.101733] lowmem_reserve[]: 0 0 0 0 [ 312.115342] binder: 14490:14492 unknown command 64 [ 312.116752] devpts: called with bogus options [ 312.127134] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB 23:01:55 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x88001) sendfile(r0, r1, 0x0, 0x800000000024) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e24, 0x200, @dev={0xfe, 0x80, [], 0xf}, 0x2}}, [0x7f, 0xffff, 0x4, 0x2, 0x7, 0x3, 0x9, 0x9, 0x7, 0x7f, 0x0, 0x3f, 0x0, 0x3, 0xffffffff]}, &(0x7f00000000c0)=0x100) r2 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="850000002f00400057000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) openat$md(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0\x00', 0x80000, 0x0) [ 312.163679] binder: 14490:14492 ioctl c0306201 20000600 returned -22 [ 312.223154] Node 0 DMA32: 1727*4kB (UME) 98*8kB (UME) 200*16kB (UME) 50*32kB (UME) 10*64kB (UME) 15*128kB (UME) 10*256kB (UME) 6*512kB (M) 1*1024kB (U) 8*2048kB (UME) 187*4096kB (M) = 804044kB 23:01:55 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 312.484484] binder: 14503:14507 unknown command 64 [ 312.558782] binder: 14503:14507 ioctl c0306201 20000600 returned -22 [ 312.568856] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 312.582826] dccp_close: ABORT with 1 bytes unread 23:01:55 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 312.599923] Node 1 Normal: 50*4kB (UM) 337*8kB (UE) 257*16kB (UME) 54*32kB (UM) 19*64kB (UM) 12*128kB (U) 7*256kB (UME) 2*512kB (UE) 3*1024kB (UME) 4*2048kB (ME) 918*4096kB (M) = 3785696kB 23:01:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x200000000d8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0) close(0xffffffffffffffff) r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, &(0x7f0000000100)=@ethernet, &(0x7f0000000180)=0x80) socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r2 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) r3 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f0000000480)={0x2a36, 0x4000f75, 0x6, 0x0, 0x0, [], [], [], 0x7caa, 0x6}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, 0x0) setsockopt(r2, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r2, &(0x7f0000e5c000)={0x2, 0x4e20, @loopback}, 0x10) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) process_vm_writev(0x0, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/185, 0xb9}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) socket$kcm(0x10, 0x2, 0x10) ioctl$KVM_S390_UCAS_UNMAP(r3, 0x4018ae51, &(0x7f0000000040)={0x20}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) r4 = accept(r1, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b90200000005000000000000008e6763f270e14ff2c25ccc9ac85c0180000063c94d6b7227311eeb74413291bbeeea5c234d4807389013f7450d0000b5000000001b11d749a5a6dd04f317fa56e40d5618474aa1c59e84e2699ff1885b0361196f61b510f0d3a3fb8070da9e6bf4c50723e3b5976f29057246bab492e03cca508019156ce4c3d8ffbc02da4b1e71c0519276e8bb3b1b58e32e368e19174c18ab140f6f34809d98cc0bb793ca1c24290b465dbdd287010006000000000010a1a88dd3b66caad3901294ee361a8db74515ff628d31380b3edfb0f23410d40284209db8341921e58fd1ea1a8500b89382c68cf36b67166c359a16152076d13f9cd67fbdf6c26538776e0fd7379d062c6f615c79e63834479a9346a1b2c4c54c29ba1b65924f964796e5152ca8e6b89ba490cf685535de3f9a51e172735cd552afce7a0e374ef3ea141cff0fc1b2b1e8bd8f5aa7c7ac962506f0db93056df402edb2f5400c5f11555be14277b3297bf4889bcea72b74f71f40236f3640a6212c17fe360d4fd68f9ab750ca6912ece506f510fea93d1106c04c6f35cc732b05573b96d082b92ff22cc2a2e4e585013644ab2b5f976a12922bc54e9376bb7cbd7ba829d23f9f3df2d9e32914f909f62824bbe891d028ef5c47e0b88f56a996c80b7d08425249fc7e63dc12ca768aa4fe2973806c0c0a7ead0d6d61ff2540691db06322fe0d3b943ee422ea2e250774bd9fe352e066e4c4c93163005bcccf975deaef5dec1c0ef680f42c5e6d95ad0f1130e08f1cd5c8720fabcabbd1d1e711542d74c74711b648eb007498ee289fedbad3c151edeb2f7d1384c021ce57d4a9817ea20d613cc7e0514e3a53507ed125f01a024deb15e50f06e15b0035209b07beded0a4b19e0e6eb147a23022bc24562d4303f22422bfbf767bb1b7f0edb350bbd82bc1f5a85484faf70b3614656508227c8cab57d3e59ce5529832981be9270096c2659e10308f7d7bf83bc9f6d6f4be2056a8f79caaae060e74a33d15042e6898073788d7c155ee2f1fbf196f8416e04251080238df7ea59246582113b6df0cd1b38f23066003e5d00a517165a0c0ce18e1d40c099e90a8b06352664a3bd30ff7d8a0eb85f88f9254c9082788b2502cc11c3b21a2cb78fb05f6bd29aa27cff0eed2bf3c31a7196d843a9e40d65c8fde2c3b23"], 0x1}}, 0x0) sendmmsg(r2, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) gettid() [ 312.827556] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 312.912054] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB 23:01:55 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b4050000000000006110180000000000cd0500fba609ad655f8b0c8b0172f24b501e00000000009500000000000000"], &(0x7f0000003ff6)='G\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 23:01:56 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='\x043\xbev/binde1\x0e\x00', 0x0, 0xbee1860313d632d5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000025c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000002f40)=0x3, 0x4) ioctl$SG_SET_FORCE_PACK_ID(r2, 0x227b, &(0x7f00000000c0)=0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000000)={0x2}, 0x10}, 0x70) r4 = socket$bt_hidp(0x1f, 0x3, 0x6) r5 = socket$inet6(0xa, 0x2, 0x5) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r6, r7, 0x0, 0x800000000024) ioctl$KVM_SET_IRQCHIP(r7, 0x8208ae63, &(0x7f0000002f80)={0x0, 0x0, @pic={0x15, 0x5, 0x79, 0x80, 0x0, 0x9, 0x4, 0x68, 0x0, 0x4, 0x0, 0x2, 0x8, 0xad, 0x1, 0x7f}}) close(r5) r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000040)={r9, @in6={{0xa, 0x4e22, 0x0, @loopback, 0x46cd}}, 0xe00, 0x0, 0x0, 0x4, 0x100000000}, &(0x7f0000000100)=0x98) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000002c0)={r9, 0x3d9e, 0x5}, &(0x7f0000002540)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r7, 0x84, 0x19, &(0x7f0000002580)={r10, 0x170}, 0x8) ftruncate(r8, 0x88001) sendfile(r5, r8, 0x0, 0x800000000024) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000200)={'vcan0\x00', 0x0}) accept$packet(r2, &(0x7f0000002600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002640)=0x14) sendmmsg$sock(r4, &(0x7f0000002cc0)=[{{&(0x7f0000000240)=@ll={0x11, 0x7, r11, 0x1, 0x3f, 0x6, @broadcast}, 0x80, &(0x7f00000002c0)}}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000300)="9d66ec5d620d3fa033965442b3f1751ab842d5bb5a97d159b595cb2ad1dad72cd5f2ff7d3a827749c38ada7cbf5c51643bff01074861c864f97095e46f45d66bd7f26c723c5fc98542c9f30992b031fd998d3a15665f5be6e6c88ee45c456dc861d56a620f0ebb80a171fae5790acdc87dd45465e90d991a7303c267369dcb8127f5d31a07e4d4a70fa416c6be7c05", 0x8f}, {&(0x7f00000003c0)="7b70adc4b8bc8920e406dda94464719745002d9d7fc834d962c20df685f466b8e31bc899530f43a9b0badb726f02f94c5ecf6d35e0e033a87e7851f73294f99ff22d33ec3a66ce47e62a996d610fdb7cc5669fea6b766b5f6f4b2b4ad4f21d4ae545e37bc3fefd4ab77b955ef2d695dfb58a30acec325b775dfb414e4225dec88cf119a0942900593a334eef13459b9af39ac316e865f00d8f0f380490f97d53ce30490cbbf3cf24a58dbfd117eed349d3b42cc1cd5883c13d487fa2e6433115ffe4c51e58b290d52516b8", 0xcb}, {&(0x7f00000004c0)="18f6da6acfa8fc92c422799972b1410e96a3e45b08e016ba51d7e3ecf9ddf035c11bd894a490921c236e12a120", 0x2d}, {&(0x7f0000000500)="2f4b56071ddb755006c1d5afcabfca96b122c0042df6df1336ca84849964b8d5eb78f9bafda79196206d55663e9f98558f46662dd2945fe445d6c2d2522ad76712829ef2bdd5a6dff462e7f3b209c4414c43fd8516471430fa3bc47b49bb250beddf3bc8c666c53bba", 0x69}, {&(0x7f0000000640)="9fb29e7bc4453c8adfc3bd50f235bf430fbf703116765b810de2e4af47cbeb5798fa2b08c79e6d5cfbaa6ed65ce6d4bdff0957c1049be9d64580e6abf4bf9f51cf1c1a35616686ac1f99062276e6ba417e63accd40250c0164bebfc75975ea614b4a3283a91d7261f204be8b49e518d8082eb96a70eeb13502a102b128904d4b7449de170195211ede7f2ada442c54a2494b422b35c32321f66cf58b8cb85282e7f7bd425c9cbe9366e761b819facb6860fbbd6424ec38266389ddc5dcc5aee0c9072d1aaa56da08c8b92832081b53cf700b681629e4ac503b6bafd3e8073ef9701dacfe5de59da6d6917db5830a29a570b737010cc7b3aa4ace049d51df42a2248e2096a332df6865462ef9151ca37ab824a60533a860042432d201faa2f09ab67fc16a7d7446c8b6eec31858c6433c4fcb8e25a8b9cba14835113c1e43106e2b6119323eca0288c0b0f6520b640bca9ca40f387f46ab6928e298036c2d614f9f703a42adf5b03cad51f01a3fb6702caf8e6f104c350f8c02862ebfe4831866c81b7355056388744bea06f2beb7a0854f04435b6bcfc66a2a9a72f9feeab913746139157408774fe3c3c4794cca01d224cd3aef585b8083b1bf99f18e3f1084071129d55aff5608cf601ca2e8555e21920b15c3bd8fb1e2e9de737a0aeb084dac60412a32027850e0cd87d242faa95f4bdb87db4ab4edba824ce2847759baf3643a4ee824cdcce1a029e13a68d564db07dd630b0e9cecdc10f6dd4f676b82e11a517a354c9ad63298841618d7bc7542c58de6d4ec1c66039d5dcdb77b3fbaf646130cdb68a53fe1e85d660c78e2bf5a29506c06117a92c8ef86ecb1327925ab7d3b20d37dbbd18a2de6338a392c71710f10a150b90876bd1e920038e62b0e0926db9736aeb9910a36705d8aa5b941177020dd78f1ee3acef43296fbb25d096fa26a3aa4c1f27ce50331bce8e0b82b3777202f7a3b8009dc0ea28b1eee372c4d1c5750e30dcbbd7387704ae3d6a61818b2c07c99c40c3459a9d111453235a0d36a70221659dfad906113b8b8a65f8e5198ee8b76ed56246ebdd659148b947c9056091de377084753a1e304fc7e42c11aef219f72d45df3306a7eefbdff17b62de234f80d61e8a5b5953829e56abb3af3ec8267a419f8eb119e4757fe1f16b5e55f728c44ba89c23d951a1250c2a4e52aad7e1519a31b508aafedfab7ecba85e3e84ae61039f1e3f80f1d8002ced5f4ddd02441547cdec0f6bc00e72d2d29c727f1d17a1fc4ffd02dace1ab58fe2a685dd4b5003ff0795bda4048ad7bceb6276c7889531b42f377fa7feb84a15fbe28a614b1a2baea6d5ba4c89b3529164108cba8b163dc6febbdb72dfebdcad45f63dcdb8c679d181c57bffab6302f66ef0de034261681fd4c807f43b0c4d0fcd3bbf0d8adcc8ee62049d82bd30db7a25f7202b2d204007e65a50732824fa5de8c67a15d90f8763ff88bf8133bd4933b8fc6c82c18f7f9712b65c2908720d8135e384938f8f7b59d13ca8e9309b234d17208e7532dac99a79248ccdf251a99f9c97501c0e74dd6f8a744448a789f89aa7c984965fc6639e66ffdf1b49128638d50958cc14b56f4ac26cef3eeec6ce76d51b60e2e4a598dee5211597ad318bfeaa36b8cb4d8a5663b2b036e8a79992698b820ae71e19068e5305b4337a655255e8d1051bce5906595d5bc66816b9cb61a8569a6e134842076bcf8898bfb266e5587b318db49011ce4e6a9db492e36a4f5e26889b772c31556aa278e305740d5e8a8067d01119e076f371b75b2d9ab762d06425d5a12528d8062064d0ae7bced70ce97e923e14c3f818841b4aabea03edd0bd984f8ae730641fd6b13695d1eab3954a87989a8b2bb06a5840e94a2cc530eb432a3b95b0f51954aa42ba24cc159935fc3a0d5dfa39aefcb0106a2383aa52e7659cb0adecbc5de3ffbe6288f741dcc6b97876b046f3a96da9f676fa34e277a447e78c0b959b8dc52db642c18d1d6a2a844a39196ef7385d964afa1d2d138d59f89cbff401c5ff0fe6999899dca5bcb7de3ce2c86fb338435ba0b31325e41e0e371f99ba3f5c95678cdcb84016e6a8c0f6239ca228801ff36b2b589722954971cafa4e95569c61cb51455bdf58735ce5e403d3eb7b2b38fb18468d6ded20f8c0f147f07542de1fae7329a60367a0b3556ad560efccc3dfbdb07cee83f11d32f7999409b86bebb2b3e406fb26788749d40e7b410604b8c2398bd66c9998d859a4735dc9f9f29b0088625c7bf5872c926c9a40a5186e9f571de23cfffb00364b806627672dadf22ff95d23488f1de19329617b75b03540abe69380e21fd22b0ac9234c4a063fee065fc9d30ef907c6186b38db771b86ff6cca7e16f6ddf4da248ab8f97d13e309606cea543d5bb6ccb014aa14ab34d1614073543f312282774d863c749ca93bfe1a281266e9c5996ec9275703245f297a2ef246cbcb7f0e9dbbb431d918424af7754108f2d88a23113f703a9637c8ebca5f220249ecf561b1fedef0cb11ecf2097e3ebf5bc0e2c04319c9d61d16497b9c3b6b64db306fded95909efc8e8b931d42f9f36592ca0fad675be29174899da3a3a2d4198a9ee90c7e5706c99e27d376a2364b26edbd0a6f752da1c536ee3ea799e723fcd7a06acfa0cf6927fe1ca3146957772b2db7bc9d733250f08658bf1960aa41497cf2282fbb240c1a1066cf0a96082a7ca26c3fa95b05540bbd6c531e0486e90b31d2bbe48a16b95647128009044170d283bb2f38e1010c4b657674d81f6108d4487b10619b415b16ac287e12f554021b6b828745f3df70eb334d39ce56bc42e99612eb81103110ee30eb9faa74f4ca8899d488c78c8300e6af2773973551b8c030ff5ada07b380cfa8a498eeaca35bb9ad3c99b2e69dd1be39371902a4cd9ef626ef6d6de4140d96fd745a610f3b8481d2b574687aa4f2d8c6b113941c79aca8ef04f36345830a867ac9f363bf58b62ad77f251edadc98440856d9870654bbb3fdcc9019fb854121cc8a1b20a1801abe5d0e1b7504f67cc035fbe9e00f455e45146cc890cdedcb908b0c167b449eebb0fce47b9dcdfb0bc02b71b25b2d2ec590463bf9c443a23a31ab5d9603268babb1ca8a45840b54bac3a8cefc767ae2653fd234be93f1e76482be3f5697d8b5333c5c3959299331591372b07d88d15e8d113c69a437f28613348c964c1a34525973d8268f4d07c4bec75fe85a95771bd539f678222b0f371397b7ed570a9e03f7fb96ec6c25dc5254ca82f5bbadf5e2e64fcbd5630d8b4a641a89cdf7fba526f40d93808559005a843fdcef0cfc5034a84038c29e5024bdc2845dea618be92d08d9319136065a492d6e0209869856df7d55fa2d9a450ccae94962d776716bf14a78c229d0c1b698e713866443ded758cecec45afcb105a3f30b4bc9182bda03abf00f231a2febaf7e401a28afb91d19b8754ee5f0f9f5d4c5aae8fee754927855b34e50ab6ef1e567701fea042feb4a878352345ae554747bb8df4ce266cdf10e92f78ed232c642d7eada7d58b64219ffb02e8469154e9f4b697941ba1390fbdb2f7d7c12003c4792d1a1dfb451a11e5d8a46930b1963c01b06dae0f25ed7e7ee58f425b1032d1c83780e2cc6776ba7d73f77a64e0766376801f30008b002f8fd52d2531b57edfb359768c39b4eb7e8108a207e01968b1048b52a7b9a80f01abc4115c1892bd424a472acd18296dca1ee39d98b6c3ebadb18d6139bf8333bb1982a9193e080e2dd8823807cda1b3e09e871672f97b5d6c32fe487e0c5531a5bd9a08339c37656f87bbabd5f5e35a487ac9af5038660b3f636f9090d8c6f12d3448ff47403cbd68d18cd00c186eea94d2c537fde69a7f4330734fa3a0aa6b00608e4926eaa5fdcd135b1b4c82cf2ab2c3722ffc01e9f1f92d263f7f1f99d552dc9fc94aa223710596076db2c9de842568c216b764056a377783e2f37e2dbdc4dcf28158b18166e1d84c3d4d6566c403c27c08cb3b9a3ea919e41b764c39e2d9fe33479d1d0e238bf4bdab17189da0f8f0939bb778a0dde0130c12eb4ddcfa0115be8b1afcc095a49d8a89e8511119bc554b3ba37ed9962e7bc5c6004db219ad49d842645b148900fa59bcccf48ed15220164fff5a16cca47f711f078787f4133177cf1ed89970f5b030cd393dc1587c29b1263228ae734197dd9a41eeb4762ad60dd2b2c0ae1a9e065390390a5e24e8f293ebd8eb91095bfd67ba57632f1dff4c5ee7c4fa01f40db468d993e18e1fe7ed4cd3f8f20b002cfdc817bccf407f5571d47451aef0a4e9ed2ed8ca7aa16b70da218e184a3170cd5034975c3812f619809da7117e5323b0be797283367cd2564d0225d6f706c8be9d6640fb73c245e4ecf1f4e5ee680e5c27b79bf101b06b72d4f12b9e3e61e818429c51c6c841ad5ebbf87b5cd77c75570d3d1a0e2057eeefe9ba17cbcc92fca7550b28890e3e8f9891e49d86b3a1ab5e55fca88267c47c87213142b744c1780f810989bd57f4be61275d3b71b4d8e6800df60d48cc6306852bd37fbf28414a857112e876e14cd304404b1d4ec4d5e0bd88b29aa27b5c7e851e73a69986bc4bcc1b778d4fbc3e194e7b9bad29d0f9ced1de357f8809171fbc8652d1e140477e36fbfce6d5e91323dd81f5807020576a97e8999e1d902998ea2f1134acc7aa3008598dcfb1816bdeafb9d968ce54f7aa425a3040afcb12a7c8deb88b9dbbed9664340e2d132da17d32e48639007ce4c3dc09b8a2d3ca9e8509571cedf6dfe0612b825726ab8ad70338129e3bcdb1af778e2fa05f1b954c770610d2bfdf6231b3fcdae020983bde2cbbd27b12d95d3374d4e392589defd2424214aabfd920f25ab5427162f4cc5aae6aca68de5fb5685d7cbd3c20924af8fdaf04c304a42292b9098c20d15b25c6741c43b6fe6c7fbde5e8100afb3987fb09285f7bee8c186b045c834eb2e86484f9c85d50d7f1ae0fbd3615c83471de9d804954cb9b07309dae3e52ed4d07000d3a41244561ba7ac14d3e67c93624a7418f5d9eb827b91ea3a9026572eb8cc216546ef7f1d4054ad238466be9b6ca0fa644d133a5a2446f5e5397ba0497a3ded911e427b68d85afbfeb5add0d920ea14d896a8fc88f2b0b8d01b1a41165721449e3f6eddb6e8ce774da5e4a6b21915cf657ed59a0b6860f227cc7c2b70c872e8b55f793c7f42e3285f272664d7367151e3469ce084209d015e2023b248ddc6025b73f340990ae412f4e827cee6274a527dd736be6070cc1ad8090190ef2e8e3f847b9a7702fec20a7e9c636a63f01a304a66dc66b72baff6c554af3488409781793ab0ced02a23db3c95a492bd12aacd11c1af9a0082cc3260f4e3faf858c768cfea796804d5fe0271dac345036096a06826624a3f499fbc546ce41503017717a55cf98abf6fc9eff5121c5002556d9409b62e2ae9b5ab1869e53bdf93962f828f4b07cd0cf833e2e3021dd398c90cafe95984709a7cddd1de6e757b3e38b11c51b1b601038af827614fa5b422ef5abbd24031812782637278d23dc0a1ca2fd3b9601c6c27f1b8da974c7080366c799c65434b01f55a00bd8fa26708360a108925128f00708cefea3f1ebcaedf8486af53f1e4c21f0608ea24ad0e9a389fd4bb86fe011a7b3b8ac392bb040681a88256afe688c575f822dd494b4b6573e6aefdfc088d8d934cfee743148ed5bd673dbba69a845ccc6239488791bdbbc10ad754b3bd683c80fcd8510a2cc8a5041d075743bf36aab346fe29920a9cd15ab5", 0x1000}, {&(0x7f0000001640)="2c61d13107457e1ad66c94c89c8127aa2a53b77281f57935bd47087e889ebd308f8c3caa0496a6eccb42bf26b17f07862497c17e80020ec6c831f1a309c9e054fb9edb8b4129f1a5c5ea08de88acca122b9c387c957432b888a7d36cee11bf02c2c04ec27c3086f6df91d82d42c59420cc9b76916de79d1412ecbafb745a0abba8bfb4da4f55ff723c734028201ee81fcd0e17f22144bf065960d20601c825efc1ce9babed7e55900953c0b44e6e393a5c980d82db2eb1900ee774cef49138b6282207085821820470b0229ce437924499e811ae314e5d0867c6d6b2846a992e9a", 0xe1}], 0x6, &(0x7f0000001740)=[@txtime={{0x18, 0x1, 0x3d, 0x2}}, @mark={{0x14, 0x1, 0x24, 0x200}}, @timestamping={{0x14, 0x1, 0x25, 0x9}}, @mark={{0x14, 0x1, 0x24, 0x82e}}, @txtime={{0x18, 0x1, 0x3d, 0xbed}}, @txtime={{0x18, 0x1, 0x3d, 0x200}}], 0x90}}, {{&(0x7f0000001800)=@x25={0x9, @remote={[], 0x1}}, 0x80, &(0x7f0000001980)=[{&(0x7f0000001880)="0af5d5601dfa615bf823e1965c320fd950051a2955af7fe02a8dbe7637f79bcfc63a17ee194ef2ff8d9b967c8374e88a0d34523aa93207b746de242bfd7d5d8adaed0a55a051260bb55ca745856a45d4d8a928d9831b7530edaa046d94996c32be246e5cc454e02799a76fc550caa031e58583082443643f185930b721346de7b7b178da3d709ad6cf12a2eb49a60fab0d83c260bc9b662043f61e0e60f728cdcaf48ae421279a56c8c0fe3bb6c5fe008f1ee14890f67c022918610915b0246c79e62cac6d5da4d39959", 0xca}], 0x1}}, {{&(0x7f00000019c0)=@ipx={0x4, 0x2, 0x0, "6f9a9adb3f4a", 0x2}, 0x80, &(0x7f0000001cc0)=[{&(0x7f0000001a40)="04370fa96c5e123f6057ea0b735aa3ac31cb529bc9115ce8e66f72e210f14c2666fcc8401f619fc85c121bc394e6b7c4861adfe4c3cc95120ff27e096ce71daa8997c841236375ca571f465d0e29a940e295a6157e855b68ea0f388b5e688877e56aa91854ca1fa38a8b7c4a7b7ac328dd9dbfba288ddc5731c796b3aa026c97af9a148065aef1e5d5ee644a7977e8182871d31792d123898f4ce9783f031aa49a59a8c6fa57f0963a25a44f9b360e4ca8171d012eb67f7972d31fbe5e276f05724e9556d6b9a5f736507841f335cc592de5d9cad8ebba8b923c534c9e3bb60367b70888ec97aca2064b958d2bb3eb8c7ae25d21e6dc96", 0xf7}, {&(0x7f0000001b40)="5d227f59ae08e7a2c42aa32efffee6b2f1013fec3b87d232e99fb854d3e133f18fa03396", 0x24}, {&(0x7f0000001b80)='SMW\fy', 0x5}, {&(0x7f0000001bc0)="1d02b77cf802fa57b459d0a8e638514cc7ac4a5d6e031d75fb4810942270781e6c46abf3e8b0caf6a049224de01a495eb4ac183a456152b634126c0cf3841dddd0179c49f1818658e3757de25ebff403a786dea5749ea5be3acfce947992f68186761693d58f2b0de691af502be808d3ef3c564a07137f94abe5bba1a00676c3387ff02f85e23fcf98d70650d445fbebdb76cb5b5192b6912d8163d5075fa753f5ee95ef4bd1737207e8018894dd1454fba558688ddd3b1e7eaf79fcbe703e93b77fb78bb694e7bb88ec7570a4", 0xcd}], 0x4, &(0x7f0000001d00)=[@mark={{0x14, 0x1, 0x24, 0x7}}, @mark={{0x14, 0x1, 0x24, 0x7}}], 0x30}}, {{&(0x7f0000001d40)=@l2={0x1f, 0xaf, {0x4, 0x6, 0x5, 0xf3, 0x81, 0x1}, 0x6}, 0x80, &(0x7f0000001e80)=[{&(0x7f0000001dc0)="6060a43b7ba68a1551a0987342d595bd8d938a8084375dba67278c1095234fdebab42fe6509ad9f7dfb502064ab581601f7ba148bf1f73ddf2931d09d0dc7e68db6a8d50b2278d9618e782202494de81271c071f6b1ac45c3924c09d1e939b298ba1e8ff90e3fdb07f19c2d628b512c6f64028194c4b7ff448f6143bc16440fc08f086fbc3", 0x85}], 0x1, &(0x7f0000001ec0)=[@mark={{0x14, 0x1, 0x24, 0x80}}], 0x18}}, {{&(0x7f0000001f00)=@generic={0x3, "6f5351e7aaf0b15f906feaa999975be3800e87874daf7a79b202b8461ed051a606adf195424b2047ff8b7c2fbebba65b2f41644fe6cd613a844a2194576572466da595c5b7234c6dd22c9b231feab2c8c11bab9d70a59e6659da5b49cdc22461d91f9b53d0d35bd305f17c1086475961157bbda3f00a702767ac39c8a659"}, 0x80, &(0x7f0000002080)=[{&(0x7f0000001f80)="9528b22cd935b8e7a304900cc24ec9513b39524edda16621e88f86147eb2e8eba6020a5541536c30e9f3b6d589f7e66b60dc55b260a8888f072f209091709cdcf1cc7b16d373e3b369c989c77aae2008adb3b60ba1a90e2fab83cbae7a76b90bf976952d1054f5d5328690e146fe2b27a7cd57c519e6c09d970dcfda3e54ab1ef6938a90647c770d46cb66e4c437a923207b2382a8e017e5003c6e2786f1679f36d87998834da13f0f9026e4d03bb192ad36e252960a380a6c5f449ee52ac8186aa0bb125c265fc1edefa8f828d89b27f89abe82f4c0c71b31136bbc263bc904ad260483b3ba557fb4b25ba0608058ce15508e449a", 0xf5}], 0x1}}, {{&(0x7f00000020c0)=@tipc=@name={0x1e, 0x2, 0x0, {{0x6a55c67536788a28, 0x1}, 0x22}}, 0x80, &(0x7f00000024c0)}}, {{&(0x7f0000002680)=@can={0x1d, r12}, 0x80, &(0x7f0000002880)=[{&(0x7f0000002700)="579d3a3cc0cf56a86bb6d3eb524d534f152f6266299f0b07af6ba75006cb2e3f3f130bf307e77578313bb5ad2583088bae5ce9ab97728717c3fda3a508ef7bffa5c4d64aad75111d808e551829dce40c6fc9d8694743a2faac89282744209521c32cabd86c66fad9cd979b7eb544b59f8a75f789b26385a178e17a0308cf37c97cefae0c617fd9a99f9d5d4d0305e20bf5a93543e92b20bac71a4100ddda6a1c0c5d9c2a471a6678e3f8bfb6717e8f5a09a707ff52eac9b21b0a4be3af56c2cceafec1466afea55703752c94c73a14b978ff9b4fce3b9b837c9f4cc6d00ae6bfa6b1f9dc8583d0b3bb4a0664015aaff312ee50a55a0c71fe0fe3", 0xfa}, {&(0x7f0000003080)="a998f9319e4750a1cba5de369034c986e517831e237530bfec93c07ca80d740a76420755f6ac92b57513992f723f413c95d5", 0x32}, {&(0x7f0000002840)="4aaea536503c40f06486541504102ff908b7cf6875dad78f699cd763c8e2846ee8081b52df21e3f9f3920b081ccf49f30647850c5b", 0x35}], 0x3, &(0x7f00000028c0)=[@txtime={{0x18, 0x1, 0x3d, 0xa70}}, @timestamping={{0x14}}, @mark={{0x14, 0x1, 0x24, 0x9}}, @timestamping={{0x14, 0x1, 0x25, 0x5}}, @timestamping={{0x14, 0x1, 0x25, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x71a}}, @txtime={{0x18, 0x1, 0x3d, 0x9}}], 0xa8}}, {{0x0, 0x0, &(0x7f0000002a40)=[{&(0x7f0000002980)="db37898a6c562ae777c99f61fe2530cdf3a787ae6a147908a71c58961801be5f4235fc075da5c7ef4ec2fe091f1c6a74c6192b9c2e64a05303e752d079a4e568e8552aab0217b5d9d9621fc50e143a69ad144fd7148168a29bbb715c48317014d354e9c6707b306bf23b8dbd3a852d1f66111b3a374c3d88b77d19614b65b610759769f2c8ae5251ed583bb0d29cc60636", 0x91}], 0x1}}, {{&(0x7f0000002a80)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'rmd160-generic\x00'}, 0x80, &(0x7f0000002c00)=[{&(0x7f0000002b00)="d9c98ee7d98c2063331337c6ba06048c73da6b85da0f29e352a42c36ef2639bca9c66acb1c25e8665d1f7fbfaaa9d871fa4ad7b7e545e05f5831ffac5a30e690130a6cc7cca970834ecfe457e3fbbbf5bee2e59b7b8cde091c1688c0f0e54401485bdff23ebf8716340cf0c3f6588bbe3885eae6f461666e79c6f3c0e111e304f8d1b9f51beca8438bd7a5b48089bf91f1cf56fbc0ea41bcfd303ce6d874618fc1944cefca21fbd4f7e190010f49d1aa234382c63658308d0e0c5e0f1c4c4ae6c9dc54aaaef22a41318d", 0xca}], 0x1, &(0x7f0000002c40)=[@txtime={{0x18, 0x1, 0x3d, 0x7}}, @txtime={{0x18, 0x1, 0x3d, 0xd40}}, @timestamping={{0x14}}, @txtime={{0x18, 0x1, 0x3d, 0x7}}], 0x60}}], 0xa, 0x7be110041248a379) 23:01:56 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 313.067781] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB 23:01:56 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x200000000d8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0) close(0xffffffffffffffff) r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, &(0x7f0000000100)=@ethernet, &(0x7f0000000180)=0x80) socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r2 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) r3 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f0000000480)={0x2a36, 0x4000f75, 0x6, 0x0, 0x0, [], [], [], 0x7caa, 0x6}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, 0x0) setsockopt(r2, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r2, &(0x7f0000e5c000)={0x2, 0x4e20, @loopback}, 0x10) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) process_vm_writev(0x0, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/185, 0xb9}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) socket$kcm(0x10, 0x2, 0x10) ioctl$KVM_S390_UCAS_UNMAP(r3, 0x4018ae51, &(0x7f0000000040)={0x20}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) r4 = accept(r1, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b90200000005000000000000008e6763f270e14ff2c25ccc9ac85c0180000063c94d6b7227311eeb74413291bbeeea5c234d4807389013f7450d0000b5000000001b11d749a5a6dd04f317fa56e40d5618474aa1c59e84e2699ff1885b0361196f61b510f0d3a3fb8070da9e6bf4c50723e3b5976f29057246bab492e03cca508019156ce4c3d8ffbc02da4b1e71c0519276e8bb3b1b58e32e368e19174c18ab140f6f34809d98cc0bb793ca1c24290b465dbdd287010006000000000010a1a88dd3b66caad3901294ee361a8db74515ff628d31380b3edfb0f23410d40284209db8341921e58fd1ea1a8500b89382c68cf36b67166c359a16152076d13f9cd67fbdf6c26538776e0fd7379d062c6f615c79e63834479a9346a1b2c4c54c29ba1b65924f964796e5152ca8e6b89ba490cf685535de3f9a51e172735cd552afce7a0e374ef3ea141cff0fc1b2b1e8bd8f5aa7c7ac962506f0db93056df402edb2f5400c5f11555be14277b3297bf4889bcea72b74f71f40236f3640a6212c17fe360d4fd68f9ab750ca6912ece506f510fea93d1106c04c6f35cc732b05573b96d082b92ff22cc2a2e4e585013644ab2b5f976a12922bc54e9376bb7cbd7ba829d23f9f3df2d9e32914f909f62824bbe891d028ef5c47e0b88f56a996c80b7d08425249fc7e63dc12ca768aa4fe2973806c0c0a7ead0d6d61ff2540691db06322fe0d3b943ee422ea2e250774bd9fe352e066e4c4c93163005bcccf975deaef5dec1c0ef680f42c5e6d95ad0f1130e08f1cd5c8720fabcabbd1d1e711542d74c74711b648eb007498ee289fedbad3c151edeb2f7d1384c021ce57d4a9817ea20d613cc7e0514e3a53507ed125f01a024deb15e50f06e15b0035209b07beded0a4b19e0e6eb147a23022bc24562d4303f22422bfbf767bb1b7f0edb350bbd82bc1f5a85484faf70b3614656508227c8cab57d3e59ce5529832981be9270096c2659e10308f7d7bf83bc9f6d6f4be2056a8f79caaae060e74a33d15042e6898073788d7c155ee2f1fbf196f8416e04251080238df7ea59246582113b6df0cd1b38f23066003e5d00a517165a0c0ce18e1d40c099e90a8b06352664a3bd30ff7d8a0eb85f88f9254c9082788b2502cc11c3b21a2cb78fb05f6bd29aa27cff0eed2bf3c31a7196d843a9e40d65c8fde2c3b23"], 0x1}}, 0x0) sendmmsg(r2, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) gettid() [ 313.131842] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 313.150443] dccp_close: ABORT with 1061 bytes unread [ 313.169555] 20873 total pagecache pages 23:01:56 executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000080)=[{0x4000000028, 0x0, 0x0, 0xfffff010}, {0x80000006}]}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0xfec, 0x20000) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) listen(r3, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20004004, &(0x7f0000000040)={0xa, 0x20004e22, 0x0, @remote, 0x1}, 0x1c) sendto$inet6(r1, &(0x7f0000000240)="e912882162eeb2654b44189df560fea8a096127e1601bbfdfb20934b16d8d8f9de053a9d971b9aa391bc3f7abd5a6bd2318ad770ef82bc255a0f3175ccd1ba220784f2d3c344ae3c0d77a7c59becfd3c5a29046e6be562fc701f25574e07c200fb30f18c892f48b917d9daa536d413506974cfc7db3989c8e2c1196ff3e90c4e93807a91eb966588b4577710a0ebd96cde2bdbeddfa333a71eb87ef56d7927b2fc3a2c556b5695b3cbd5b6b5df0b0d", 0xfd60, 0x0, 0x0, 0x1201000000003618) [ 313.207507] 0 pages in swap cache [ 313.245518] Swap cache stats: add 0, delete 0, find 0/0 [ 313.283056] Free swap = 0kB [ 313.299432] Total swap = 0kB [ 313.313571] 1965979 pages RAM [ 313.330232] 0 pages HighMem/MovableOnly [ 313.356324] 333228 pages reserved [ 313.377498] 0 pages cma reserved 23:01:56 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:01:56 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x50000}]}) lsetxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)='TRUE', 0x4, 0x0) 23:01:56 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="08631018ad687345c39f06f1345eb5b67840316700"/34], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:01:56 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x200000000d8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0) close(0xffffffffffffffff) r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, &(0x7f0000000100)=@ethernet, &(0x7f0000000180)=0x80) socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r2 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) r3 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f0000000480)={0x2a36, 0x4000f75, 0x6, 0x0, 0x0, [], [], [], 0x7caa, 0x6}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, 0x0) setsockopt(r2, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r2, &(0x7f0000e5c000)={0x2, 0x4e20, @loopback}, 0x10) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) process_vm_writev(0x0, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/185, 0xb9}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) socket$kcm(0x10, 0x2, 0x10) ioctl$KVM_S390_UCAS_UNMAP(r3, 0x4018ae51, &(0x7f0000000040)={0x20}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) r4 = accept(r1, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b90200000005000000000000008e6763f270e14ff2c25ccc9ac85c0180000063c94d6b7227311eeb74413291bbeeea5c234d4807389013f7450d0000b5000000001b11d749a5a6dd04f317fa56e40d5618474aa1c59e84e2699ff1885b0361196f61b510f0d3a3fb8070da9e6bf4c50723e3b5976f29057246bab492e03cca508019156ce4c3d8ffbc02da4b1e71c0519276e8bb3b1b58e32e368e19174c18ab140f6f34809d98cc0bb793ca1c24290b465dbdd287010006000000000010a1a88dd3b66caad3901294ee361a8db74515ff628d31380b3edfb0f23410d40284209db8341921e58fd1ea1a8500b89382c68cf36b67166c359a16152076d13f9cd67fbdf6c26538776e0fd7379d062c6f615c79e63834479a9346a1b2c4c54c29ba1b65924f964796e5152ca8e6b89ba490cf685535de3f9a51e172735cd552afce7a0e374ef3ea141cff0fc1b2b1e8bd8f5aa7c7ac962506f0db93056df402edb2f5400c5f11555be14277b3297bf4889bcea72b74f71f40236f3640a6212c17fe360d4fd68f9ab750ca6912ece506f510fea93d1106c04c6f35cc732b05573b96d082b92ff22cc2a2e4e585013644ab2b5f976a12922bc54e9376bb7cbd7ba829d23f9f3df2d9e32914f909f62824bbe891d028ef5c47e0b88f56a996c80b7d08425249fc7e63dc12ca768aa4fe2973806c0c0a7ead0d6d61ff2540691db06322fe0d3b943ee422ea2e250774bd9fe352e066e4c4c93163005bcccf975deaef5dec1c0ef680f42c5e6d95ad0f1130e08f1cd5c8720fabcabbd1d1e711542d74c74711b648eb007498ee289fedbad3c151edeb2f7d1384c021ce57d4a9817ea20d613cc7e0514e3a53507ed125f01a024deb15e50f06e15b0035209b07beded0a4b19e0e6eb147a23022bc24562d4303f22422bfbf767bb1b7f0edb350bbd82bc1f5a85484faf70b3614656508227c8cab57d3e59ce5529832981be9270096c2659e10308f7d7bf83bc9f6d6f4be2056a8f79caaae060e74a33d15042e6898073788d7c155ee2f1fbf196f8416e04251080238df7ea59246582113b6df0cd1b38f23066003e5d00a517165a0c0ce18e1d40c099e90a8b06352664a3bd30ff7d8a0eb85f88f9254c9082788b2502cc11c3b21a2cb78fb05f6bd29aa27cff0eed2bf3c31a7196d843a9e40d65c8fde2c3b23"], 0x1}}, 0x0) sendmmsg(r2, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) gettid() 23:01:56 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm-control\x00', 0x0, 0x0) accept$netrom(r0, 0x0, &(0x7f0000000240)) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x666100, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f00000000c0)=0x30f7cd3f) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 313.797325] binder: 14571:14574 unknown command 1936239896 [ 313.833975] binder: 14571:14574 ioctl c0306201 20000600 returned -22 23:01:56 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x31, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) connect$inet(r0, &(0x7f0000000400)={0x2, 0x0, @broadcast}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 23:01:56 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 313.987886] binder: 14581:14582 unknown command 64 [ 314.052537] binder: 14581:14582 ioctl c0306201 20000600 returned -22 23:01:57 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r4, 0x10e, 0x8, &(0x7f0000000480)=0x9, 0x4) sendfile(r1, r2, 0x0, 0x800000000024) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80001000}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c11d589", @ANYRES16=r5, @ANYBLOB="000028bd7000fedbdf2503000000240004001400010062726f6164636173742d6c696e6b00000c00010073797a3100000000100005000c00020008000300ffffffff3400090008000200060000000800010000000000080001002000000008000200d609000008000100f5f4ce2008000200040000001400090008000200e30000000800010005000000140009000800010001040000080002000700000013030500140002000800010065746800080001007564700008000100696200000800010065746800080001007564700008000100696200000800010075647000440002000800030006000000080001001c000000080001001e000000080001001a000000080003000600000008000300070000000800030002000000080003000200000004000200"], 0x13c}, 0x1, 0x0, 0x0, 0x44000}, 0x1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080), 0x8}, 0x0, 0x0, 0x80000}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="850000002f00000057080000000000009500000000000000e14b095b636bd31d78cb4c939c4efbca272a4da80e977f218493d5e393c6817707ce202a87ac633787aafcebed7de1c0cd3cc09be356bbd6a172ef92389f68a8c21574c2acd4d3c72ad81c6074e4"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 314.100456] dccp_close: ABORT with 1061 bytes unread [ 314.109036] dccp_close: ABORT with 1 bytes unread 23:01:57 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x31, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) connect$inet(r0, &(0x7f0000000400)={0x2, 0x0, @broadcast}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x5452b8196f000000) [ 314.145487] binder: 14597:14598 unknown command 64 [ 314.209157] binder: 14597:14598 ioctl c0306201 20000600 returned -22 23:01:57 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 314.330140] protocol 88fb is buggy, dev hsr_slave_0 [ 314.335753] protocol 88fb is buggy, dev hsr_slave_1 23:01:57 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:01:57 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="851d8019bc9d302596578f0000002f0006000000000400000036097f870000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 314.429207] binder: 14597:14602 unknown command 64 [ 314.436236] binder: 14597:14602 ioctl c0306201 20000600 returned -22 23:01:57 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="4000000010003bb444ba62f40f608f2d83334b05", @ANYRES32=0x0, @ANYBLOB="030000000000000008000a00", @ANYRES32=0x6, @ANYBLOB="1800120008000100677265000c00020008000700ac1414aa"], 0x40}, 0x1, 0x0, 0x0, 0x4004008}, 0x28800) [ 314.639608] binder: 14620:14624 unknown command 64 [ 314.645392] binder: 14620:14624 ioctl c0306201 20000600 returned -22 23:01:57 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x200000000d8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0) close(0xffffffffffffffff) r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, &(0x7f0000000100)=@ethernet, &(0x7f0000000180)=0x80) socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r2 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) r3 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f0000000480)={0x2a36, 0x4000f75, 0x6, 0x0, 0x0, [], [], [], 0x7caa, 0x6}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, 0x0) setsockopt(r2, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1) connect$inet(r2, &(0x7f0000e5c000)={0x2, 0x4e20, @loopback}, 0x10) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) process_vm_writev(0x0, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/185, 0xb9}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) socket$kcm(0x10, 0x2, 0x10) ioctl$KVM_S390_UCAS_UNMAP(r3, 0x4018ae51, &(0x7f0000000040)={0x20}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) r4 = accept(r1, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b90200000005000000000000008e6763f270e14ff2c25ccc9ac85c0180000063c94d6b7227311eeb74413291bbeeea5c234d4807389013f7450d0000b5000000001b11d749a5a6dd04f317fa56e40d5618474aa1c59e84e2699ff1885b0361196f61b510f0d3a3fb8070da9e6bf4c50723e3b5976f29057246bab492e03cca508019156ce4c3d8ffbc02da4b1e71c0519276e8bb3b1b58e32e368e19174c18ab140f6f34809d98cc0bb793ca1c24290b465dbdd287010006000000000010a1a88dd3b66caad3901294ee361a8db74515ff628d31380b3edfb0f23410d40284209db8341921e58fd1ea1a8500b89382c68cf36b67166c359a16152076d13f9cd67fbdf6c26538776e0fd7379d062c6f615c79e63834479a9346a1b2c4c54c29ba1b65924f964796e5152ca8e6b89ba490cf685535de3f9a51e172735cd552afce7a0e374ef3ea141cff0fc1b2b1e8bd8f5aa7c7ac962506f0db93056df402edb2f5400c5f11555be14277b3297bf4889bcea72b74f71f40236f3640a6212c17fe360d4fd68f9ab750ca6912ece506f510fea93d1106c04c6f35cc732b05573b96d082b92ff22cc2a2e4e585013644ab2b5f976a12922bc54e9376bb7cbd7ba829d23f9f3df2d9e32914f909f62824bbe891d028ef5c47e0b88f56a996c80b7d08425249fc7e63dc12ca768aa4fe2973806c0c0a7ead0d6d61ff2540691db06322fe0d3b943ee422ea2e250774bd9fe352e066e4c4c93163005bcccf975deaef5dec1c0ef680f42c5e6d95ad0f1130e08f1cd5c8720fabcabbd1d1e711542d74c74711b648eb007498ee289fedbad3c151edeb2f7d1384c021ce57d4a9817ea20d613cc7e0514e3a53507ed125f01a024deb15e50f06e15b0035209b07beded0a4b19e0e6eb147a23022bc24562d4303f22422bfbf767bb1b7f0edb350bbd82bc1f5a85484faf70b3614656508227c8cab57d3e59ce5529832981be9270096c2659e10308f7d7bf83bc9f6d6f4be2056a8f79caaae060e74a33d15042e6898073788d7c155ee2f1fbf196f8416e04251080238df7ea59246582113b6df0cd1b38f23066003e5d00a517165a0c0ce18e1d40c099e90a8b06352664a3bd30ff7d8a0eb85f88f9254c9082788b2502cc11c3b21a2cb78fb05f6bd29aa27cff0eed2bf3c31a7196d843a9e40d65c8fde2c3b23"], 0x1}}, 0x0) sendmmsg(r2, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) gettid() 23:01:57 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x8, 0x2000) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfc, 0x4000000}, 0xc) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) r2 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r2, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r2, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r3 = dup3(0xffffffffffffffff, r2, 0x1c0000) ioctl$KDGKBLED(r3, 0x4b64, &(0x7f0000000200)) [ 314.883502] binder: 14635:14637 unknown command 64 [ 314.923952] binder: 14635:14637 ioctl c0306201 20000600 returned -22 [ 314.960865] protocol 88fb is buggy, dev hsr_slave_0 [ 314.966335] protocol 88fb is buggy, dev hsr_slave_1 [ 314.982020] binder: 14635:14641 unknown command 64 [ 314.999959] binder: 14635:14641 ioctl c0306201 20000600 returned -22 23:01:58 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setns(0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) setreuid(0x0, 0x0) eventfd2(0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 23:01:58 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0xc) r0 = syz_open_dev$binderN(&(0x7f0000000040)='\x00\x00\x00\x00\x00\x00\x00@\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="08297729eb7793e467094f4d70d163ffff000000"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="85007d8cf8d8000057000000000008009500000000000000e4cac5cf72d78367d79f23257d6360886cdadaa4ac58c0312c1cec6cbc335a208c6f40508591837bd1baa63f34c4dcaf6bcf9c06628eb23454ef9d1accf3430d6a86f46bed601560b8b0d3764bf80576fd0d8115"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = open(&(0x7f0000000240)='./file0\x00', 0x90240, 0x44) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x78, 0x0, &(0x7f0000000340)=[@dead_binder_done, @acquire_done, @exit_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000280)={@flat=@weak_binder={0x77622a85, 0xa, 0x1}, @fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x7, 0x2, 0x37}}, &(0x7f0000000300)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x1}], 0x46, 0x0, &(0x7f00000003c0)="560cd73fe39a08dbf2a3199ca68a3d9c819b50e1764efdcac5350be9a13727496457e248f0880c6ed923109e752a6c0dd7f23e549bd42077f0baa2f2aeb6685709e66c168f39"}) r3 = syz_open_dev$swradio(&(0x7f0000000200)='/dev/swradio#\x00', 0x0, 0x2) ioctl$TIOCNXCL(r3, 0x540d) r4 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r4, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r4, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) connect$vsock_dgram(r4, &(0x7f0000000480)={0x28, 0x0, 0x2710, @hyper}, 0x10) 23:01:58 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="850000002f00000025000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) timerfd_gettime(r3, &(0x7f00000000c0)) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r1, r4, 0x0, 0x800000000024) setsockopt$CAIFSO_LINK_SELECT(r4, 0x116, 0x7f, &(0x7f0000000080)=0x6, 0x4) 23:01:58 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:01:58 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 315.325982] binder: 14657:14663 unknown command 64 [ 315.331227] binder: 14657:14663 ioctl c0306201 20000600 returned -22 23:01:58 executing program 4: r0 = socket(0x40000000015, 0x805, 0x0) getsockopt(r0, 0x114, 0x271b, 0x0, &(0x7f000033bffc)) 23:01:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000000)) ioctl$KVM_GET_CLOCK(0xffffffffffffffff, 0x8030ae7c, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) bind$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f00000000c0)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) ioctl$KVM_RUN(r3, 0xae80, 0x0) symlink(&(0x7f0000000200)='./file1\x00', &(0x7f0000000040)='./file0\x00') sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000000780)=ANY=[@ANYRES32=0x0], 0x1}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 23:01:58 executing program 4: socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip6_tables_matches\x00') sendfile(0xffffffffffffffff, r0, 0x0, 0xf000) ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f00000006c0)) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='coredump_filter\x00') getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}, &(0x7f0000000140)=0x10) r2 = socket$inet6(0xa, 0x1000080002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, 0x0, 0xdbc48b2ed180dff0, 0x0) ioctl$TIOCCONS(0xffffffffffffffff, 0x541d) ioctl$EXT4_IOC_SETFLAGS(r3, 0x40086602, &(0x7f0000000700)=0x80) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x10400003) epoll_create(0x100000000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'sit0\x00'}) sendmsg$sock(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=[@timestamping={{0x14, 0x1, 0x25, 0x2}}, @txtime={{0x18}}, @txtime={{0x18}}], 0x48}, 0x0) fsetxattr$security_smack_entry(0xffffffffffffffff, 0x0, &(0x7f0000000100)='self\\(\x00', 0x7, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000540)={@remote}) 23:01:58 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa', 0x1, 0x0) write$binfmt_script(r0, &(0x7f0000000500)=ANY=[@ANYBLOB='#'], 0x1) [ 315.691869] kvm: vcpu 0: requested 128 ns lapic timer period limited to 500000 ns 23:01:58 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:01:58 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='../4\x00') fstat(r0, &(0x7f0000000180)) 23:01:58 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8b1a, &(0x7f0000000080)='wlan1\x00') 23:01:58 executing program 4: syz_emit_ethernet(0x4e, &(0x7f00000002c0)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x689, 0x3}, [], {@ipv6={0x86dd, {0x0, 0x6, "76e051", 0x18, 0x3a, 0x0, @empty, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@mld={0x83, 0x0, 0x0, 0x0, 0x0, @mcast1}}}}}}, 0x0) [ 315.928364] binder: 14696:14700 unknown command 64 23:01:58 executing program 3: pselect6(0x6029, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400204) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$unix(0x1, 0x2, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000dddfc8)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c0000000706f300ffe97ffffdffbf2e0a0000000c00010006001d005d0a00010c0006"], 0x23}}, 0x0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r1, 0x0, r3, 0x0, 0x40000010003, 0x0) 23:01:59 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="80cb68f8347e8e9b7159e9111c5fd6d9f26ac6bdfd07e4532feeee2b7989a8db9ad22ec2388ae213c0b07f7b1378d448eadbfec1702978d985087d68bdc6d5c483fac50d28960c51289caefd90fac01cd3158f4c5e6f1cbbc214b61a5ac15b1378d04fc6a1634d1107b17a86428b4fbd1421c9c54f5b312c0d6f4fdfe727b30d42fbaa775ad691b36abc4bcdf2ff642e60d360d3015a161900d63e5e18673529387e7cbbead468366dd0f36f7bb49e41529baba3c36985a4e0b86b0249a1944375a27afb4278a54f163c818e024bf31791f140cf3f39f909a523e291496b0f968fbcc34037d20ce3f5b2e2dbef04f8d922ec2b42278f9033b86024691cfb09c2ae6d034435c94da73addfd2bfe9478243f2205cc84dc0eb4f3e0a84221b9f550034b7bc2d2570583b949d767102b6bbfeb1bdc83a66785c5143b04b0791bbc298d3f64888a2429c5a791e26ed1b1a927cb71f9b6b47a649cde02ea36a5dfa9e4ce91a0ce994f686399d52a6e980a5b7ae9b7be1d19f71172246f3f79d1a7e5d45cf32bc6a7ae6a4977b69d5160fe0a2502f277515bc190ead57d15adbd5f39388abe8396f09490e0d33989226d6a2bef6a712d01480333c207155222d55c2537162743907308c47f218a21c7f71563c32c994982cda072b0b20c59934025d1903ea98b241413efd2429822609d619418ed404f"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x7, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 315.960911] binder: 14696:14700 ioctl c0306201 20000600 returned -22 23:01:59 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:01:59 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:01:59 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [0xc0000100]}) 23:01:59 executing program 4: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000500)='/dev/nullb0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000d, 0x12, r0, 0x0) r1 = socket(0x40000000015, 0x805, 0x0) getsockopt(r1, 0x114, 0x2711, 0x0, &(0x7f000033bffc)) [ 316.105377] binder: 14714:14716 unknown command -1904331528 [ 316.125796] binder: 14714:14716 ioctl c0306201 20000600 returned -22 23:01:59 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="f762f33f00000000000000000000000000000000cd7184b1d09b8fba06304405ed9f063e5eb87e02c1ae80ff0f597b2d900213cc0d607ac0a3a65c94bde87bf074ca2c4fac87ba00aca6cf57836ad70e088c5f252de7949b38962e17ada28565bcae14b82e453aff8cd741c4a19671aa4621690a7dc2480663f3c34b1c2cb46cfe93e7104dfef647dbfd19916643f90d627e17479e23cee4017d43fcde5927bdfbf448686122da76262330733f38ec66a1a9da3dedb79f07dd0824c6c33f25981847ff90cc688c3fbc5ea966cc1ab43b8e7abc06195d87c9e147702b5302c2a986f9424eb6ee696fb6a705182be828811686dd"], 0x0, 0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xc000000000000002, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="85eeff000e0e001000009500000000e656f6031e0f000700800000a624dca7c440000000000076bffbac6402ee02c97f080c2333d9cc6a4aea78a8936a51e0faf9346a532fb10fa4b7d7159ceb178d256b2179f4c44eabe92dd45fc259ce348d8ba6b2e77be1734e3d2d439060647cce2f"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000640)='/selinux/policy\x00', 0x0, 0x0) ioctl$KVM_PPC_GET_PVINFO(r2, 0x4080aea1, &(0x7f0000000680)=""/220) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x200, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000040)={r5, @in6={{0xa, 0x4e22, 0x0, @loopback, 0x46cd}}, 0xe00, 0x0, 0x0, 0x4, 0x100000000}, &(0x7f0000000100)=0x98) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f0000000780)=r5, 0x4) sendmsg$TIPC_NL_SOCK_GET(r3, &(0x7f00000005c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000580)={&(0x7f00000003c0)={0x1bc, r4, 0x400, 0x70bd27, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x70, 0x1, [@TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x2fa, 0x1, 0x1b}]}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9e9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfae}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}]}, @TIPC_NLA_MEDIA={0x1c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_SOCK={0x48, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffff8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x200}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xc1}]}, @TIPC_NLA_NET={0x1c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x80}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ID={0x8}]}, @TIPC_NLA_MEDIA={0x98, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x1, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffff81}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_MTU={0x0, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x62d}]}]}, @TIPC_NLA_MON={0xfffffffffffffe70, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x101}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x20}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4b3}]}]}, 0x1bc}, 0x1, 0x0, 0x0, 0x20000084}, 0x4000) [ 316.187731] audit: type=1400 audit(1569884519.160:66): avc: denied { write } for pid=14710 comm="syz-executor.3" path="socket:[54520]" dev="sockfs" ino=54520 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 23:01:59 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="c50000002f00000057090000000000009500000000000000adb8df0fd602cdb1f00f9193cd0dffdbf7b1fca575eaa43fe6975a86c2965a786200138f10b9b0fdfb31327c234d5932b723d3c4cb6bf2bc8082b29a90779068da20a37e8c9557a939edb79d185ff0fd476ea5193239c0de199f90bc816ffcaecbc1f90cc4bef9fad182f53d4d7eff27b987dc3a27388ebec231c55481944f37958f3ecfc8ba397f4ff31c2e2854824501c8a5aae6b9b7dbacd2c154d6213ae6cbf42166925c8e47e6887c0dc810a9b76bbb81c057f2e97a767cb7a071cc5478568be8fdf4b52f4e5d98cb0e8fecbfb43d7378db7c7b702e"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 316.237295] binder: 14730:14734 unknown command 63 [ 316.257736] binder: 14730:14734 ioctl c0306201 20000600 returned -22 [ 316.280698] audit: type=1400 audit(1569884519.160:67): avc: denied { map } for pid=14724 comm="syz-executor.4" path="/dev/nullb0" dev="devtmpfs" ino=14136 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=blk_file permissive=1 23:01:59 executing program 4: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000500)='/dev/nullb0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000d, 0x12, r0, 0x0) r1 = socket(0x40000000015, 0x805, 0x0) getsockopt(r1, 0x114, 0x2711, 0x0, &(0x7f000033bffc)) 23:01:59 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 316.542113] binder: 14748:14750 unknown command 64 23:01:59 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000600)={{0xeb9f, 0x1, 0x4300, 0x18, 0x0, 0x14, 0x14, 0x2, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x0, 0x3}]}]}}, &(0x7f0000000680)=""/173, 0x2e, 0xad, 0x1}, 0x20) 23:01:59 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 316.580454] binder: 14748:14750 ioctl c0306201 20000600 returned -22 23:01:59 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:01:59 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [0x40000102]}) 23:02:00 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:00 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000600)={{0xeb9f, 0x1, 0x4300, 0x18, 0x0, 0x14, 0x14, 0x2, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x7, 0x3}]}]}}, &(0x7f0000000680)=""/173, 0x2e, 0xad, 0x1}, 0x20) 23:02:00 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:00 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = socket(0x11, 0x800000003, 0x0) prctl$PR_CAPBSET_READ(0x17, 0xf) setsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) setsockopt(0xffffffffffffffff, 0x2, 0x8, &(0x7f0000000200)="01094c48321c341289860752177e01a5", 0x10) bind(r1, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x9730, @mcast2, 0x4000800}, @in6={0xa, 0x4e24, 0x1ff, @rand_addr="62934344e0df1f2125d2753c1249643d", 0x2}, @in6={0xa, 0x4e20, 0x7fffffff, @loopback, 0x8}, @in={0x2, 0x4e24, @local}], 0x64) perf_event_open(&(0x7f0000000180)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_config_ext, 0x8000}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="850000002f00000057000000000000109500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:00 executing program 4: [ 317.130577] binder: 14787:14791 unknown command 64 23:02:00 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1d631cf10000000000000000000020e30000"], 0x0, 0x0, 0x0}) execve(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)=[&(0x7f00000000c0)='/dev/binder#\x00'], &(0x7f0000000380)=[&(0x7f00000003c0)='syzkaller\x00', &(0x7f0000000280)='\x00', &(0x7f00000002c0)='\x00', &(0x7f0000000300)=']\x00', &(0x7f0000000340)='syzkaller\x00']) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="850000002f00000057000000000000009500000000af611a18fa2bf0e786f09020c547246b2661be666a93f88752b4e3bd10563d00"/62], &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:00 executing program 3: 23:02:00 executing program 4: [ 317.156263] binder: 14787:14791 ioctl c0306201 20000600 returned -22 23:02:00 executing program 4: [ 317.421951] binder: 14804:14811 unknown command 241 [ 317.430884] binder: 14804:14811 ioctl c0306201 20000600 returned -22 23:02:00 executing program 3: 23:02:00 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:00 executing program 4: [ 317.515622] binder: 14804:14817 unknown command 241 [ 317.541804] binder: 14804:14817 ioctl c0306201 20000600 returned -22 23:02:00 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:00 executing program 4: 23:02:00 executing program 3: 23:02:00 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="0863104000000000000000000000000000001000"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r1, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@ipv4={[], [], @initdev}, @in6=@initdev}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@local}}, &(0x7f00000000c0)=0x64) fcntl$setflags(r0, 0x2, 0x1) r4 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r4, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r4, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) connect$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x6, {0x5, 0x3, 0x0, 0x7, 0x4e, 0xaa}, 0x4, 0xd0}, 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0xfffffffd}, 0x10}, 0x70) 23:02:00 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:00 executing program 4: 23:02:00 executing program 3: [ 317.967025] binder: 14833:14835 unknown command 64 [ 318.000117] binder: 14833:14835 ioctl c0306201 20000600 returned -22 23:02:01 executing program 4: 23:02:01 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:01 executing program 3: [ 318.269392] binder: 14833:14850 unknown command 92 [ 318.291910] binder: 14833:14850 ioctl c0306201 20000600 returned -22 23:02:01 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:01 executing program 3: 23:02:01 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:01 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/di\x00\x00\xa6\xee\xc8U\x03\x00\x05\x00', 0x0, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x1000, 0x2) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r1, 0xc0a85322, &(0x7f0000000200)) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) ioctl$DRM_IOCTL_GET_MAP(r3, 0xc0286404, &(0x7f00000000c0)={&(0x7f0000ffa000/0x3000)=nil, 0x80000, 0x2, 0x80, &(0x7f0000ff0000/0xf000)=nil, 0x401}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:01 executing program 4: 23:02:01 executing program 3: 23:02:01 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:01 executing program 4: 23:02:01 executing program 3: 23:02:01 executing program 4: 23:02:02 executing program 3: 23:02:02 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000500)='/dev/autofs\x00', 0x400, 0x0) getsockopt$TIPC_IMPORTANCE(r2, 0x10f, 0x7f, &(0x7f0000000540), &(0x7f0000000580)=0x4) close(r1) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680)='/dev/snapshot\x00', 0x200, 0x0) getsockopt$inet_sctp6_SCTP_NODELAY(r3, 0x84, 0x3, &(0x7f00000006c0), &(0x7f0000000700)=0x4) r4 = open(&(0x7f00000005c0)='./bus\x00', 0x80000, 0x40) ftruncate(r4, 0x88001) sendfile(r1, r4, 0x0, 0x800000000024) r5 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000000200)={{{@in=@empty, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@initdev}}, &(0x7f0000000080)=0xffffffffffffff35) r7 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000080)={'syz'}, &(0x7f0000000400)="585ccbc4ed83b8361cb55d9a4ac32d08648f300d19c1a6464914dc5500b66347b3c7218a9dfc0189f64219209906a53f9169000032a133d4b444025e0cf22ce6117f28000042e3d35228897501f93191b076ac446ff0022b8753a1fa748c569f435fb3bae96efb74b50ec93c2db8eae3198a29e5c0cfc60000ce0637cef580b4ec24c53d86571ff5ff70e48884ca000018cca71fcfacf40d32e4b58a8d272579d80a912da92dca0b5274ba9ff33c1e8e036e5031949762d009d308bd73f477252d0000000000004000000000000000000000000000000000195e23bf66c511268b21080e2d9090b7bae053d3539c86fb2c74ede96c1825fd4c", 0xf9, r7) r8 = add_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000300)={'syz', 0x2}, &(0x7f0000000340)="3e860487683635427b958bfb5353521e6ddb2bd720dede24bfe361ae0e4f67eb2ec1f7c345c38e937a256f3089d93d3d68840d420a09a50a4f66b0e5e01dbdad1d8241d703f2a2827a60c030d6d50535eca9299d52e85eca89d8db5170ac6f9bfe703a56f66693c5d83d51826c5bc4abc8c12e2e76359eaffd7fbcb8e5d41320f1e848aaf8e202739106221aa72c3b1ff70909f0e498f945ff1d75c4f76007b8b460a410", 0xa4, r7) r9 = socket$inet6(0xa, 0x400000000001, 0x0) close(r9) r10 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r10, 0x88001) sendfile(r9, r10, 0x0, 0x800000000024) connect$inet(r10, &(0x7f0000000640)={0x2, 0x4e20, @multicast1}, 0x10) keyctl$get_persistent(0x16, r6, r8) [ 319.199702] binder: 14912:14913 unknown command 64 [ 319.217542] binder: 14912:14913 ioctl c0306201 20000600 returned -22 23:02:02 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:02 executing program 4: [ 319.401111] audit: type=1804 audit(1569884522.380:68): pid=14913 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="ToMToU" comm="syz-executor.2" name="/root/syzkaller-testdir082794551/syzkaller.NWdoMA/337/bus" dev="sda1" ino=17122 res=1 23:02:02 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:02 executing program 3: 23:02:02 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:02 executing program 4: 23:02:02 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000080)='\xc1\xee\xe8\xea\x85B\xb6\x1d\x1b\xc2\x9f\xc5M\xa5\xc5\x10\x96@k\"9\x80J\xc1\xbf\xff\x97\x1frq\x91!\xd2\xa2\x12\x0e\x932,\x85\xaaO|\x94x`v\x19\xdf,\xb3\x90\xe3S\xa2\xfe\x8a)E\xd9H\xcc\xa5V\x1b', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x33}, 0x70) 23:02:02 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x50000}]}) pipe(0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) setxattr$security_capability(&(0x7f00000000c0)='./file0\x00', 0xfffffffffffffffe, 0x0, 0x0, 0x0) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) pipe(0x0) write$P9_RLERRORu(0xffffffffffffffff, 0x0, 0x0) 23:02:02 executing program 4: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x50000}]}) setxattr$security_capability(&(0x7f00000000c0)='./file0\x00', 0xfffffffffffffffe, 0x0, 0x0, 0x2) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0) [ 319.726118] binder: 14931:14935 unknown command 64 [ 319.732958] binder: 14931:14935 ioctl c0306201 20000600 returned -22 [ 319.773610] binder: 14931:14947 unknown command 64 [ 319.799072] binder: 14931:14947 ioctl c0306201 20000600 returned -22 23:02:03 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x200001000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0xffffffffffffffd8, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="1800000036002908001700befe000000010000001800000014000000ffffffff000000000000000003006d18a03d10c519c66775fd431115d4becdf3be9f706ee13c6dec7cbaf582d425851adce2c4350c15dda0a027952640bab6f05cc17bf0d2f56044631beb0727cb5d163925d4a70cb1237b31428b60be64104a3398e6c0f71ee0260c211f3f85a3101708d3736c3b2fada106196a0794c5c79dce9a9e29989666b02fdd91722e16a3b4f2ce75a634309eba36d3ca7ec2c9499a683f3d7e5b904ac9a44a1ce668dad1e84399e68e6a28743a7c44f4d6d1d6345ddef3"], 0x2c}}, 0x0) 23:02:03 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000240)={0x0, 0x9, 0x0, 0x1f, 0x7}, &(0x7f0000000340)=0x18) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000380)=@sack_info={r4, 0x25, 0x4}, 0xc) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r1, r5, 0x0, 0x800000000024) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r5, &(0x7f0000000200)={0x4, 0x8, 0xfa00, {r6, 0x5}}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r7 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r7, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r7, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) close(0xffffffffffffffff) r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r8, 0x88001) sendfile(0xffffffffffffffff, r8, 0x0, 0x800000000024) r9 = socket(0x11, 0x3, 0x0) setsockopt$packet_buf(r9, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r9, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) connect$l2tp(r9, &(0x7f00000003c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x3, 0x4, 0x3, 0x2, {0xa, 0x4e1f, 0xfffffe62, @loopback, 0x80000006}}}, 0x32) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x18, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="850000002f00000057000000ddd200009500000000f0ff001ebd07cc44906bf7903901f681a9ce6be7a80035f800a4fe09f3d6038e8e571983e65f7b20e72e939a407214b8233458edcaee425645397a9fdc"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x10, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0xa, 0x0, 0x4}, 0x10}, 0x70) getpid() r10 = socket$inet6(0xa, 0x400000000001, 0x0) close(r10) r11 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r11, 0x88001) sendfile(r10, r11, 0x0, 0x800000000024) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000000, 0x110, r10, 0x0) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000240), &(0x7f0000000280)) 23:02:03 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) exit(0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) accept4(r0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/dev\x00') sendfile(0xffffffffffffffff, r1, 0x0, 0x0) r2 = socket(0x10, 0x800000000000002, 0x0) close(r2) socket$inet6_sctp(0xa, 0x10000000005, 0x84) socket(0x10, 0x0, 0x0) socket$inet6_sctp(0xa, 0x10000000005, 0x84) perf_event_open(&(0x7f0000000500)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003400000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe000000008500000026000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000ac0)={r3, 0x0, 0xe, 0x0, &(0x7f00000005c0)="3104e4a5a2886aa1a30600008e00", 0x0, 0x103}, 0x28) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, 0x0, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000002c0), 0x8) [ 320.068728] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 23:02:03 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) 23:02:03 executing program 2: clone(0xd6488100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$vimc1(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/video1\x00', 0x2, 0x0) readv(r1, &(0x7f0000000580)=[{&(0x7f0000000200)=""/171, 0xab}, {&(0x7f00000002c0)=""/90, 0x5a}, {&(0x7f0000000640)=""/4096, 0x1000}, {&(0x7f0000000340)=""/255, 0xff}, {&(0x7f0000000440)=""/84, 0x54}, {&(0x7f00000004c0)=""/148, 0x94}], 0x6) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfff7fffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x12, 0x6, &(0x7f0000000080)=@raw=[@alu={0x9, 0x1, 0xa, 0x14, 0x11, 0x20}, @jmp={0x5, 0x1, 0x9, 0x2, 0x7, 0x27c95d73b248c0b3, 0xfde7a172c6b194c2}, @exit, @ldst={0x2, 0x2, 0x0, 0x3, 0x6, 0xfffffffffffffffc, 0xffffffffffffffff}, @generic={0x2, 0x3, 0x9, 0x4, 0x7a5}, @generic={0x0, 0x1, 0x1, 0x800, 0x7}], &(0x7f0000001640)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) [ 320.338752] audit: type=1400 audit(1569884523.310:69): avc: denied { sys_admin } for pid=14977 comm="syz-executor.2" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 320.379361] binder: 14977:14981 unknown command 64 [ 320.385107] binder: 14977:14981 ioctl c0306201 20000600 returned -22 23:02:03 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:03 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x31, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) connect$inet(r0, &(0x7f0000000400)={0x2, 0x0, @broadcast}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6, 0x4}, 0x1c) bind$alg(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) accept4$ax25(r2, 0x0, &(0x7f0000000040), 0x80000) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 23:02:03 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 320.562835] IPVS: ftp: loaded support on port[0] = 21 23:02:03 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) 23:02:04 executing program 4: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 321.193926] binder: 14977:15009 unknown command 64 [ 321.199999] binder: 14977:15009 ioctl c0306201 20000600 returned -22 [ 321.200264] net_ratelimit: 2 callbacks suppressed [ 321.200268] protocol 88fb is buggy, dev hsr_slave_0 [ 321.216587] protocol 88fb is buggy, dev hsr_slave_1 [ 321.221774] protocol 88fb is buggy, dev hsr_slave_0 [ 321.226823] protocol 88fb is buggy, dev hsr_slave_1 23:02:04 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:04 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:04 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0xa9, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 321.592357] binder: 15025:15027 unknown command 64 [ 321.597442] binder: 15025:15027 ioctl c0306201 20000600 returned -22 23:02:04 executing program 2: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x200, 0x0) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f00000000c0)=0xffffffff, 0x4) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/member\x00', 0x2, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='sixkalier\x00', 0x4}, 0x27f) 23:02:04 executing program 3: clone(0xd6488100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$vimc1(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/video1\x00', 0x2, 0x0) readv(r1, &(0x7f0000000580)=[{&(0x7f0000000200)=""/171, 0xab}, {&(0x7f00000002c0)=""/90, 0x5a}, {&(0x7f0000000640)=""/4096, 0x1000}, {&(0x7f0000000340)=""/255, 0xff}, {&(0x7f0000000440)=""/84, 0x54}, {&(0x7f00000004c0)=""/148, 0x94}], 0x6) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfff7fffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x12, 0x6, &(0x7f0000000080)=@raw=[@alu={0x9, 0x1, 0xa, 0x14, 0x11, 0x20}, @jmp={0x5, 0x1, 0x9, 0x2, 0x7, 0x27c95d73b248c0b3, 0xfde7a172c6b194c2}, @exit, @ldst={0x2, 0x2, 0x0, 0x3, 0x6, 0xfffffffffffffffc, 0xffffffffffffffff}, @generic={0x2, 0x3, 0x9, 0x4, 0x7a5}, @generic={0x0, 0x1, 0x1, 0x800, 0x7}], &(0x7f0000001640)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 23:02:04 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) 23:02:04 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000200)={0xff, 0x7f, 0x7, 0x0, [], [], [], 0x6, 0x20, 0x10001, 0x6, "f1fb742fb8e18fb9b1bcc3ebd5d7367d"}) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = semget$private(0x0, 0x3, 0x0) semop(r1, &(0x7f0000000000)=[{0x0, 0xffffffffffffb6d0}], 0x1) semctl$SETALL(r1, 0x0, 0x11, &(0x7f0000000080)) semctl$SETALL(r1, 0x0, 0x11, &(0x7f0000000340)=[0x7fff, 0x7]) r2 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$VFIO_IOMMU_UNMAP_DMA(0xffffffffffffffff, 0x3b72, &(0x7f0000000080)={0x20, 0x6463e23f798cc436, 0x1, 0x3f, 0x27}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 321.838055] binder: 15038:15041 unknown command 64 [ 321.851529] binder: 15038:15041 ioctl c0306201 20000600 returned -22 23:02:04 executing program 4: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 321.917581] binder: 15049:15051 unknown command 64 [ 321.922833] binder: 15049:15051 ioctl c0306201 20000600 returned -22 [ 321.955834] binder: 15040:15053 unknown command 64 23:02:05 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="0863104000000000004da9a500"/34], 0x0, 0x0, 0x0}) socket$bt_bnep(0x1f, 0x3, 0x4) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control\x00', 0x800, 0x0) statx(r2, &(0x7f0000000200)='./bus\x00', 0x400, 0x200, &(0x7f0000000240)) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r1, r3, 0x0, 0x800000000024) ioctl$VFIO_SET_IOMMU(r3, 0x3b66, 0x4) [ 321.991470] binder: 15040:15053 ioctl c0306201 20000600 returned -22 [ 322.071696] binder: 15062:15063 unknown command 64 [ 322.088972] binder: 15062:15063 ioctl c0306201 20000600 returned -22 23:02:05 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:05 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:05 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000200)={{0x0, 0x0, @descriptor="a269a8a7f1b5ca35"}, 0x96, [], "91cc278d0b049a35a53a409071d29fe545c928b1896a10e27d4b96c8e7dbb7e57bee88cd358d0279a7bd125c3c9d52f68831c94ac75965db6cb8033cdeec508d919ff18a285fbf0300fd0e019d7b61ad107b90fc807315f3cd513b30859b668f84aecdde0f2e721fb153ae0b5bacd96c7ab487421eb25747ea90ce8206d66d7ffa25e62b31fbd73bcca77a79064e290e51534555ea16"}) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0xc59a80752dfdaa64, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000300)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x3aa, 0x3, &(0x7f0000000000)=ANY=[], 0x2cc, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0xff, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5ab}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="850000002f00000082c562fdc846af05950000000000040075ce84253715aab3c9005d27"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 322.385329] binder: 15062:15068 unknown command 64 [ 322.393158] binder: 15062:15068 ioctl c0306201 20000600 returned -22 23:02:05 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) r3 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0xffff, 0x9000) r4 = syz_open_dev$usb(&(0x7f0000000640)='/dev/bus/usb/00#/00#\x00', 0x6, 0x305180) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000200)={"26588c5aa0dde3b5db9db9069b43c729e51e081cb08a6a066cff36ac95821d3236d05c5652e344614fc3c888f2175881b08ec6642189643313aaa6c36a78b9978234a4174dec61fdac50c9656b8475b627eb5f9cc5300757300c691a913b2254a1d3e32e3afd51ae1ec232a61ec7faa40856512de02db3f80c5109018b0f608b1fbd719bcd88e47dc65111be5e33490abf5af188a48bfb7a7e678b21372dff07a9afc0dfcbfe44996a4150e586ce92acc1f33f02fa271c1a714de226fd06b90b7dd9b9f00cb687bf28731e765152bd3c3e1a0a977b6a4c758cd08b34d037ade303870cde0a8c7d13573cd9484448d3184276147bacbc80bb3727fe280fa04f527eaca9f55e2610d56b268962293dba3ac216aaa9d1dad7fe760da4a38ff7fcbcdcb1a332e5a71ad4faa26998fa745ed79e5c907b944da1920b11b9e9efde7c9a081f463e4f07c57d2102692595acc713167fea15aea125669a949209abdfba4e53a5bc9df45374ddacefb854c7eb22b5b01dc5c2b683581e7a6b6a9294c0b6219f4a612b5c39a77b15c8ba5efc8a2e5951631f174df29ef815f8fa2515abe807afc66899ba041335f52dcad46b79a7d0cb5829761314a43ebd80ab7d1e61a98021cd702be6fd30bf69a6af77ddd2e0c6ab884df3f030a295c5dd7b30113736996d1b9f43de036e26772f52d4b298a45d6adb631e366aaf02486df12adb646a1b1a0d22ebd7f9fd05572fa48c8ef965a589bcf69388a6802e154ec8206a1ba0e8807dc1edbee2924a353c99aaeb78497c8bfe5a13d081506f92e6ffe8b57d88963ce24f71434fc1a2636e751006ff568cfbe167b416e46c05539a4ce943b7dded6ba2da8af391570104539a2d4c7308a06c5bc26c285f5ae0dce29c4dd7e51d59850d7317a5fbe4a8e243f35da9ec4267af65ae83b4c16dbb25bb8b25d6b622b18df57a6c04afef4a49de5e65aa8a6210f30e622ec9c25b44415f475c0f8ecd49a4ae86637465c2c301f026c9451905b1d672fb50599af53c1173a73b863e5e00831d231a7bd4ae69e6d69cd9645b42f6f45fa444cfd97dec8e03518a01b29f4e0d2aba2f1d7a041a44995277f86e102c0e5a101d13f3146e533a56a1924805e27f43ac02491065a9a234c419732758df028a143c570a571f1ac07069e2995b4d0397dd649f4e94a8ab6b2e43318895ca0c515efc2dc30bf9c9629684b15552d539a5d6c6db26bad72cdcfc7626fdf1a003164cac65ca90ce0ea8f72a25492fe551108ea81443335583467a96c236bcbcb516880864468defba9c2ce23b26864a86f5a4fe8a793e8fbd8fe121d19eca3931780b290e291689dfdbe7094564d8b6b6afac57823d9f0733fab30f4831437d6669713de7cd833d2e6c83bb89fc3aa4fb389d588a01150a05cbd1a4c5b597af64a235710c1acdc361e1fcb1854d63f2"}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000680)) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000080)) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f00000006c0)) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="850000002f00000057000040000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 322.449340] binder: 15079:15081 ioctl c0506617 20000200 returned -22 [ 322.634423] binder: 15085:15089 unknown command 64 23:02:05 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000200)={{0x0, 0x0, @descriptor="a269a8a7f1b5ca35"}, 0x96, [], "91cc278d0b049a35a53a409071d29fe545c928b1896a10e27d4b96c8e7dbb7e57bee88cd358d0279a7bd125c3c9d52f68831c94ac75965db6cb8033cdeec508d919ff18a285fbf0300fd0e019d7b61ad107b90fc807315f3cd513b30859b668f84aecdde0f2e721fb153ae0b5bacd96c7ab487421eb25747ea90ce8206d66d7ffa25e62b31fbd73bcca77a79064e290e51534555ea16"}) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0xc59a80752dfdaa64, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000300)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x3aa, 0x3, &(0x7f0000000000)=ANY=[], 0x2cc, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0xff, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5ab}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="850000002f00000082c562fdc846af05950000000000040075ce84253715aab3c9005d27"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:05 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 322.671907] binder: 15085:15089 ioctl c0306201 20000600 returned -22 [ 322.703879] binder: 15085:15089 ioctl 8004745a 20000080 returned -22 23:02:05 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000200)={{0x0, 0x0, @descriptor="a269a8a7f1b5ca35"}, 0x96, [], "91cc278d0b049a35a53a409071d29fe545c928b1896a10e27d4b96c8e7dbb7e57bee88cd358d0279a7bd125c3c9d52f68831c94ac75965db6cb8033cdeec508d919ff18a285fbf0300fd0e019d7b61ad107b90fc807315f3cd513b30859b668f84aecdde0f2e721fb153ae0b5bacd96c7ab487421eb25747ea90ce8206d66d7ffa25e62b31fbd73bcca77a79064e290e51534555ea16"}) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0xc59a80752dfdaa64, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000300)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x3aa, 0x3, &(0x7f0000000000)=ANY=[], 0x2cc, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0xff, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5ab}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="850000002f00000082c562fdc846af05950000000000040075ce84253715aab3c9005d27"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 322.771127] binder: 15096:15099 ioctl c0506617 20000200 returned -22 23:02:05 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r2, 0x0) stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r5, 0x0) syz_mount_image$ntfs(&(0x7f0000000080)='ntfs\x00', &(0x7f00000000c0)='./file0\x00', 0x34e6, 0x0, &(0x7f0000000200), 0x80, &(0x7f00000003c0)={[{@show_sys_files_yes='show_sys_files=yes'}, {@gid={'gid', 0x3d, r0}}, {@case_sensitive_no='case_sensitive=no'}, {@disable_sparse_yes='disable_sparse=yes'}, {@nls={'nls', 0x3d, 'iso8859-4'}}, {@show_sys_files_no='show_sys_files=no'}, {@show_sys_files_no='show_sys_files=no'}, {@show_sys_files_no='show_sys_files=no'}, {@dmask={'dmask', 0x3d, 0x4}}], [{@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@dont_appraise='dont_appraise'}, {@fsuuid={'fsuuid', 0x3d, {[0x32, 0x66, 0x63, 0x38, 0x38, 0x0, 0x51, 0xe90274924377647e], 0x2d, [0x66, 0x62, 0x36, 0x39], 0x2d, [0x35, 0x63, 0x65, 0x38], 0x2d, [0x39, 0x36, 0x7, 0x52], 0x2d, [0x36, 0x62, 0x34, 0x30, 0x32, 0x62, 0x64, 0x64]}}}, {@fowner_gt={'fowner>', r2}}, {@euid_gt={'euid>', r3}}, {@uid_eq={'uid', 0x3d, r5}}, {@obj_role={'obj_role', 0x3d, '!/'}}]}) r6 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:05 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) r3 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0xffff, 0x9000) r4 = syz_open_dev$usb(&(0x7f0000000640)='/dev/bus/usb/00#/00#\x00', 0x6, 0x305180) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000200)={"26588c5aa0dde3b5db9db9069b43c729e51e081cb08a6a066cff36ac95821d3236d05c5652e344614fc3c888f2175881b08ec6642189643313aaa6c36a78b9978234a4174dec61fdac50c9656b8475b627eb5f9cc5300757300c691a913b2254a1d3e32e3afd51ae1ec232a61ec7faa40856512de02db3f80c5109018b0f608b1fbd719bcd88e47dc65111be5e33490abf5af188a48bfb7a7e678b21372dff07a9afc0dfcbfe44996a4150e586ce92acc1f33f02fa271c1a714de226fd06b90b7dd9b9f00cb687bf28731e765152bd3c3e1a0a977b6a4c758cd08b34d037ade303870cde0a8c7d13573cd9484448d3184276147bacbc80bb3727fe280fa04f527eaca9f55e2610d56b268962293dba3ac216aaa9d1dad7fe760da4a38ff7fcbcdcb1a332e5a71ad4faa26998fa745ed79e5c907b944da1920b11b9e9efde7c9a081f463e4f07c57d2102692595acc713167fea15aea125669a949209abdfba4e53a5bc9df45374ddacefb854c7eb22b5b01dc5c2b683581e7a6b6a9294c0b6219f4a612b5c39a77b15c8ba5efc8a2e5951631f174df29ef815f8fa2515abe807afc66899ba041335f52dcad46b79a7d0cb5829761314a43ebd80ab7d1e61a98021cd702be6fd30bf69a6af77ddd2e0c6ab884df3f030a295c5dd7b30113736996d1b9f43de036e26772f52d4b298a45d6adb631e366aaf02486df12adb646a1b1a0d22ebd7f9fd05572fa48c8ef965a589bcf69388a6802e154ec8206a1ba0e8807dc1edbee2924a353c99aaeb78497c8bfe5a13d081506f92e6ffe8b57d88963ce24f71434fc1a2636e751006ff568cfbe167b416e46c05539a4ce943b7dded6ba2da8af391570104539a2d4c7308a06c5bc26c285f5ae0dce29c4dd7e51d59850d7317a5fbe4a8e243f35da9ec4267af65ae83b4c16dbb25bb8b25d6b622b18df57a6c04afef4a49de5e65aa8a6210f30e622ec9c25b44415f475c0f8ecd49a4ae86637465c2c301f026c9451905b1d672fb50599af53c1173a73b863e5e00831d231a7bd4ae69e6d69cd9645b42f6f45fa444cfd97dec8e03518a01b29f4e0d2aba2f1d7a041a44995277f86e102c0e5a101d13f3146e533a56a1924805e27f43ac02491065a9a234c419732758df028a143c570a571f1ac07069e2995b4d0397dd649f4e94a8ab6b2e43318895ca0c515efc2dc30bf9c9629684b15552d539a5d6c6db26bad72cdcfc7626fdf1a003164cac65ca90ce0ea8f72a25492fe551108ea81443335583467a96c236bcbcb516880864468defba9c2ce23b26864a86f5a4fe8a793e8fbd8fe121d19eca3931780b290e291689dfdbe7094564d8b6b6afac57823d9f0733fab30f4831437d6669713de7cd833d2e6c83bb89fc3aa4fb389d588a01150a05cbd1a4c5b597af64a235710c1acdc361e1fcb1854d63f2"}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000680)) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000080)) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f00000006c0)) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="850000002f00000057000040000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:05 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$VIDIOC_QUERYMENU(r2, 0xc02c5625, &(0x7f0000000200)={0x8000, 0x3, @value=0x1}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x4301, 0x0) ioctl$TUNGETFILTER(r3, 0x801054db, &(0x7f00000000c0)=""/2) [ 322.910881] binder: 15107:15113 ioctl c0506617 20000200 returned -22 23:02:05 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000200)={{0x0, 0x0, @descriptor="a269a8a7f1b5ca35"}, 0x96, [], "91cc278d0b049a35a53a409071d29fe545c928b1896a10e27d4b96c8e7dbb7e57bee88cd358d0279a7bd125c3c9d52f68831c94ac75965db6cb8033cdeec508d919ff18a285fbf0300fd0e019d7b61ad107b90fc807315f3cd513b30859b668f84aecdde0f2e721fb153ae0b5bacd96c7ab487421eb25747ea90ce8206d66d7ffa25e62b31fbd73bcca77a79064e290e51534555ea16"}) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0xc59a80752dfdaa64, 0x0) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000300)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x3aa, 0x3, &(0x7f0000000000)=ANY=[], 0x2cc, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0xff, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5ab}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="850000002f00000082c562fdc846af05950000000000040075ce84253715aab3c9005d27"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 322.954316] binder: 15112:15118 unknown command 64 [ 322.989185] binder: 15119:15122 unknown command 64 [ 323.000362] binder: 15112:15118 ioctl c0306201 20000600 returned -22 [ 323.024048] binder: 15112:15125 ioctl 8004745a 20000080 returned -22 [ 323.031033] binder: 15119:15122 ioctl c0306201 20000600 returned -22 23:02:06 executing program 4: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 323.048357] binder: 15124:15126 ioctl c0506617 20000200 returned -22 [ 323.059772] binder: 15119:15128 ioctl c02c5625 20000200 returned -22 23:02:06 executing program 3: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:06 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:06 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:06 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="0863101d00000000000004000000000000000000aef756a72c8d23211d5c2f2ce58638a734b82f0a9633628be2c1494742f0755ef598552aa17c58797fe041e560729b5fcd008aa7f3316e2662d183"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3f}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 323.254269] binder: 15140:15145 unknown command 29 [ 323.574656] binder: 15140:15145 ioctl c0306201 20000600 returned -22 23:02:06 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:06 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 323.675343] binder: 15140:15170 unknown command 29 [ 323.691860] binder: 15140:15170 ioctl c0306201 20000600 returned -22 23:02:06 executing program 3: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:06 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$KVM_XEN_HVM_CONFIG(r2, 0x4038ae7a, &(0x7f00000000c0)={0x0, 0x1ccf, &(0x7f0000000080), &(0x7f0000000200)="b140ee3f85084abc5f8c9b0a01f07983e1f092abe240254e9d788d865f14ae277cf9cb4163b18b4f61b287d592d3f08bbc763a6f6e01966d9bb0d8d3d7bc2362594b8ff470de98040cce431b49cd914071a73329161ab67f2553d31d9e7b8a551b73063a68dc22585dc3625ecf057804a448f6ceafdc656971ecec6760237dc5864ee3789dab5aa3ed2eb0775de5d94247e9569a624a1ed008d0fe631b9564", 0x0, 0x9f}) [ 323.826378] binder: 15181:15184 unknown command 64 [ 323.832531] binder: 15181:15184 ioctl c0306201 20000600 returned -22 23:02:06 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="0863104000000500"/20], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x0, 0x0) ioctl$IMADDTIMER(r1, 0x80044940, &(0x7f00000000c0)=0x14) 23:02:07 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:07 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 324.173897] binder: 15195:15198 unknown command 83886144 23:02:07 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0x840, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r0, 0x4068aea3, &(0x7f0000000200)={0x4204856885f64b56, 0x0, [0x5520, 0x2, 0x7f, 0x100000000]}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x400040) [ 324.219650] binder: 15195:15198 ioctl c0306201 20000600 returned -22 23:02:07 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 324.501411] binder: 15210:15215 unknown command 64 [ 324.506701] binder: 15210:15215 ioctl c0306201 20000600 returned -22 23:02:07 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:07 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r1, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) connect$rds(r1, &(0x7f0000000080)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 23:02:07 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="850000002f00000025000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) timerfd_gettime(r3, &(0x7f00000000c0)) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r1, r4, 0x0, 0x800000000024) setsockopt$CAIFSO_LINK_SELECT(r4, 0x116, 0x7f, &(0x7f0000000080)=0x6, 0x4) 23:02:07 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="006310400000000000450587842c742beb490000"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 324.773743] binder: 15229:15232 unknown command 64 [ 324.785592] binder: 15231:15233 unknown command 64 [ 324.797388] binder: 15229:15232 ioctl c0306201 20000600 returned -22 [ 324.807775] binder: 15231:15233 ioctl c0306201 20000600 returned -22 23:02:07 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="850000002f00000025000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) timerfd_gettime(r3, &(0x7f00000000c0)) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r1, r4, 0x0, 0x800000000024) setsockopt$CAIFSO_LINK_SELECT(r4, 0x116, 0x7f, &(0x7f0000000080)=0x6, 0x4) 23:02:08 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:08 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) 23:02:08 executing program 4: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 325.059037] binder: 15243:15244 unknown command 64 23:02:08 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 325.107815] binder: 15247:15253 unknown command 64 [ 325.113198] binder: 15243:15244 ioctl c0306201 20000600 returned -22 [ 325.137978] binder: 15247:15253 ioctl c0306201 20000600 returned -22 23:02:08 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="850000002f00000025000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) timerfd_gettime(r3, &(0x7f00000000c0)) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r1, r4, 0x0, 0x800000000024) setsockopt$CAIFSO_LINK_SELECT(r4, 0x116, 0x7f, &(0x7f0000000080)=0x6, 0x4) 23:02:08 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:08 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) [ 325.560996] binder: 15278:15283 unknown command 64 23:02:08 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="850000002f00000025000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) timerfd_gettime(r3, &(0x7f00000000c0)) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r1, r4, 0x0, 0x800000000024) setsockopt$CAIFSO_LINK_SELECT(r4, 0x116, 0x7f, &(0x7f0000000080)=0x6, 0x4) [ 325.615756] binder: 15278:15283 ioctl c0306201 20000600 returned -22 23:02:08 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:08 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) [ 325.964099] binder: 15299:15300 unknown command 64 23:02:09 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 326.002220] binder: 15299:15300 ioctl c0306201 20000600 returned -22 23:02:09 executing program 3: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:09 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:09 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0xc) r0 = syz_open_dev$binderN(&(0x7f0000000040)='\x00\x00\x00\x00\x00\x00\x00@\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="08297729eb7793e467094f4d70d163ffff000000"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="85007d8cf8d8000057000000000008009500000000000000e4cac5cf72d78367d79f23257d6360886cdadaa4ac58c0312c1cec6cbc335a208c6f40508591837bd1baa63f34c4dcaf6bcf9c06628eb23454ef9d1accf3430d6a86f46bed601560b8b0d3764bf80576fd0d8115"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = open(&(0x7f0000000240)='./file0\x00', 0x90240, 0x44) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x78, 0x0, &(0x7f0000000340)=[@dead_binder_done, @acquire_done, @exit_looper, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000280)={@flat=@weak_binder={0x77622a85, 0xa, 0x1}, @fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x7, 0x2, 0x37}}, &(0x7f0000000300)={0x0, 0x18, 0x30}}}, @request_death={0x400c630e, 0x1}], 0x46, 0x0, &(0x7f00000003c0)="560cd73fe39a08dbf2a3199ca68a3d9c819b50e1764efdcac5350be9a13727496457e248f0880c6ed923109e752a6c0dd7f23e549bd42077f0baa2f2aeb6685709e66c168f39"}) r3 = syz_open_dev$swradio(&(0x7f0000000200)='/dev/swradio#\x00', 0x0, 0x2) ioctl$TIOCNXCL(r3, 0x540d) r4 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r4, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r4, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) connect$vsock_dgram(r4, &(0x7f0000000480)={0x28, 0x0, 0x2710, @hyper}, 0x10) 23:02:09 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:09 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="851d8019bc9d302596578f0000002f0006000000000400000036097f870000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:09 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:09 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000200)={'team_slave_0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000072e0b50c1416e3ac6b8bb9483572d9"]}) r1 = shmget$private(0x0, 0x13000, 0x0, &(0x7f0000feb000/0x13000)=nil) r2 = shmat(r1, &(0x7f0000fee000/0x2000)=nil, 0x5000) shmdt(r2) shmdt(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="0863100200000000000000000000000000000000b8800f7e7601e17bbc4cbb1aedb4233adc6ca9075a2fd6babd60c08bdf5eb7c28882a8eb9392653908ce5477a4e410a405b99f37eb01685ca9f8a154f6ee74f53cd3f4c7bdc648c18b968584d268bb07308fd422be2628deb027c19804afcd4972e3706ed9fcfedbf0690a81bff5eecd968b9e3ad72820"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r5 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000000240)) ftruncate(r4, 0x88001) r6 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r6, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r6, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) sendfile(0xffffffffffffffff, r6, 0x0, 0x2) r7 = fcntl$dupfd(0xffffffffffffffff, 0x80c, r3) setsockopt$RXRPC_SECURITY_KEY(r7, 0x110, 0x1, &(0x7f0000000080)='/dev/binder#\x00', 0xd) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 326.923035] binder: 15343:15346 unknown command 64 23:02:09 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r4, 0x10e, 0x8, &(0x7f0000000480)=0x9, 0x4) sendfile(r1, r2, 0x0, 0x800000000024) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80001000}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c11d589", @ANYRES16=r5, @ANYBLOB="000028bd7000fedbdf2503000000240004001400010062726f6164636173742d6c696e6b00000c00010073797a3100000000100005000c00020008000300ffffffff3400090008000200060000000800010000000000080001002000000008000200d609000008000100f5f4ce2008000200040000001400090008000200e30000000800010005000000140009000800010001040000080002000700000013030500140002000800010065746800080001007564700008000100696200000800010065746800080001007564700008000100696200000800010075647000440002000800030006000000080001001c000000080001001e000000080001001a000000080003000600000008000300070000000800030002000000080003000200000004000200"], 0x13c}, 0x1, 0x0, 0x0, 0x44000}, 0x1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080), 0x8}, 0x0, 0x0, 0x80000}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="850000002f00000057080000000000009500000000000000e14b095b636bd31d78cb4c939c4efbca272a4da80e977f218493d5e393c6817707ce202a87ac633787aafcebed7de1c0cd3cc09be356bbd6a172ef92389f68a8c21574c2acd4d3c72ad81c6074e4"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 326.959240] binder: 15351:15352 unknown command 2 [ 326.960065] binder: 15343:15346 ioctl c0306201 20000600 returned -22 [ 326.965724] binder: 15351:15352 ioctl c0306201 20000600 returned -22 [ 327.225004] binder: 15356:15361 unknown command 64 23:02:10 executing program 3: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 327.247627] binder: 15356:15361 ioctl c0306201 20000600 returned -22 23:02:10 executing program 2: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x20000, 0x0) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000440)={0x7f}, 0x1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="08631040000000000000000000000000000000008d483b62ef2df7ffff7f07ffb3e9795f0695b7b0c4e4ce5b98abc79934b3d97fa81f895fd5823d3f6f9191959b1965814093bc2fd3d61890dc076791364857ee8b7512a1c686e92692d927036f23013ac3341ff123ffb396017d3e9ebdcf21cdeafdb58be12e9847cd2c5f8ba5f40e717580f6965b322af6aea07fa9e946334b80aa3379fa871a25b2d59a6500ceb3fc77e9a19e5f06942339075c57e6e0d0b96ce9607a0b2a64d89d78e6f8431afbde9b06681f0bca0bf62c120de726413a"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x280) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000000c0)={r3}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$vcsa(&(0x7f0000000300)='/dev/vcsa#\x00', 0x80000001, 0x20000) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r6, r7, 0x0, 0x800000000024) getsockopt$inet_IP_IPSEC_POLICY(r7, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f00000005c0)=0x2d3) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'ip6gre0\x00', r8}) bind(0xffffffffffffffff, &(0x7f0000000180)=@xdp={0x2c, 0x0, r8, 0x11}, 0x80) r9 = syz_open_dev$vcsa(&(0x7f0000000300)='/dev/vcsa#\x00', 0x80000001, 0x20000) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000340)={{{@in=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000ac0)=0xe8) r11 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) ioctl$TUNSETOFFLOAD(r11, 0x400454d0, 0x6) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000000c0)={'ip6gre0\x00', r10}) bind(0xffffffffffffffff, &(0x7f0000000180)=@xdp={0x2c, 0x0, r10, 0x11}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x8, 0x2000000000000095, &(0x7f0000000480)=ANY=[@ANYBLOB="850000f32f000000570000000000001e7f4e65ee09deb4031b48dea2c576b0dddf7900"], &(0x7f0000000000)='{\xe6@\x94', 0x0, 0x0, 0x0, 0x0, 0x0, [], r10, 0x4, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x8}, 0x10}, 0x70) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000640)={'bcsh0\x00', 0x100}) 23:02:10 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r4, 0x10e, 0x8, &(0x7f0000000480)=0x9, 0x4) sendfile(r1, r2, 0x0, 0x800000000024) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80001000}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c11d589", @ANYRES16=r5, @ANYBLOB="000028bd7000fedbdf2503000000240004001400010062726f6164636173742d6c696e6b00000c00010073797a3100000000100005000c00020008000300ffffffff3400090008000200060000000800010000000000080001002000000008000200d609000008000100f5f4ce2008000200040000001400090008000200e30000000800010005000000140009000800010001040000080002000700000013030500140002000800010065746800080001007564700008000100696200000800010065746800080001007564700008000100696200000800010075647000440002000800030006000000080001001c000000080001001e000000080001001a000000080003000600000008000300070000000800030002000000080003000200000004000200"], 0x13c}, 0x1, 0x0, 0x0, 0x44000}, 0x1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080), 0x8}, 0x0, 0x0, 0x80000}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="850000002f00000057080000000000009500000000000000e14b095b636bd31d78cb4c939c4efbca272a4da80e977f218493d5e393c6817707ce202a87ac633787aafcebed7de1c0cd3cc09be356bbd6a172ef92389f68a8c21574c2acd4d3c72ad81c6074e4"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:10 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 327.395076] binder: 15368:15369 unknown command 64 [ 327.412192] binder: 15366:15371 unknown command 64 23:02:10 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r4, 0x10e, 0x8, &(0x7f0000000480)=0x9, 0x4) sendfile(r1, r2, 0x0, 0x800000000024) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80001000}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c11d589", @ANYRES16=r5, @ANYBLOB="000028bd7000fedbdf2503000000240004001400010062726f6164636173742d6c696e6b00000c00010073797a3100000000100005000c00020008000300ffffffff3400090008000200060000000800010000000000080001002000000008000200d609000008000100f5f4ce2008000200040000001400090008000200e30000000800010005000000140009000800010001040000080002000700000013030500140002000800010065746800080001007564700008000100696200000800010065746800080001007564700008000100696200000800010075647000440002000800030006000000080001001c000000080001001e000000080001001a000000080003000600000008000300070000000800030002000000080003000200000004000200"], 0x13c}, 0x1, 0x0, 0x0, 0x44000}, 0x1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080), 0x8}, 0x0, 0x0, 0x80000}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="850000002f00000057080000000000009500000000000000e14b095b636bd31d78cb4c939c4efbca272a4da80e977f218493d5e393c6817707ce202a87ac633787aafcebed7de1c0cd3cc09be356bbd6a172ef92389f68a8c21574c2acd4d3c72ad81c6074e4"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 327.437043] binder: 15366:15371 ioctl c0306201 20000600 returned -22 [ 327.443984] binder: 15368:15369 ioctl c0306201 20000600 returned -22 [ 327.721677] binder: 15382:15384 unknown command 64 23:02:10 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:10 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(0x0, &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:10 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) lgetxattr(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)=@random={'user.', 'syzkaller\x00'}, &(0x7f0000000280)=""/86, 0x56) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0xffffffffffffff01, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x0, 0x10, &(0x7f0000000000), 0xffffffffffffffc4}, 0x48) [ 327.745180] binder: 15382:15384 ioctl c0306201 20000600 returned -22 23:02:10 executing program 4: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x20000, 0x0) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000440)={0x7f}, 0x1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="08631040000000000000000000000000000000008d483b62ef2df7ffff7f07ffb3e9795f0695b7b0c4e4ce5b98abc79934b3d97fa81f895fd5823d3f6f9191959b1965814093bc2fd3d61890dc076791364857ee8b7512a1c686e92692d927036f23013ac3341ff123ffb396017d3e9ebdcf21cdeafdb58be12e9847cd2c5f8ba5f40e717580f6965b322af6aea07fa9e946334b80aa3379fa871a25b2d59a6500ceb3fc77e9a19e5f06942339075c57e6e0d0b96ce9607a0b2a64d89d78e6f8431afbde9b06681f0bca0bf62c120de726413a"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x280) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000000c0)={r3}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$vcsa(&(0x7f0000000300)='/dev/vcsa#\x00', 0x80000001, 0x20000) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r6, r7, 0x0, 0x800000000024) getsockopt$inet_IP_IPSEC_POLICY(r7, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f00000005c0)=0x2d3) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'ip6gre0\x00', r8}) bind(0xffffffffffffffff, &(0x7f0000000180)=@xdp={0x2c, 0x0, r8, 0x11}, 0x80) r9 = syz_open_dev$vcsa(&(0x7f0000000300)='/dev/vcsa#\x00', 0x80000001, 0x20000) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000340)={{{@in=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000ac0)=0xe8) r11 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) ioctl$TUNSETOFFLOAD(r11, 0x400454d0, 0x6) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000000c0)={'ip6gre0\x00', r10}) bind(0xffffffffffffffff, &(0x7f0000000180)=@xdp={0x2c, 0x0, r10, 0x11}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x8, 0x2000000000000095, &(0x7f0000000480)=ANY=[@ANYBLOB="850000f32f000000570000000000001e7f4e65ee09deb4031b48dea2c576b0dddf7900"], &(0x7f0000000000)='{\xe6@\x94', 0x0, 0x0, 0x0, 0x0, 0x0, [], r10, 0x4, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x8}, 0x10}, 0x70) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000640)={'bcsh0\x00', 0x100}) [ 327.899741] binder: 15396:15399 unknown command 64 [ 327.925547] binder: 15397:15400 unknown command 64 [ 327.930901] binder: 15396:15399 ioctl c0306201 20000600 returned -22 [ 328.094487] binder: 15397:15400 ioctl c0306201 20000600 returned -22 23:02:11 executing program 3: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:11 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(0x0, &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:11 executing program 2: r0 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r0, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r0, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r1 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r1, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000080)={r1}) connect(r2, &(0x7f0000000200)=@vsock={0x28, 0x0, 0xffffffff, @reserved}, 0x80) r3 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r3, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r3, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000280)=0x14) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0xff, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) r5 = socket$inet6(0xa, 0x400000000001, 0x0) close(r5) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x88001) sendfile(r5, r6, 0x0, 0x800000000024) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r6, 0xc0045540, &(0x7f00000002c0)=0xff) 23:02:11 executing program 4: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x20000, 0x0) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000440)={0x7f}, 0x1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="08631040000000000000000000000000000000008d483b62ef2df7ffff7f07ffb3e9795f0695b7b0c4e4ce5b98abc79934b3d97fa81f895fd5823d3f6f9191959b1965814093bc2fd3d61890dc076791364857ee8b7512a1c686e92692d927036f23013ac3341ff123ffb396017d3e9ebdcf21cdeafdb58be12e9847cd2c5f8ba5f40e717580f6965b322af6aea07fa9e946334b80aa3379fa871a25b2d59a6500ceb3fc77e9a19e5f06942339075c57e6e0d0b96ce9607a0b2a64d89d78e6f8431afbde9b06681f0bca0bf62c120de726413a"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x280) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000000c0)={r3}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$vcsa(&(0x7f0000000300)='/dev/vcsa#\x00', 0x80000001, 0x20000) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r6, r7, 0x0, 0x800000000024) getsockopt$inet_IP_IPSEC_POLICY(r7, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f00000005c0)=0x2d3) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'ip6gre0\x00', r8}) bind(0xffffffffffffffff, &(0x7f0000000180)=@xdp={0x2c, 0x0, r8, 0x11}, 0x80) r9 = syz_open_dev$vcsa(&(0x7f0000000300)='/dev/vcsa#\x00', 0x80000001, 0x20000) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000340)={{{@in=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000ac0)=0xe8) r11 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) ioctl$TUNSETOFFLOAD(r11, 0x400454d0, 0x6) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000000c0)={'ip6gre0\x00', r10}) bind(0xffffffffffffffff, &(0x7f0000000180)=@xdp={0x2c, 0x0, r10, 0x11}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x8, 0x2000000000000095, &(0x7f0000000480)=ANY=[@ANYBLOB="850000f32f000000570000000000001e7f4e65ee09deb4031b48dea2c576b0dddf7900"], &(0x7f0000000000)='{\xe6@\x94', 0x0, 0x0, 0x0, 0x0, 0x0, [], r10, 0x4, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x8}, 0x10}, 0x70) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000640)={'bcsh0\x00', 0x100}) [ 328.249141] binder: 15422:15425 unknown command 64 [ 328.258689] binder: 15422:15425 ioctl c0306201 20000600 returned -22 [ 328.276633] binder: 15430:15431 unknown command 64 [ 328.287957] binder: 15430:15431 ioctl c0306201 20000600 returned -22 [ 328.323133] binder: 15430:15431 ioctl 89e2 200000c0 returned -22 23:02:11 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) connect$pppoe(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:11 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x0, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:11 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(0x0, &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:11 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000200)=ANY=[@ANYBLOB="07000000000000000b0000000000000002000000070000000600000091c30000090000000000000000000000000000001c0000800300000075be46b101000000020000000800000036000000000000000000000000000000010000c0013700000000000006000000010001000500000007000000000000000000000000000000040000000800000005000000000000001f0000070004000007000000000000000000000000000000080000800000fc01f1ff00001f00000040000000e0ffffff020000000000000000000000000000001900008001000000010000000000008014000000080000004e0000000000000000000000000000001a000020090000000700000007000000050000000000fe1f0100008000"/288]) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0xfffe}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:11 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:11 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000200)={'team_slave_0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000072e0b50c1416e3ac6b8bb9483572d9"]}) r1 = shmget$private(0x0, 0x13000, 0x0, &(0x7f0000feb000/0x13000)=nil) r2 = shmat(r1, &(0x7f0000fee000/0x2000)=nil, 0x5000) shmdt(r2) shmdt(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="0863100200000000000000000000000000000000b8800f7e7601e17bbc4cbb1aedb4233adc6ca9075a2fd6babd60c08bdf5eb7c28882a8eb9392653908ce5477a4e410a405b99f37eb01685ca9f8a154f6ee74f53cd3f4c7bdc648c18b968584d268bb07308fd422be2628deb027c19804afcd4972e3706ed9fcfedbf0690a81bff5eecd968b9e3ad72820"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r5 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000000240)) ftruncate(r4, 0x88001) r6 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r6, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r6, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) sendfile(0xffffffffffffffff, r6, 0x0, 0x2) r7 = fcntl$dupfd(0xffffffffffffffff, 0x80c, r3) setsockopt$RXRPC_SECURITY_KEY(r7, 0x110, 0x1, &(0x7f0000000080)='/dev/binder#\x00', 0xd) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 328.677174] binder: 15463:15464 unknown command 64 [ 328.688589] binder: 15463:15464 ioctl c0306201 20000600 returned -22 [ 328.729751] binder: 15463:15464 ioctl 4008ae90 20000200 returned -22 [ 328.758740] binder: 15468:15471 unknown command 2 23:02:11 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="850000002f000000570900000000000095000000000000001f9f24f7c940ce8f03da5def62a29f78f3bbfadc373933ca6c31ceadb6ff302f"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:11 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000200)={'team_slave_0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000072e0b50c1416e3ac6b8bb9483572d9"]}) r1 = shmget$private(0x0, 0x13000, 0x0, &(0x7f0000feb000/0x13000)=nil) r2 = shmat(r1, &(0x7f0000fee000/0x2000)=nil, 0x5000) shmdt(r2) shmdt(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="0863100200000000000000000000000000000000b8800f7e7601e17bbc4cbb1aedb4233adc6ca9075a2fd6babd60c08bdf5eb7c28882a8eb9392653908ce5477a4e410a405b99f37eb01685ca9f8a154f6ee74f53cd3f4c7bdc648c18b968584d268bb07308fd422be2628deb027c19804afcd4972e3706ed9fcfedbf0690a81bff5eecd968b9e3ad72820"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r5 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000000240)) ftruncate(r4, 0x88001) r6 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r6, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r6, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) sendfile(0xffffffffffffffff, r6, 0x0, 0x2) r7 = fcntl$dupfd(0xffffffffffffffff, 0x80c, r3) setsockopt$RXRPC_SECURITY_KEY(r7, 0x110, 0x1, &(0x7f0000000080)='/dev/binder#\x00', 0xd) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 328.782729] binder: 15468:15471 ioctl c0306201 20000600 returned -22 [ 328.988728] binder: 15477:15482 unknown command 64 [ 329.017194] binder: 15479:15484 unknown command 2 23:02:12 executing program 3: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x3) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 329.042016] binder: 15479:15484 ioctl c0306201 20000600 returned -22 [ 329.045371] binder: 15477:15482 ioctl c0306201 20000600 returned -22 23:02:12 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000200)={'team_slave_0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000072e0b50c1416e3ac6b8bb9483572d9"]}) r1 = shmget$private(0x0, 0x13000, 0x0, &(0x7f0000feb000/0x13000)=nil) r2 = shmat(r1, &(0x7f0000fee000/0x2000)=nil, 0x5000) shmdt(r2) shmdt(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="0863100200000000000000000000000000000000b8800f7e7601e17bbc4cbb1aedb4233adc6ca9075a2fd6babd60c08bdf5eb7c28882a8eb9392653908ce5477a4e410a405b99f37eb01685ca9f8a154f6ee74f53cd3f4c7bdc648c18b968584d268bb07308fd422be2628deb027c19804afcd4972e3706ed9fcfedbf0690a81bff5eecd968b9e3ad72820"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r5 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000000240)) ftruncate(r4, 0x88001) r6 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r6, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r6, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) sendfile(0xffffffffffffffff, r6, 0x0, 0x2) r7 = fcntl$dupfd(0xffffffffffffffff, 0x80c, r3) setsockopt$RXRPC_SECURITY_KEY(r7, 0x110, 0x1, &(0x7f0000000080)='/dev/binder#\x00', 0xd) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:12 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) r4 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r4, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r4, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r5 = socket$inet6(0xa, 0x400000000001, 0x0) close(r5) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x88001) sendfile(r5, r6, 0x0, 0x800000000024) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000240)={0x1000, 0x20, 0x0, r6}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000400)={0xb4, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000080)={@fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r4}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}, 0x20}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000280)={@flat=@handle={0x73682a85, 0x101, 0x2}, @fd={0x66642a85, 0x0, r7}, @fd}, &(0x7f0000000300)={0x0, 0x18, 0x30}}}, @dead_binder_done, @request_death={0x400c630e, 0x1}, @acquire={0x40046305, 0x2}], 0x1000, 0x0, &(0x7f0000000640)="66962521d840a2502da80bc3a569230d881b4728922aee30ceb25457607d29529af19961f54bed8e2e5bcffdc39f1be34571451ae01b3f639aaa9ae92ec1965c923d85376b0874c7b1586306645ba0a1623e4222bd2fcfcb6f2e40ee20bc61861261d7d5c21b1c8ad933cb4ef57546e55cd53752c89c2a9388a02e178839f4bb02090b331d6c7b1f3e3f62d1a036bfe6abb7059fb94bfa8dcc86c5c4c3535df315282cb2042df8430b9bac8009dfa80554d898516610599d0e7369ad4e700bebf58ba7d302f688b222ba1cc26f9837fe0240de4f9fb682c919c3891618338758377c4186ba4f52e7dabc7a38c94f90841fa93601d3a3bb4c030b04e4f6bcd1ba39d1e95d6fb08d911399fdce25158c58c7ddab196f17999e3104a0894f71756e5670514f9662080a100f42e06355721bccdf27c90ce23ac4b0bc3438f3c55b453b105852437d5dcf3b5eb78c99f85b53c4de7cacffc3b8c576f74ba29fd6da517a49b511b9f57d95add5316faaa1aa0b0dc6d588959e1da0313c3a5b02b7abef1f9c33370207c5ebbf891ded35298c9c21e18237fbed8a48dd97f880da8810ac8e0a512a7793b3bd0afca281bff07a304017a0f110ed011031a0f03d0996fb88d649c78d79ca1e3d315846801997a350fa1e2654dfe10351f762ae2ca7668145d931e47446d27261166b7b7769d34487f0f30c0908e8b4c9e812d7a375b1edfb68d58a9da8e9b629087a87e7320296d62a6c543bbe9c784e2b75297b82ebeaa089840af135270cdba527c4be8d72f978f52aa9443fac74f662e8054db918e6a890a5b6a46f1e0328b77175abf55cf9f70b47082d74458850343a72ecd2cb11c2eae90054eca214e66e82baf10cc3e4636dc271473ba8264b47022d91ecd4f445fda728cad4832c4cfc013afdfa1e9bf06064b71453426b609559734caecc851edaa718ed406fb53ba1419d5cdc7b2a73ebd12c0e59465e22ec4aebc23e20768c9218ed620c2c77da44fcefe6b34f7b575d0d9b902aa45da6dd606fcfba0d53a65a055144c05b01419159344f63664d2dfdded09dc0405f3ee7dc2f3fcac6c659af1ca51137002bc0649492e0831db641d30026f1ad0286c59d7228d5583dee8b61d13f5632464e9b0948379913bae9ece068d3aaa8b8f1269e2f3edcf215ca30f437b1649492944fb2dd20cf9d4a9c0551c6a68a472b6b0734bc556c68c71733c9f4a578de02d79ce9320897025f24d8a095036f6c864146ea0f0b0a6281313bd3be1208a944b2365b8ae291e75ff0c025247035ac0e48dc08303a2ec35663d700b9b7fa91b012a6be4de60c4509204afd565318b1f9352c33ece33d33b7cca5bca0e2e604d6db0cf81dba9664e92c845368a083002acca9177e57f19e5e3e9bf490449d98ef8f1c2ffa4da4f846aa7487dd3d4c324ba4dfd989da0ed87313db374e08483174fe6a3b8a5def3044f707714f0eb5ff38115c6055d29c777ea58c8a9b8ea0bccb3fb81de4f3416cfb8ee8aa88261f38359845fdb875deff9500c21ec4dc1a7c1b1907911aa6a7af379cbb240140b94c485b7d61898096808a4505dbdc634f73fe547481bba3886ffe9d419f1d3063145750031113ad8b82ecffad5caa8739977961e66eafce997c5bf926657d0352b51e3a151f61d89ca9cd078065dbc9e054b037ff4d7edc308bbc4e6f1e09e72b401a0146e0313ab9d756cc0a34fdab40bac5dfa4aeeeddef00181a3a682de71e8f2a22230e25afa66b582e292b7b3375072c77c8aa517c5210394f9fffaba497df03502576a246fb717e64841ca0ca7ebce786452077e6b68903e6fead645d628e9096eab5264d9c10a6d1891f5fb21be2771255594f3b85ecf3d60399252bb84519721c188db4ad4fc0a2e9eefbcce67a3977299e3107d8454cc2fda1ef629d5bdc5901e3c15a716e76914bd7c91377ba7708c012f46a03b437cc190602ce1151fac3f2e6aa91fbc55d8aff12df7462aa62f25a4b49adc1456cd8e015305430f1889f0016ac8bc0ae478cee5d17e197e4496decf23f3175e646d358470c65100bbfb76bbba3ea44f7a2f01763c481c52d17b7eb79e9c83c18fc2e6ca0376d17c6fb0bcab3baf83f713153eef87a36916341617eadf1b796055b19534e9cb1e0844f097ff9e4803fa974105059b7a63648f1a90f735daf8b0591c862da6fb97c77f113b93103b41a6d56a8a29e904b62396a9c8f086fbdb1853d2b24f2c0e3b345af2029d4b141d9e42b8eca94dec3c3a8d536a1166532acf4f93429c62b48ff321e1850b37840e04c5828fa4ca93793115946958b41b18ab5657e029be67f13afcbd46815e490e28259c356b494a28add91b2e1d7d9ecfdf75446348738feac9842a7f012c128ac56452ff6a5f24bd14b0b90311bbc543bf74b02b0f09dd02edf40c6cf7673d6b1002c4bae34aa5bd90f603339265f2b594395e390359328961d7e1ac8fe26744b2918a98b172770059127e279798153759b6a58b96cfccdebaf9d5780e0858d60640ddc7e2f177c0590bb4f56fed5140bfbf7e32f5940e3e6514a388a40ad1687e2d19cfc6085af73415695c2a80ff3b532889010d086afda8d5b8eabb4b816280ab46656a02536eae0bc78ca7b5003511333ca8e763976a3c6f8fbad445d60a32a597e50ca90aa05e6b86439c7992fc9e33256d65eaa0bc623a844fbbcd9dec13186ef9d624d01628ac2212db7506a7dd5585d5d7ce04de8a44fadca6f8b873bbe993d3430541f79e60f6c46221a9a6df91943d0e60890a6ada50c74f3752dc2b18896da7a03158aa6e800d9c3e1768ae8cd4552b102bcadd3d3531ae3b75bf1b7cd94f66faaf6d2f80fd86611ace8bab702f9bfbc6c58628e3128f826054201bd2759b5d04d93b2351c8a49c011fb74a63765238a952888c548260bfae8190caeec0f47f4db0511fe0835b27308ea2f83103e3c34cd9d766f4d21497ca04e64e78676898b0617121ceeda3b9c6c4e1c832308b5f25105ba39e93c71affc8facc6248323451c70bf9470076e0bf4e96635f3bb59c0830c21f6fa72953c7cb39c1f8bd5f566a90c4530c0374d6b798a63fe5cabe15e45004611aaecf5def92a4ea86422f23b40a3f5bddaf1c430a1387b35f2c3036078535298ff601fbf62fae6c52213907a1d9ca1fff33a98b6a500e3282f8b32c0fa16c4567a5116bd54c3f8e4ac23fae7548d9a3e85b52af3d0b55245fd021b2f6e568e15a0ffeb273a583e00e7f99eb2073da36d1f6343b57a40394cc0d74952a17c73f2fcec01bc96c3fca0f2e69acee66f37e9f9824d6a25425ca1927c45db1c71238f19d134d9e75314482d9c5564a4d32e9e52c79bcbcf16eacf3f3fe28559f2c7af736ebac12accb3295fa138cd6f56967689403a46c4078ba4a953dc642903c109cdfa471c227bcb37d1ef1bdf70f74e788cbd1aa42f31e624af9ca57b15839aa0be6bec0581a1951865b24b07942fe00389756845e24a3e8172f3992bb1e36aeeb8883622914563d4b3438e940a7d3a0bfc3828b9ee2bdd191cf8713a86e3bf4a44eff6719466326a17cded80c15ca18777a8086628d199514109a0da343c31e9ec5024b67b0b73ec8232326f4fe83d9e81e72105c2a7525743b8dfa643adeb487a9356b9e33cf2c2e39b514d682c225bf3d5afe23320acc9e644979d8a93420a3c136504c517f92a3588ecefd1ef6932687fe3e0c1a20b1641ec58c2bc076260c64beda00dd1d31128f41030180b28e43abc2fccbd9e73eb8f832ccef5f71cde9c943a2360d0b577b4f147b86a3a01ca3e7f6e500751fedc750d23e97ce6679c99d539bbf394186c9b3928ac9328a0887bfa0858549e25b8211aa59c0d4f69ca40fa2564d48f1062059638b59c7078dbf526932a0bf77a56900d0412a12b74357e9275a56c8b4b69ee115f1b47cb138082915b70fcf7658e15f92c3281086d4c736d8601917679fe743444e17e2af90cdab180c5eef64166b08692abc3a1803cffa0a68300a86c746ad432fc42e4addf831349fbbac665214e165b4b632c829cac099304a62c0558ede02beb2a25d2c8bf670736ba185cf72c50b85a4660040a3254a71d39ffa2f30fe09f60ff5f7581c30a0068e1471e94e97147b1ac8bfd24d03b79c58fb93e66d22a51133d2de01560eaff6065bd7147f4f9cc64298dc91a9b725856a31b9a2b78cb72c8bdab84ba6334a109d2dd6357ac7dbe819f5bd713f736bb322507c8855a59e714f3a3c5f20a7a40e96c5f34bab5e2fb62b95d7945d53d43b6a5d72f4c46abec740aefa301f29837a5d652b0fa06948d749fe16cd2eb6e97dd129110cb416001c062620cf6c2dcb2694ccff8ecf10d60f6c5e918b19410d3120b51cbf5aa3e1a9d29fdac7d75275a95afddc2896ddc0eb8df022ff1cf7a84dd62ec317cef3b961da705b4fa44b570bbd6407d47618ebb60285c0ebf18e41d82412e05df295fc0084283ff86f1535a69c48b57e6abee86e20eeba8f0141ac4e4a4d309022f3bbeafddcfe7f0fa801dace63b8324ab6ac8dca77f381d29c6efc5775fe7a7d0e0e89e5393bf329a7e5319f8af31db18d18d2ed01f0b4b0551d5aedba6ef8b4cbdaed68cc74012d0260279d099f357088727dd0c0f826287449da1b922d7e8abfd9a659cba28b8c5448d4a07a3b4a55a6a95685b718b3dd72b542b39efbf4b332e41219c3f6ae7cdf3c7eb7b374a31e5e6fd0e10cb2c4cf0e74087f85d31fe832ac3fc663dc40ed8283bdf0985a75b02ae51bbc89e322a10ebccc621fa47b19accf85684f383b1832aea81d5c87b46761b6e172615512767cbb70132503ef17ba66f398a2168e97099aa0b798394b665bc0b83a9c3c0fe2797d75a123100c2baddeac9c7bbca2c035e167eaa0af557188b8622dc606b93f98d85c4d9eb937104d655f2017a47f88430fca9ded45714f7893b2eff589df186419b8c199aa240bcb7318d8e45a0cf5506b9b6f5f93ad8fd936f5b628aec104d49ec91330e00c5825a9a640bec25e34c87a5035e2b6acbe17862c3f266d5c32a1e9a3165a2cf2c70cc325214df2bef72783526099d476bc9f2b0e17c7452611d8826edf343bda48acdfbf0b1d5be36c731d1ace72d17e7e07f8c7c5ae0839a4c1cdee0b738d2ee06ee235bab6c9f24c34890a319d1f54d4628419737f0c66f201a07fc12e593bca777dcd179320b13031a3504d12b3d2fffdb9c3423a3d3fdfa44acb55c44783ef48059348156413526812d8738d5ba6d9ec996caccf7ad99a6883b796bdb87e493aea82e27905ab04969495b045633f5ffc0377e4f103960dca1b33ed7e3b38074b8917eb2fede8e45e0ab601870804e2f439a40793635b5e919ea5e8afffc6913bb434d2a497ae6916bf6d2cdb632ab2f4a3642e4430a4ea93b4c1c6345d23aacca16b556b2986f427e3792e1967ee7fefefa0371202a3140482610ccf928932978c93da8bd8622872002f687e69bc62bb2ab07003438467b65d28acebe15c3e57ae42836829848deda66e6836bde2c589c577ecc37a977501873ca93d91d297c8749ded6a1d89363e80583345c1779a3a586ec9da57ffbfb44a22e610329c159c2d70372e8b2ac263524b53b049f7aed453b21d3b3815120f3474e817f865539961f1bbe4fa830c390091141e622fdff02c5cf4379b7c27c016b7cac4248ae9b6ffac19fb7faaafa86ad2dc16c99193c7f3b3b4172fd05261d3bbe9119333a2c190c62fc43623813ff9895687f5714f49ade1fad96dd7474162fcfbe61283782853d"}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 329.203932] binder: 15494:15497 unknown command 2 [ 329.209918] binder: 15494:15497 ioctl c0306201 20000600 returned -22 [ 329.216972] binder: 15495:15498 unknown command 64 [ 329.234167] binder: 15495:15498 ioctl c0306201 20000600 returned -22 23:02:12 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) connect$pppoe(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:12 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000007c0)={'vcan0\x00', 0x0}) connect(r0, &(0x7f0000000740)=@ll={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local}, 0x80) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) connect$bt_l2cap(r2, &(0x7f0000000240)={0x1f, 0x5, {0x9d, 0x1, 0x3, 0x7, 0x81, 0x81}, 0x100}, 0xe) ftruncate(r3, 0x88001) r4 = signalfd(r2, &(0x7f0000000000)={0x9}, 0x8) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/252, 0xfc}, {&(0x7f00000000c0)=""/80, 0x50}], 0x2, 0x0) sendfile(r2, r3, 0x0, 0x800000000024) ioctl$TIOCSCTTY(r3, 0x540e, 0x18) sendmsg$can_bcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="01000000000000000000000000000000e5855dd74126cdf7e232f9134e0b272bb27ddc37f39f4c000000000000000801afe10c12c1ce346e9edfad166d56e6739db6e58d8188f8a47414c457f27119b2074591aad467685e3c13de16e3514298c2a49dc753606f51a41f2e4733245fa32b7004c8d9b834a943e7bb0ca3d39aa540e37ad59b59874d948a443a694345aa188c6c31bbab923167c4b6780ca9dd4f0835e039d1404674f3002e", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="00000080010000000000abdcc1bd2dfe9a500000000000006084838a191749c2aece0e5ba77d95"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="03000000900b00"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x7530, @ANYBLOB="00000000010000000000000000000000ae78615d7a9c43ea0c4e20b8a6cf76c8a18a14c0c0c0501edcbc6266a0b95dc7372ccd82975f55ad7d0f880c6f76c79bb992925860801729ae9d3a8fe1b0a7fc"], 0x80}}, 0x0) 23:02:12 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0) geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 329.461395] binder: 15495:15504 unknown command 64 [ 329.468614] binder: 15495:15504 ioctl c0306201 20000600 returned -22 23:02:12 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:12 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = socket(0xf9583315e494ca31, 0x0, 0x1f) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000440)={r2}) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r3, &(0x7f00000016c0)={&(0x7f0000001600)={0x10, 0x0, 0x0, 0x21120c10}, 0xc, &(0x7f0000001680)={&(0x7f0000001640)=ANY=[@ANYBLOB="01010000", @ANYRES16=r4, @ANYBLOB="804028bd7000fcdbdf25100000000c0009000800014009000000"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(r1, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x11}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={0xdc, r4, 0x100, 0x70bd2c, 0x4, {}, [@TIPC_NLA_BEARER={0xc8, 0x1, [@TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x330}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2f}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x81, @mcast2, 0x10000}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xb}}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @rand_addr=0x10001}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x2, @ipv4={[], [], @empty}, 0x1}}}}]}]}, 0xdc}}, 0x20000010) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:12 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) pause() r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x81) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f0000000580)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10000174a3ac8694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde318ead4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d41f6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28b774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a800655d127de6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047526865c84f7cff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d8191643"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r4, 0xaead, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000000)={'vxcan1\x00', {0x2, 0x4e20, @multicast1}}) dup2(r0, r4) [ 329.748604] binder: 15527:15529 unknown command 64 [ 329.758819] binder: 15527:15529 ioctl c0306201 20000600 returned -22 [ 329.898330] binder: 15527:15536 unknown command 64 23:02:13 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)=0x0) sched_rr_get_interval(r1, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:13 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = getpgid(0x0) ptrace$poke(0x4, r4, &(0x7f00000000c0), 0xff) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000000, 0x20010, r3, 0x0) fcntl$setpipe(r3, 0x407, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) close(r5) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x88001) sendfile(r5, r6, 0x0, 0x800000000024) fcntl$getownex(r6, 0x10, &(0x7f0000000100)={0x0, 0x0}) wait4(r7, &(0x7f0000000240), 0x80000000, &(0x7f0000000300)) write(r3, &(0x7f0000000340), 0x41395527) ioctl$DRM_IOCTL_AGP_RELEASE(r2, 0x6431) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000400)='./file0\x00', 0x0) unlink(&(0x7f0000000040)='./file0\x00') [ 329.986246] binder: 15527:15536 ioctl c0306201 20000600 returned -22 [ 330.092273] binder: 15544:15546 unknown command 64 [ 330.108220] binder: 15544:15546 ioctl c0306201 20000600 returned -22 [ 330.136216] audit: type=1400 audit(1569884533.110:70): avc: denied { map } for pid=15543 comm="syz-executor.3" path="pipe:[55918]" dev="pipefs" ino=55918 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=fifo_file permissive=1 23:02:13 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0) geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 330.241782] binder: 15544:15554 unknown command 64 [ 330.247079] binder: 15544:15554 ioctl c0306201 20000600 returned -22 23:02:13 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) connect$pppoe(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:13 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x4, 0x84000) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0xb, &(0x7f0000000200)=@raw=[@call={0x85, 0x0, 0x0, 0x63}, @call={0x85, 0x0, 0x0, 0x10}, @alu={0x4, 0x1, 0x8, 0x0, 0x9, 0x0, 0x8}, @call={0x85, 0x0, 0x0, 0x29}, @alu={0x7, 0x1, 0x5, 0xb, 0x3, 0x0, 0xfffffffffffffff0}, @map={0x18, 0x0, 0x1, 0x0, r1}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff8}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @initr0={0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) pipe(&(0x7f00000000c0)) 23:02:13 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:13 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000200), 0x0, 0x4, &(0x7f0000000240)={0xa, 0x4e24, 0x80, @rand_addr="82d60756d3a5ae0f64bc7216b15a7f24"}, 0x1c) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) ioctl$VIDIOC_G_CROP(r3, 0xc014563b, &(0x7f0000000200)={0x2, {0xffff, 0x9, 0x9, 0xfffffff9}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040000000000500000001000097c2cf697660a29813cd3bfe4b0000000000"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r0, 0x800443d3, &(0x7f0000000280)={{0x0, 0x1f, 0x3f, 0x7f, 0x80, 0x2}, 0x6, 0x0, 0x80}) [ 330.597612] binder: 15566:15569 unknown command 64 [ 330.611225] binder: 15566:15569 ioctl c0306201 20000600 returned -22 23:02:13 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)=0x0) sched_rr_get_interval(r1, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:13 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="080000000000000008000000000000000c0009452421defd0ef8320000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x6, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x20}, 0xfffffffffffffd10, 0x10, &(0x7f00000000c0), 0x10}, 0x70) 23:02:13 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = getpgid(0x0) ptrace$poke(0x4, r4, &(0x7f00000000c0), 0xff) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000000, 0x20010, r3, 0x0) fcntl$setpipe(r3, 0x407, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) close(r5) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x88001) sendfile(r5, r6, 0x0, 0x800000000024) fcntl$getownex(r6, 0x10, &(0x7f0000000100)={0x0, 0x0}) wait4(r7, &(0x7f0000000240), 0x80000000, &(0x7f0000000300)) write(r3, &(0x7f0000000340), 0x41395527) ioctl$DRM_IOCTL_AGP_RELEASE(r2, 0x6431) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000400)='./file0\x00', 0x0) unlink(&(0x7f0000000040)='./file0\x00') 23:02:13 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0) geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 331.009121] binder: 15592:15594 unknown command 64 [ 331.023790] binder: 15590:15593 unknown command 64 [ 331.029130] binder: 15590:15593 ioctl c0306201 20000600 returned -22 23:02:14 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)=0x0) sched_rr_get_interval(r1, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 331.074210] binder: 15592:15594 ioctl c0306201 20000600 returned -22 23:02:14 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) lsetxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.ima\x00', &(0x7f0000000200)=@v2={0x5, 0x0, 0x14, 0x9, 0x17, "f36e3088f342b4e020ca0b5d71b0a8d8430080ed961dc8"}, 0x21, 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 331.196169] binder: 15610:15614 unknown command 64 [ 331.239426] binder: 15610:15614 ioctl c0306201 20000600 returned -22 [ 331.281857] binder: 15613:15617 unknown command 64 23:02:14 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:14 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) sendto$inet6(r0, &(0x7f0000000200), 0x0, 0x4, &(0x7f0000000240)={0xa, 0x4e24, 0x80, @rand_addr="82d60756d3a5ae0f64bc7216b15a7f24"}, 0x1c) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) ioctl$VIDIOC_G_CROP(r3, 0xc014563b, &(0x7f0000000200)={0x2, {0xffff, 0x9, 0x9, 0xfffffff9}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040000000000500000001000097c2cf697660a29813cd3bfe4b0000000000"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r0, 0x800443d3, &(0x7f0000000280)={{0x0, 0x1f, 0x3f, 0x7f, 0x80, 0x2}, 0x6, 0x0, 0x80}) [ 331.335951] binder: 15613:15617 ioctl c0306201 20000600 returned -22 23:02:14 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:14 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r1, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x7, 0x10000) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="850000002f000000570063c6000000009500000000000000a7f4b394ba7c3991a6d370cd3346582771dd44010abc3023949e60c7b1e460343094156769213174a6e4be6ac346ae4e66e3d9ef00a803c6767a7cc498066986714e6974ab17441a8316fd77cadee1b83321f3d52c196eb5d964608d4d90b56fd9773b"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:14 executing program 4: r0 = accept4$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @bcast}, [@default, @remote, @rose, @rose, @rose, @null]}, &(0x7f0000000000)=0x48, 0x100000) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000180)=""/216, 0x9}) mkdir(&(0x7f0000000380)='./file0\x00', 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$KVM_GET_REG_LIST(r1, 0xc008aeb0, &(0x7f0000000300)={0x3, [0xfffffffffffffffd, 0x8, 0x8001]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) ioctl$VIDIOC_QUERYSTD(r3, 0x8008563f, &(0x7f0000000280)) sendfile(r2, r3, 0x0, 0x800000000024) ioctl$EVIOCGABS20(r3, 0x80184560, &(0x7f00000003c0)=""/4096) r4 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) lseek(r4, 0x4, 0x0) [ 331.719349] binder: 15633:15635 unknown command 64 [ 331.739402] binder: 15633:15635 ioctl c0306201 20000600 returned -22 [ 331.774433] binder: 15633:15643 unknown command 64 [ 331.779417] binder: 15633:15643 ioctl c0306201 20000600 returned -22 23:02:14 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x88001) ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, 0xfffffffffffffffe) sendfile(r0, r1, 0x0, 0x800000000024) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000080)={0x0, 0x81, 0xff01}) r2 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) keyctl$set_reqkey_keyring(0xe, 0x70bf924309d0ec14) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:14 executing program 3: openat$rtc(0xffffffffffffff9c, &(0x7f0000000340)='/dev/rtc\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) r1 = syz_open_dev$media(&(0x7f0000000380)='/dev/media#\x00', 0x7, 0x44022) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000003c0)=0x9, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xf17) unshare(0x40040400) ioctl$sock_bt_hidp_HIDPCONNDEL(0xffffffffffffffff, 0x400448c9, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x0, 0x0, 0x7, 0x0, 0x0, 0x8, 0x4000, 0x0, 0x0, 0x0, 0x1, 0x8, 0xa5c, 0x0, 0x0, 0x0, 0x1f6, 0xfff, 0x0, 0x5, 0x0, 0x5, 0x2, 0x0, 0x5, 0x8, 0x0, 0x400, 0x0, 0x2, 0x2, 0x9, 0x400, 0x4, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_bp={&(0x7f00000006c0), 0x11}, 0x0, 0x5e, 0x0, 0x0, 0x800, 0x5, 0x5}, 0x0, 0xc, 0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000700)=ANY=[@ANYBLOB="0300000060b4be5d9dc652ba3763c6468e37cff17c4f734adc795732627182eb678f2ed0e016ea39ea4346010043c9709fc34422cb4b474ec9c06e99ef56842ef518c9c63d41e12eb9f9669dbdf1a01d8dc8bae2fa4aac713e98ff9c716ef40000000000f0815d32b5a877068f19ae7375fb2d054f877db5812904faa4266671fcd824f3af54344654d844f8457de1a40f17c5f6b979a58e03f9b3c06ce6df7edd38c7013592d95bb25273c1240ae1d3d8e9c469809a0fe7da550c7821aff0d96ea21b00cf03bb79a6d22da0898f2123486f1c192830fb16bcd3b23f62e67f05e42ee1adbeb7dd0ee5a6782b1cc298266f3c7c46e978f1909edf5aca6392fda226f8528d00"/273, @ANYRES32=0x0], &(0x7f00000000c0)=0xfe10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000040)={r4}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f00000005c0)={r4, 0x4}, 0x8) syz_open_dev$ndb(&(0x7f0000000140), 0x0, 0x4200) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x200e80, 0x14) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) r6 = fanotify_init(0x0, 0x0) fanotify_mark(r6, 0x0, 0x0, r5, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x3) write$P9_RREAD(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="1a3ce226d586bf94a52bee8fcc8c3acd5cb113fadca3758d612ca43ba496b1e7772f10dc1a2a5651467a657588cdd60b93c759fd72a0f1e3e4000800000100008000000000d82779937cc4733ec1ed1f1e3be5d815beedde3496d71099b3188f62763267114ecc3f5c3907ae55e7fca6c1c9342eca4675836f2313c550fd5f7869fa379a4c70d1a8a369db91b7ae7713ea7752eae4c459cfc494d4ef81aa1ad0f20bbdc96c26d42051704f397f3755d415b37738a52f854f69021f7edaeb67c24cabd1edfe73e3562e981e9ccf7f21f6b852ccbedb9a12b2e06885d8b7d57258169ce50d10f785e958ce5b96af32b203e76b52a5531e38267fa6a6576cfec3c39ff260aa117752f397f5225f55eb2c495a83495d3a79f74373942c00b731fc8f57eeae8330caec0edb78aa4cba60eb5ba0630b95f49a6f2dc03fc9bbdf74802a3fa707c7113abcb51e4cee937c68c31b62dac9e61ae549d2df2bd4d0a9dfadc9cbb5428c00a437527404e793dd13c80d896df00c9a0a20e45f279c0ddc919f87f1d3168c8e5bafad85a89162c9ad4c1a56481766d10ce8bdcfd1b227703b14a8862d5ead8d1ba7975d646c1359e091b293947bd6cd449d75103f53787f99fdf9"], 0x153) close(0xffffffffffffffff) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff, 0x9f5, 0x63, &(0x7f0000000040)="afadd26e7504c5f39e22000b0b9b81136075d19d7e724c84e17330c2b77f599eaa454d42859a1b4ae09d7840cc7d1abca1fb636017f91eca69b09982011b18b41ab97877596225a1c1143898b8b5175ccf09dd7b3854112c49ecc0548ee15a0d70237e", 0x9439, 0x400, 0x6, 0x8, 0x0, 0x0, 0x80000000, 'syz1\x00'}) socket$inet_sctp(0x2, 0x5, 0x84) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) 23:02:14 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(0xffffffffffffffff, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) 23:02:14 executing program 4: r0 = accept4$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @bcast}, [@default, @remote, @rose, @rose, @rose, @null]}, &(0x7f0000000000)=0x48, 0x100000) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000180)=""/216, 0x9}) mkdir(&(0x7f0000000380)='./file0\x00', 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$KVM_GET_REG_LIST(r1, 0xc008aeb0, &(0x7f0000000300)={0x3, [0xfffffffffffffffd, 0x8, 0x8001]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) ioctl$VIDIOC_QUERYSTD(r3, 0x8008563f, &(0x7f0000000280)) sendfile(r2, r3, 0x0, 0x800000000024) ioctl$EVIOCGABS20(r3, 0x80184560, &(0x7f00000003c0)=""/4096) r4 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) lseek(r4, 0x4, 0x0) [ 332.037125] binder: 15658:15658 unknown command 64 [ 332.048311] binder: 15658:15658 ioctl c0306201 20000600 returned -22 23:02:15 executing program 4: r0 = accept4$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @bcast}, [@default, @remote, @rose, @rose, @rose, @null]}, &(0x7f0000000000)=0x48, 0x100000) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000180)=""/216, 0x9}) mkdir(&(0x7f0000000380)='./file0\x00', 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$KVM_GET_REG_LIST(r1, 0xc008aeb0, &(0x7f0000000300)={0x3, [0xfffffffffffffffd, 0x8, 0x8001]}) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) ioctl$VIDIOC_QUERYSTD(r3, 0x8008563f, &(0x7f0000000280)) sendfile(r2, r3, 0x0, 0x800000000024) ioctl$EVIOCGABS20(r3, 0x80184560, &(0x7f00000003c0)=""/4096) r4 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) lseek(r4, 0x4, 0x0) [ 332.195364] binder: 15654:15668 unknown command 64 [ 332.201818] IPVS: ftp: loaded support on port[0] = 21 [ 332.207702] binder: 15654:15668 ioctl c0306201 20000600 returned -22 23:02:15 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/commit_penools\x00', 0x1, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000300)) fcntl$setlease(r0, 0x400, 0x4) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080), 0x13}, 0x0, 0x0, 0x1}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x1b, &(0x7f0000000200)=ANY=[@ANYBLOB="850000002f00000057000000000000084422734300950000780000000096818bc92165120f01e7eb52e8eaf0803c73af291fd0336bdb6464ba46fe29987bb6884cff6606e6a82fb0334183e67a1a2303983c6357de42877cc02f267a668b0de98305682223e22a4c2eb32e8a92058afa217dcdda3ba9bf9911af791641d39ca8ea2c3e7700debf4e894bac1113c02a8767fb1ffe74a9283ca6763ef8d54f5d65e3d466b73fa0959060cab93a26726e092ccb2da685b0cb4c88fabef61e60e8154ae8fc73534fb24447999b36e79787c89eaf10c9ef1f0a40425139"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x1, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) fchmod(r1, 0x100) 23:02:15 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/attr/sockcreate\x00', 0x2, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r2 = add_key(&(0x7f00000000c0)='pkcs7_test\x00', &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000000240)="194acc07ca4cfc873afc165c7a32a4f3749c3b96b9ef3767f77ff51437f90836ed0daa91567f66207afc9767c9c8c457bbb0276854c6cc586b6869075c6ef53a0593dc3d01d5fa88c51ceb", 0x4b, 0xfffffffffffffffb) keyctl$restrict_keyring(0x1d, r2, &(0x7f00000002c0)='.request_key_auth\x00', &(0x7f0000000300)='syzkaller\x00') r3 = syz_open_dev$radio(&(0x7f0000000340)='/dev/radio#\x00', 0x3, 0x2) pipe(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$ARPT_SO_GET_REVISION_TARGET(r5, 0x0, 0x63, &(0x7f0000000500)={'ipvs\x00'}, &(0x7f0000000540)=0x1e) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000003c0)={@in={{0x2, 0x4e20, @multicast1}}, 0x0, 0x4, 0x0, "209f3bce67aa37e6975007d99e96d2257139654b1cfbded47cd75cb0e80ccb19cc142197bd1fb0c5920edc7a2d96b666d8901df133d38027362f495bdabd201f95de82116378a3bbbbe8e17c86577330"}, 0xd8) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r4, 0xc0406618, &(0x7f0000000580)={{0x0, 0x0, @identifier="27a53569790f2c52b24870da8aaf5aa3"}}) open_by_handle_at(r0, &(0x7f0000000640)={0xc7, 0xffffffe6, "da4d98d09f47ff2088e026e88cb3034180c69fa3160a9456eb136394bc2abbebb1ec1bfc46e60c350bf628c8d468e9d38c12089f77e8620743c9e2b09970a9b098351beba51ec4585e074325cf394386d8c699560baf44fd43adfe5eb8fff10004a0a8cbdc46ce430882291deaaa56d8c14ede8a22484f3f0a928e121bff18e535e63dbe3b04b586ec0019fd2d5bbf06f3d140cfdc9063cb448a7c91c53cffdce9c8a297c131cbca76c0fd108dbcafdf499d788629b0d3d22ed70d225adfd1"}, 0x10000) ioctl$SNDRV_CTL_IOCTL_PVERSION(r3, 0x80045500, &(0x7f0000000380)) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:15 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:15 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 332.482459] binder: 15683:15684 unknown command 64 23:02:15 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x0, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) write$FUSE_LSEEK(r0, &(0x7f0000000080)={0x18, 0x0, 0x4, {0x9}}, 0x18) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$VHOST_SET_VRING_NUM(r2, 0x4008af10, &(0x7f00000002c0)={0x2}) setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}], {}, [{}, {}, {}, {}, {}]}, 0x54, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765726469723d2e2f66696c65302c776f726b6469723d2e2f66696c65315c00fed9a2db372ffd6381a120415666ecc81016d60b5d77fb4d4c0e0a61839fb9605508dd53928c12eff0a7153aa2aa9428239a8d6c92e035f991059d47ff386e"]) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f0000000280)='y\x00', 0x2, 0x1451bb76a7adaeb0) [ 332.524727] binder: 15683:15684 ioctl c0306201 20000600 returned -22 23:02:15 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) socket$packet(0x11, 0x2, 0x300) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) dup(r1) [ 332.571012] binder: 15683:15684 unknown command 64 [ 332.581118] binder: 15683:15694 ioctl c0406618 20000580 returned -22 [ 332.589321] binder: 15683:15684 ioctl c0306201 20000600 returned -22 23:02:15 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(0xffffffffffffffff, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) [ 332.686051] binder: 15699:15703 unknown command 64 [ 332.691487] binder: 15699:15703 ioctl c0306201 20000600 returned -22 [ 332.827216] binder: 15699:15711 unknown command 64 [ 332.880845] binder: 15699:15711 ioctl c0306201 20000600 returned -22 23:02:16 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(0xffffffffffffffff, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) [ 333.278617] overlayfs: filesystem on './file0' not supported as upperdir [ 333.393514] IPVS: ftp: loaded support on port[0] = 21 23:02:17 executing program 3: openat$rtc(0xffffffffffffff9c, &(0x7f0000000340)='/dev/rtc\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) r1 = syz_open_dev$media(&(0x7f0000000380)='/dev/media#\x00', 0x7, 0x44022) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000003c0)=0x9, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xf17) unshare(0x40040400) ioctl$sock_bt_hidp_HIDPCONNDEL(0xffffffffffffffff, 0x400448c9, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x0, 0x0, 0x7, 0x0, 0x0, 0x8, 0x4000, 0x0, 0x0, 0x0, 0x1, 0x8, 0xa5c, 0x0, 0x0, 0x0, 0x1f6, 0xfff, 0x0, 0x5, 0x0, 0x5, 0x2, 0x0, 0x5, 0x8, 0x0, 0x400, 0x0, 0x2, 0x2, 0x9, 0x400, 0x4, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_bp={&(0x7f00000006c0), 0x11}, 0x0, 0x5e, 0x0, 0x0, 0x800, 0x5, 0x5}, 0x0, 0xc, 0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000700)=ANY=[@ANYBLOB="0300000060b4be5d9dc652ba3763c6468e37cff17c4f734adc795732627182eb678f2ed0e016ea39ea4346010043c9709fc34422cb4b474ec9c06e99ef56842ef518c9c63d41e12eb9f9669dbdf1a01d8dc8bae2fa4aac713e98ff9c716ef40000000000f0815d32b5a877068f19ae7375fb2d054f877db5812904faa4266671fcd824f3af54344654d844f8457de1a40f17c5f6b979a58e03f9b3c06ce6df7edd38c7013592d95bb25273c1240ae1d3d8e9c469809a0fe7da550c7821aff0d96ea21b00cf03bb79a6d22da0898f2123486f1c192830fb16bcd3b23f62e67f05e42ee1adbeb7dd0ee5a6782b1cc298266f3c7c46e978f1909edf5aca6392fda226f8528d00"/273, @ANYRES32=0x0], &(0x7f00000000c0)=0xfe10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000040)={r4}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f00000005c0)={r4, 0x4}, 0x8) syz_open_dev$ndb(&(0x7f0000000140), 0x0, 0x4200) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x200e80, 0x14) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) r6 = fanotify_init(0x0, 0x0) fanotify_mark(r6, 0x0, 0x0, r5, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x3) write$P9_RREAD(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="1a3ce226d586bf94a52bee8fcc8c3acd5cb113fadca3758d612ca43ba496b1e7772f10dc1a2a5651467a657588cdd60b93c759fd72a0f1e3e4000800000100008000000000d82779937cc4733ec1ed1f1e3be5d815beedde3496d71099b3188f62763267114ecc3f5c3907ae55e7fca6c1c9342eca4675836f2313c550fd5f7869fa379a4c70d1a8a369db91b7ae7713ea7752eae4c459cfc494d4ef81aa1ad0f20bbdc96c26d42051704f397f3755d415b37738a52f854f69021f7edaeb67c24cabd1edfe73e3562e981e9ccf7f21f6b852ccbedb9a12b2e06885d8b7d57258169ce50d10f785e958ce5b96af32b203e76b52a5531e38267fa6a6576cfec3c39ff260aa117752f397f5225f55eb2c495a83495d3a79f74373942c00b731fc8f57eeae8330caec0edb78aa4cba60eb5ba0630b95f49a6f2dc03fc9bbdf74802a3fa707c7113abcb51e4cee937c68c31b62dac9e61ae549d2df2bd4d0a9dfadc9cbb5428c00a437527404e793dd13c80d896df00c9a0a20e45f279c0ddc919f87f1d3168c8e5bafad85a89162c9ad4c1a56481766d10ce8bdcfd1b227703b14a8862d5ead8d1ba7975d646c1359e091b293947bd6cd449d75103f53787f99fdf9"], 0x153) close(0xffffffffffffffff) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff, 0x9f5, 0x63, &(0x7f0000000040)="afadd26e7504c5f39e22000b0b9b81136075d19d7e724c84e17330c2b77f599eaa454d42859a1b4ae09d7840cc7d1abca1fb636017f91eca69b09982011b18b41ab97877596225a1c1143898b8b5175ccf09dd7b3854112c49ecc0548ee15a0d70237e", 0x9439, 0x400, 0x6, 0x8, 0x0, 0x0, 0x80000000, 'syz1\x00'}) socket$inet_sctp(0x2, 0x5, 0x84) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) 23:02:17 executing program 4: r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x0, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) write$FUSE_LSEEK(r0, &(0x7f0000000080)={0x18, 0x0, 0x4, {0x9}}, 0x18) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$VHOST_SET_VRING_NUM(r2, 0x4008af10, &(0x7f00000002c0)={0x2}) setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}], {}, [{}, {}, {}, {}, {}]}, 0x54, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765726469723d2e2f66696c65302c776f726b6469723d2e2f66696c65315c00fed9a2db372ffd6381a120415666ecc81016d60b5d77fb4d4c0e0a61839fb9605508dd53928c12eff0a7153aa2aa9428239a8d6c92e035f991059d47ff386e"]) setxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f0000000280)='y\x00', 0x2, 0x1451bb76a7adaeb0) 23:02:17 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(0xffffffffffffffff, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r4, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:17 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:17 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @local, @local}, &(0x7f0000000240)=0xc) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2a07, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x0, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x800000, 0x0) ioctl$PPPIOCGDEBUG(r3, 0x80047441, &(0x7f0000000100)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x30020100, 0x0, 0x0, 0x0, 0x0) getpid() r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r4, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(0xffffffffffffffff, 0x1) r5 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f00000000c0)={r6, 0xf8, "218c86ee2a4d6c523333a272f6580ca00ebba0e56ff84c0bb758a78bd65e553a4abd479fa01e21cf8f46f59803bffe0747d49547c5a6c47bae1c3eea4735b57eb0d0d74e714eb1a11c3e3a831bcd00b1273c094bfc2306f60f44666633c0240876bc3a3b16351ddf41267b876821ddee9b4e9d92fcca5ddd6ef004e8366a79504c7837c600a1c11392fd7a5d231deea1c004ee2e1520fbe8c4770107b2cfcc0c6f350365a58c37d7ed7896a7b380705e633c2f50923097a13d49d8bef3ca3d4b0d761b57387667d0de6ba958e15367acc37f4a98598e60272bebad821e575655883b851e8e29775a7ad952eb600db48083fa44e152ed14db"}, &(0x7f0000000000)=0x100) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x9, 0x8, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6ef479d8, 0x0, 0x0, 0x0, 0x20}, [@map_val={0x18, 0xb, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x80}, @jmp={0x5, 0x0, 0x7, 0x5, 0x0, 0x50, 0x8}, @call={0x85, 0x0, 0x0, 0x22}, @exit]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0xfffffffffffffde9, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0xe}, 0x10}, 0x70) r7 = syz_open_dev$audion(&(0x7f0000000380)='/dev/audio#\x00', 0xa959, 0x10000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000040)={r8, @in6={{0xa, 0x4e22, 0x0, @loopback, 0x46cd}}, 0xe00, 0x0, 0x0, 0x4, 0x100000000}, &(0x7f0000000100)=0x98) getsockopt$inet_sctp6_SCTP_STATUS(r7, 0x84, 0xe, &(0x7f00000003c0)={r8, 0x559f, 0x5, 0xbc5, 0x1, 0x8687, 0x7, 0x0, {r6, @in={{0x2, 0x4e20, @local}}, 0x80000000, 0x9, 0x1ff, 0x1, 0xfffffff9}}, &(0x7f0000000480)=0xb0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r10, 0x0) lstat(&(0x7f0000000080)='./control\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000280)='./control\x00', 0x0, r11) lchown(&(0x7f0000000140)='./file0\x00', r10, r11) 23:02:17 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, 0x0, 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 334.576076] binder: 15736:15740 unknown command 64 [ 334.599355] binder: 15736:15740 ioctl c0306201 20000600 returned -22 23:02:17 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x85001) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="8570f1fcbb553acc1d00000000000000000000f100"/31], &(0x7f0000000000)='syzkaller\x00'}, 0x48) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000200)) 23:02:17 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, 0x0, 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 334.929511] binder: 15772:15776 unknown command 64 [ 334.936506] binder: 15772:15776 ioctl c0306201 20000600 returned -22 [ 334.984744] binder: 15772:15780 unknown command 64 [ 334.995159] binder: 15772:15780 ioctl c0306201 20000600 returned -22 23:02:18 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) socket$packet(0x11, 0x2, 0x300) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) write$selinux_user(r2, &(0x7f0000000080)={'system_u:object_r:initrc_exec_t:s0', 0x20, 'system_u\x00'}, 0x2c) 23:02:18 executing program 4: socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) execve(0x0, &(0x7f0000000900)=[0x0, 0x0, &(0x7f0000000780)='system\\&wlan1!\x00', 0x0, 0x0, 0x0], 0x0) clone(0x20000000, &(0x7f0000000300)="ccb60eebdbfb350b8a8a87e8a1c38df13c854346004515e1f4d588fc60bcbd6fec30e6bc0b2185dbe65e72950ac23004ecfb63d65613d36f6014ba6de6862b389712774728fd34e974b8a337b18ab6f2d31672593e68d23f6f5d4bf0f1b6d11548b6944c312983e7975c9b", &(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000940)="3a0257677c0fc5f362fbbf0142266cfcf48fc2eca4ba549d5cc9b448fbabe930d15a600e0b54be3863a118a395048b766c40eb374d6c90c13b37d34f679ba733727d351083b31a80f5eee53c68244ba8ff46fa2ebf698b54c25f59924b3a6be0a6878362a9c52f2c8a26efd26f7c869954f16f5d148ffa77c51bfcc210dfb6d6c6367b72f887905e4a0cfe86a14bff28d63da772127ca461930b9142dd95e9bed5b8b71463926259eeace70e0541b38a8cae5c82ad062542e2833386bb152b7b865073eabc784e93fafaadd8b1f925e75b5f7d862431afa0b225ba07b2d923e3400dbaf94683378a759ceaf4097754fca6f9cce12e266e9dde64fbb39905285f387878d1ee0affb0cb29685ad331db0b58af4c8afebb61b7ea050562ab1928f27e7916644f8c91b0581bf17a4ba9793b497fb80a530a7350107af8dee6f92a786416366f2f86657e12e34251738c47598ab3c22bae798a73d0f372eb15060bd46ac2eab223f3b9ba4ca4c4e9e1c0d2884e61b30d1e6476c1b92d5bde587a2d0c6d392171df9964afe22af39a496285f3b4f4e42f414f07434006ba94578bb66d9dcfdd3ead66fe51a678c040e93665c2c71d33d2d41553a3176309be0c4cbfefea105b3974455de7cc607534307fceca43318fb8c08be70284472f518700e1e863a40f2fa993ef45e65eeca8e20c45ef9a4ef895f47c8fc214fd848bb797699182e93fcd274408637267605b6f5674158f1f3583f273e5e60e3ebe721c0336c706bc86a39dd22ac2cba472ebe8d752c004f5c13e6183750668fb52a304019c4d52bbd9f6732649e3ae5b6aea95b70e732ef8626799b26efcdaaec5f3899b4a825ce21a3f3a736ced6f90f5b511810200632dae8e6d7891158300edc094cbf0a4e2af6fbe61dd9cd963d1d1f1e3e4f1994c59706edd705aa0e6b5795b35f195f771e90568e35bcffc32264323b9a233b6b397fe9ca839bac0b0ff0b0c7a54160b494b80dc980341ddc90735783b92e513e15a6e6fc86fbd2202c9238613e6569401bfa3883f50e9320f82ced19c8729b8260a1722ac4ef5825177a0c93ecbcb1ba851635c2857d57d6efb0b89cc6b21f540df6cedd34d86eae7a6ed1c709bd2fb650209f2fc4107dfe0bb16706b41eb91278342aad54d72dde786ac25c40cba92cdbeee08c2980deaa252f05c1b59fe42461f9d081de1c42847a90f04f0bd1747eca7c9507198623a264208982465a6a231a86c19fa9c2a57f274f3a0ce3a7380797991fe1aff28ea31757a386a0e063a249bbac2c9d52dad545cb0b8ea0e5c55b083c99ff542ee6d842907ede77c4b1fab3315b3e16dcea0f0a4115829c5769e789d4a219062f3066575e9edcc4ddd656cfd589f400ec5fb0b25e58ef3689f524c02cb4e092d1fa04df6646ce898da0a89e5efe4d747942a39c917255c53f4c6880348c488aa9f9cfb11b88a00a38d9239db2337717bfaede177b917d58b5b0c069b19e1333134534b5cda1d9c3e66152cf5bbca7de3448c27100d9d714c2a4f3537b3eb3ec592593bd42f8f320afc54e1c654e384515b21e726dda8f384eb812b85ecc44d2645378fa8047e5a65d2a666212bbcc4577f7078e5b4249c5a2dad5fb74c0aeb255ef6fc645fdb7721fa77753bb8f3828f0690e683187f3a065c59f5fe912de913b8db08bf47466ff9818b4e12ea6252633fc81b491c908931ffa701c57350274e5a3d31e55a23d92bc5d9cb272cb8992278770753367eb8bdf2c015dcbbb97cdde729cddd16c972e502ecacbd71a8be63ce0656c7519a5e7d904bf38f4dd240a743c6507cedd0c79009a75e869ff1fd436b509b061e33de17afd7ddb9b8bb3bb359c3f416f0f5a9ba9f3c66740be151f054371c6ee3ee04f2d367d5d07dfb1a6716540ef6e1a9249a05505a4d5a5f393347e3d0dc9e6d5afe25a4a544227c3a59cfc91df2b0aa14157a2b609873bf12d3102cdd7cc4741a2c6038a9701327fecc375f2c8e561f6688ec5431a16122575e02467ca98a23e832b4c83664437a8b8f7aa9e3d6df34d93948a2789306af0fae3cff8417c3370386406e3218635cfbb59d650a23e241f630d430506edf6dec52a54cb12486295d4dac3e535d2546b7c20ca9ec818ca18cbff7165bcf9e858eaa8a3c857e9500d7cf3ab26f765d66ebacd1522f5db53816a99d3b7f09432e3f0e48346a61d416953d2e8245a8a73053f14ad1c685f3ea80bc7c1cd43559f9ca01af64e9daa5e45d490dec3f32c2140f7090a12d81dbcc86defd5d4cc4b55542ae924f1d261b3efc19618d53a311e20ad9cf43f589669f10e8905e7fc97c94f73447b041d70a85366f2281c77979a6f146265c89b89a61b380428d2d643a910b42585f70392cc76c90d7228ce48da0e7eab73e1bac38bd2de487958e8a47c7cce7b162d0c17fd3b8c4ba7428645854d555e5cba889961d9cd62da68f5ed528b47a26154abf487f9b23dd33e89c79cb924b48a2b11100fe4a57c5227a0b50a8d6be53f22c0501c6a7e918ed15edfd8899468693fbccc404fa595a89c45ad8afc92a75ec9c4cee3e6915509f01f2596a7c9a4c7919c484ae425a17faa971604152cb685124fc03aba7737c91f890efd6d6b12a7c41ffa317c96035baa9b0db8178dd76e7697e1b394a172af0ec9a97f5fd8674e2cb0bf6e3ce06c1bf13f3940f2675296b4913bc44b6bfbf6e183785b84851f83bc731ccb440d5ac89f5d25bca96467d43ca6ca69e5386e7185eaa5f54f82196675551e3516171e0316fe644c6d32fce881aba1993bb53882ddab10782219bb0cf54806b93e933f01b0d9b246a27e681c3486dfdb04afd0ed616a385d3f4ecda52a4a0dfae0888780fd44abfd0299492c54b3c34e830fe1ffc86bd86dc38506736c90b39dafff08b91801c9c0c36d5460baabe04c88b3ac78da128b6d465678f80107f8de46e3d46a00de06046bc22e7fe9da0ede2fcef996b57cfb818035e7455d3b09d906a9e8ad76196157e8061eeaffbd6007ae60412a4300616c62d4930a6441eb732e2e753aafa2fc8d60445badf44a0218b21fc880668bb24e7017046eff03dfe3d0133db93a471304fb9f7b5e1166c1629fd4dc2ebbbb8e66a3b27e8abc5a5392d7c50e334dd13ffa1038a70b48d718fe06ac2fe34d481c94e9fa372c41180592a7b4cb108f75746ffb6684cf1a65f06a2030bb4b795864116b04e420b7be2ceb0308c8b3c3a503490164c4b4a8cd0674b3edfaa04f461eaa6bbe1d3ad7184f962ccb894ae86ce8452c3e9b237f748def29fba65b3f5d87072611ca0ef9441dca09fb9e156eb77506b4e8b7dd93f58ff29074c702e3d86abf29105c4990f9e9e3839c2111377a7778fd65751a05ad4774579838b9fc55e1faec506f4e97cbfdbfad3418ed7ff09b6e0f1a236cdf2325d20483387549d539a457150bfd4a4c94f64e638f63278c8fd76b269c16becf3e9a6b07dc5d32394470701e374f7e0b984df8a33086b9c96395e48b10e5129e0df8344a741d0ce7409fc27786d3cc083545de62b8212276990efc3c90fbcd8cdc510e93bbbc9407c0f8e50afa4132372134678af94aa8af051d85c2e920c782280213718a4e9e69aa52db1adb3a19c6f22c9bd1f1119eb3828bdd58a69ed678b18b5b555e56f608e50a6ee74b807b763dcc72590d5724e1a439858e3dfe95c91f1269eae8ff7fa704a445729de217a1e0607b17f5c4578fc57d58723cb10d54486cf3659be97d0fd84afe03d8d1aab93af773504140cbb626b56830b119fa7808867349ace30ffb6dd1b478022464d7f16cb5e8ed49435fd995768584f5d7492ab4c537fa44e0231e101d526be951c8a8354453a55266a3912c869ef936fcee1346be49cd73871b25d67a87957536fe112c26a97513bff974a0d42e157b1dde20f765a6e32eacd4b50915f0ab8fff9d60ac643c5cf5f3b71ccc9850690ba80399c10943a9b5063705b8c0044d957b2b14ffd721b4c81fde63ba8b8226240132b508c8cbb53e69ab586c861484e7b6ec1b59401675eddc7a68d070f3a655f66bd06e0d3da486af99031f3e69aee5bcb2a4222b329eac9482f006191a3736bf2e16a45e75c8450a762a313b75ad13c95cfa75388cb084465554f4799927585638a854f319bb70ae42bd4cc7224fba6e18421272015f1b9a750212ba6c55a629e4ca81e18cfbd121be1f02b5c2df25ffb13cae50e64931bf67ac0b85826c7196a93cffcd7d1d91a858ae8d7cf5dd90f2faadb07ac7274d64127934e0ade474a85cc025af5f1ebee8f9addbc5e01b5fb7a2c46f5ae51a1abb3cac202fb2175a5f3e27cbb440999f2f38379ceacf9fd7174051926439ca537e69dcfa43e0f950338923493a5b4eb1af506e36321265e22c4688936b80ece7a4f2ba44a917004264933d19ecfbc319e5ad635ddb6b44e89d179047e8f6885d25a4a698d2279a7677d4c4c7a3b5712d163ed5db20e44450fda14aa2764f8756f89cf20799d214839c7ad845ca86e3a68d2b6fb3dbb529a2ce94052abdf060d062527c32cb0520d5738d2aabfd6b00dec2af194795585e6d481a5545a9d7414350f73b6774e283ec7a381e3013eccfc63187a29a0f6e54173ad190b0501ecdd947cf0e06be3e1fd8190b71110a27ba2738d1e43dbcf2d2494c99c9860e9ca8621ec28f14515ad5f2a8e26799a75539fa3dc94cb9729bab7922f7736c2f5992f042c064be2be3f69cc52a870fdc31bd417ea4404771d966205e44a549f2af6efebb14013254578d83c04d4dee4a5ebf89bc69fbd04554a70fdfd53fa14649e1c6c10269fbbe4466fcec26e8a99b82bb8e843b6d769d1fcd15a18cc4abf9587d910b89f9615d47185593b2aa137e3b7de1025109882c1ec9cb6fa7d4185c4064b010f60bd0b7821b101eaef20268628700697561baac79fadd9827af55de8c07a551b2b53251dc8f0d8b6ebea3bb621c5bc98b2876dd22065d3974bd46bcc471162b968c2c3336b6ba5fd32693ca0b9f6c2bf50bd5290de87de05b1df3225943449c4ae4ae9a0298fc3e172bab130a6dca202dc544e72070d5a3d580b87ff086e961d9c4d24bef0d32125fe740e93cfb4b58e14dd1b40974f98762db01d6f37f2163f7d920f5665e0e8d2e6a54a9116e57f868efd7127fb7453694bc98d354697ab6688a2b826cbef64e07a0f3e1efe910ff089f54cb5e2b7e3d4dc95ce355e639f85125a167967ff09ec4c5fef7381a2cf169b03b73c33934ac1c5615a45b1322e3cc95a29f2c512e5e9cb1b1142f5a5a5d8443e73bfc6aa837bef6db08e0bfacb5100e43e236e062b26cef530b5fb92dd4378dd616a62d8cbed61124e332c914e8bb92b248e1a592d811ba87dd907b0e418b5a67d16cd9854e550de4843adc01cea837d6ea59e35bfb1af70b5e233805f3b58289f6f86fe106835cc572645dceb16b954a376b1cfb1dc21594a53fb6c8610473c43090063803b310475fa706430a66f80c1fc3e19e050883d529811ab7f358259613c7bf9aa846a478f141837d2a877d4121f87260279e2e53ee0d5e973403220cb73de5d1edb173c05d74e03bd163c6cb38c1eae098c44d958ea0a754de38a8a78acdb6de45441ec8ae6636d54102ac14930146f981ea0a906453e4df8cdf9ceb07463c30f39e4e080af5e62b6cc780022ba2e956df2058826db46f33d81286ab53af5c91ff7718e8bb88f0b4a7dda8eb1d2efbc14f68e98f605123cb65e233bec102bd053aac2a16c842409bf44d6c01e9fc8cf824306766570b3b457") r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x400000, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000080)) bind$inet(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x11, 0x800000003, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vga_arbiter\x00', 0x200880, 0x0) ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) write$P9_RWRITE(0xffffffffffffffff, &(0x7f0000000040)={0xb, 0x77, 0x2, 0x8026}, 0xb) setsockopt$packet_buf(r2, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r2, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x10, &(0x7f0000000240)=ANY=[@ANYBLOB="74727d6e733d72646d612c706f72743d3078303030303030303030303030303030302c72713d3078303030303030303000000000303030302c72713d3078303030303030303030303030303030302c73713d3078303030303030303032303030303030302c64666c74676945d5cf", @ANYPTR=&(0x7f00000029c0)=ANY=[@ANYBLOB="7f1b72078034b199c99cc143f7a54724e94da0e499a47b610dc8af52d42401df9f964d58b8bf2ffeee7011455f8dd87c2bb23cea9706c910acdba750671be50e804500acf722f370489bd927722982f6f435ccea48b050a14111e30015118b018fcdf8e8d0d1f0c59b252fee042e656fbcd91c5a76118db91599bcf1b27802acd59f0720c32f5a473f91e7e9528115844e06338cd90a2dd10f23b9c983256e06391572e3568c95a281e8468ec10c4501e336dd4790687c8cad4d639e49f4dfc4e3542cb24c12eb15a8787015c5dfe4970792ee6ba8d774375a094f9d6d72f3b3e4c98149486be0bbb62442f23e6d438c5c42b87e3401f7670e41ce2ea7eefd404ce627803d3a7f20e0279292b26c738ef7ab86b2daf6bd48030f3841797dfe6cda462ef4b1d49b73493e863f06d91b16732276fdfe28089463788aa063983c224dc785b0be2ac2ca2c73291333e11f2d2f5b85cff5768e59134020af58a82072097c9c31c72645c08ff5a1e9dbc99d26414b933b8cb65979a549009f11d5977a31aea72ca48847c61d40301005786a8c0d0270abdda3b0e1ab233e0514a5ef8a5f034de080b699d92d398ab522a17ef1861c33256e8c7bfc4ac8d1f7f57cb0f43f28685ccfcf1fe36ee2ff50b197d0f5039cb5517a91a05336a3525c005edda3aa419ec98f2bda8df412862c6d5ce496e187afc90c7f967e84c42eb84e60bd43b912821e9cdb94936897fe99da3f9b19545587c7ef5dce660c4fd84e49daaeaa7facab38104be80da248428fc0e616638d5c0371221c96314dacee2a3d258fe8c2464f1644774c1eb0ab9e9d52f7e71d352c5a261fbaf5c853ed4ef8aaa3a29f48a1620603a60f57f6d48417549fcd0ac0aa6135d5438752883f47760edca83cbc8fa34bfabcb547e9b78e5f2de951c32c6e983e326e99f3a2c591972beb87ead20eaf67cdd113f97d844bb02e979ce3bf2cee9691d158dbeb1039a0c7ada30ebf7f0504f75f5217217ab6d6265aec6cce5c83df6e5c88347c2ad4b2c8b443a5950abc7880d5d9dfe51d79a5dd15e32ba9ddce78d3bdfde9b1addc0a51db631eab536a0555a2211867ca53efc59361a17a97591287196741e0cc35488db9047f6e8007d4dada7276df7c649e2d2d71b53d6e18540f85824216f2e6af01b49afa2c0fa64cdc02d84c55909e2d9780b2ec2a7ac484173bdf5b607ed9468c503833045dac97619fdad5f0e67f01651e329a4bcf533cfdc0ef13672f16fd95530ca851ee9e120a71b6d0900e7e4d4f2af31b5f328ca274035018bf7458f2f76a0c9f8ab21e5769f538c667cbd8c5784b19b64658dda4de5b2b263a9e33a4594f0aa5605b5db6bcd691e8d08dfa146965d3e45a52ba92bb50d8f860221ac8acbdd41d1a75882868b523a575ad3bda2a334151a806b6991b31b7840323228e4bcd9f422ff7be4e2f6d972b223b63feabd0cde93bdf78d992d19e6ce039c2486c7588a1cae3f329e1a7fcd524e01ce7df5eae071b23d282667a2ea80731d864fc0ad01cf7dc37a780e91276559d1e530be54a7b82dcd8b2cb72815c118449ed8e55c46bffad99615faccf47f35e17b485276a8d898c259cf42f06e724c934c8db13c9b147f6076388e5ce925ca9bed7e4abb699045460c12fa0a2047d7f38bb73df12b561af49d119c02100c45e11abeadf8842cbe5d93d125ebe8bb3b6c483691bea6257a85ee14bedb321fbbeb688432759ca50c19133f944291928170408f012a19073fd9eb54e7098c2b0ef8147b2fe80018cb3b4bb9602a9c56a064466c5b11e145f576e836b2f2a34084fd45125e7b05f6e1d8e4f1f8848823b5bdb2aac4fdf8c6940e37038e4e8c0e69710e8a258e157fe4ec261866adb7900f993e59c23034412d89c52573f5a14c680d6b67adf367af9c5540a647dd3c32431a7702e6e04f5ceece22e55ec8ae92665730e81eff73e0259c0207ac7eeb01328a6a56d89a6d80e9160ff7767a6e563896762f64dc806205f4b17e90b28e5844258bf8b7ea6e3a9aaa03cc307edf8941bacd03c25cb3d2f2634610df81c817e9ea49dfb22128c9f787d3adced34ae7232b729a19bb53532aae55ba13b011a5011bb4bdc50cfaab9efd49ba4af15ba28a6655332e42d01c300a012b99e89583608e179b2be9d0bb4aa0b1db1cec8119042cbbdb1df68646c3cfc4cdf965565d23cf32da1308d11bacbd44a26b17018103670458f803339df23d29ec011dd49e3005fbca67776fccc87762a17a90f51263bd3be18dd74ac4bc872b7840ec35e37e90f22831a226571b7138477fca9f5ff882f5341fc583fd447c674fff4586b23e9ade0840a91c222f682a2c8779d1291301086031c91c2fce013c77aa610ad163bee646dc669bfe35707cb01fb827d82a39564a5d6f928bf815d6baf4563ff7cde093a260091caeac888940ddc400fdf96522ac566af9c19c515726ae3d45977a7fb933c6b4dfc2c390e6e4170ce5dc40fe9a0f692e9d3ff19b0033c47b492396162d93345998fb10cd1bad3da9f4db648b4cc583a0069f18de81d7c6f5a7bc754c535d89c41bf0cca1e483a92b7502388c43754fafaddd24cffcd8f4fcb9830143e61573110a7377dd9200f59d38d39644811bb277902b080420c2cc06e7a576ba2997037f1d404b94bdde6af43ccad0c3b340934799083ff07330cc07ee551dbb2dca32088c17fb8b7fe59e8b53e0233d1503866618f10e457080ca4f09d0c2415aca90760a39a98336a06d4bad72eedf16943a340638538626c49d4bfa6af2a13c4d3a9cbc815a1afb2583a2f8a64f0ec8a2a1e3f9423abe9035bfc8d5338863bbfb46c3fbd2d7ac48cd910c837e3de09f1e105726d5b7751f779695552a01dce741e9d76937e9f56740a294049aee5329efffe82c9b6e66edeb3ef5c1eec5be5b0ee6bc7a0e16ec7c50ab11dccad7f7e67d08ed1736af225bf843bad0862dfd3a08724a5b4cca6e7a37da409f43f966871458533d3a7d78f92bf98b109961bdefad058332dacbb9ef4daf5d1ffbc23285479d89b5d1001052b733c141608a13adc659645345c574a2de57cd88f1bc120425cd65967e55257780f3632983f61f078c8ae622d16860f6fb21cf516d8e0e22e8a1eb3ab6b0d50b779ca33f2c03d0f75846509b21b98bcd968f2c9bf2fdf7e54c02ce8a00fdb16afa7b0a5527312d07195bbe0618aa64db17af80f1e84480d3edb452f3b9e40413e33eabedf73d24276b74ac555c4634252f3fbe7d7f63681744a18c63514db0b05ba6e29bc27b720599f90c96d923e7a7cbbf3ff3cb53e86ab169e07e065f6e031a8df0a9573a912bad21d8bfead78606730529971184b7fca3371f7a4cd7daa24eb31364355a16f9bb6df14e5e07992636d5fe667514ae73635d0c124ba95d91a6335709854825801f0ba97a8282e4a3fbe2b8d3786cdd88ed6607418805b25d97db01509a3592378746c7e91e5be7266d1e2c36bfd8773ab9f41b013ae59933c2f20964d827b7953657bf2b865b7ea3767bc96e1fefb7219a9fef68db122ccc899e7d71b9ae1bb217549ed6859c7da70985cefa785456209d7f64bf046e2af59556a961b429af5b6453ce9cad4d1ab4713eec1edcd643b861af8ad4a8d26cf8c27b3a296020afb551d16e1dcd7c48e6440e9f88dad14424a77de25ed187b41d678484737c2f0fe3a18555c345a2a83ba427016ee747d9af3c0448ae776ff70dad085a5398ee6c09e67aa04764424f1b54e2b7be42988406e9938a8cacb4e574553c97dd2c337fad6a2fc71a392825ae4cb81011e18d2e9298fc22e029a4eeecf7b6b34f017736e60b37c1441be68ffa27e86a4549f0bca69fda7402568755132ff82ec5a87db824304d26e5dce4d4d6e31011f5270aacff22b00d903b96ae25e737bd39f8238d7d7afee3252e4fc4fb1457276f2ddbb2417f8ceb1d3bab03feaa6cbf42e0975bd2bb739246277555161764b816ffb25c87fd5f9e854d72489241147e0812addd9bfec23aac9e34900377ef172d176815fbc8206b7f0b8ee743615e53b6c9f7d85d7065740b093662dbccf8767cb80cf2eda804791fa759c68b7a400508ac0b7f4523e859a4f4ab85164d5b85d9c70105b0bb62edf1852502aab2377e8a29c49e1dffe63a63a0946ca13385205321149e21174a9ddd79a72b402c3d61675c72a8dbc461ac0dc7afbb51f2114dd4c3b963da2d1ab20e2be698cead3b5c9faf60fa68148128d209ffad8be91e5ea3da46e12b714c6f729f2a867b1a3a19973d5c9acc0adc3a9013204aaa18a01b3726c5bc7ae372407b3ae09d6cc615b7c194c00339884765f96912d1711cc6a37f1b67d215c6c684cd3bb0a9281810c9803ea75782efac7b14d0cc25bf0e1a828df7d9df683bde2b05cebaf129a1e560c0db331a2d4056f6e11b8925e0c92048dc1b102875ccd5247869242c0832765a2aa6575867417691165cc20e37ca565ee1deffc3d0e4aeccf277619447917784e5fa66b667822970ab7dde0b46a951c0495b6de9458be2450bfb64b1c425c808ac8231083fb66d1de38011d2df673dac58af2611e4d01d10136dbebd585a4c74e6c33fc35a54cd5216506b01edb164f99f282367d40baf1dd586ff7402b870fb8ad749f45b4b4866989ac4c8c3332a4c0b246bff33b82dcc5434f21d3260cbef1cae5dbbb7a2a4c65c51cadac545306b01c2517693040c49cc80be2601693b9c4becd38c1252fdbc51b200878c382a15f09aeba68a42fd4ca6ab8ef20cf6cb447ab185575a672f03595593b60570c9448eac8d7499aa2b74229c1f87c05d7873396376e2d3e96f2b4bfdce4a336cea8d49ecf2ef45b6dffbee8895645f5c386e718fac9bc2931f5b5b2717650c36a8a4ac4e00527e87fd988c2a55117c94fd188a3133bb59baffed4e425e407ebcac34c0a9852eb0442f7cb54d569d4d1f7c3648641e6b45cd29b204bef2d4fab3d0163bf7d8e07ecd32cee73b5305b4252fef1363c64167ca4602ce69e390a787e8c42caf657b0b95e925d03fc604f500a491a87dcd37b395643b9403e0540f53bea0b2d61237d8d254b2e242fa998800a1d01a62bcc98b242cde53bc3e4a1f1fc7df6692cdfefd5eb2605b7c488ba1b651c1534d25a7a1667d8d5fd6f6390aad01f26b407e004acca79a4e39f2f08c2b289ae95eafb70cd11024dd457d909496f0e79e91458cb9aa6e2c56fc96e65254267acbf13485def231e4dcaaae546269deb6665b6f04c7a0ce252a06283106e197797fdf683d92d58eeea4154035ea9cedd923aa69a9783edf7846726e6682e516d6eb27f1ec6026d535c9875b8e67a36e5e153827ff4fe49a2c3976534a667238c610a2be3072984dee3cc546a9bf15f5694a714d0bcd4a0f420e332bb7c67f9085465db7952178b3dcb5e212956c32bd0d40de9fb207d0b587a942b148be4bd8a563f2996c8ca6347b035d44d84afcfa31084dda80c53a42025543203102800b52a6b087294a45c55b0b10451bbedc025ce5bf3c596fdf22c1c251e42899d69c2e90c8fc35b2ff9303fc1914b845cc862a5d3ad542cb092adcb59b7b7f09d0234cd4621d57efb766bfee5784231e8c7a1705b797bec8cc3ee8906b9cbb5b2dbe5977eba2b97be6b4178abdcc2da1d03626160d53f1e7ce49b18ac39d10936310173c9a8d3d92d75a2b6614bca1c37d7250b3de0747a34022c3ce6eebaaea9001efedb1c3ea926f4fe55340db5f811f26e51420f52cc87030ca0891d6b33ebc2e7faa8e3c96c6cd274d845", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="32973e52f2f7a209a3a9d60186818586a163e7d65bbbbe28c602adce5219ae5eaa45ff1f91d71757c6426326ecedaaf683f839f9ed50a70b7e2424acb1574044f69df5d65950fe8405d8"], @ANYRESOCT=r0, @ANYRESHEX, @ANYRES32], @ANYBLOB=',/url\x00,version=9p2000.L,subj_type=keyring),\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00']) [ 335.135924] binder: 15783:15784 unknown command 64 [ 335.150670] binder: 15783:15784 ioctl c0306201 20000600 returned -22 23:02:18 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={r1, 0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000080)='syzkaller\x00'}, 0x30) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r2, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 335.310168] binder: 15783:15784 unknown command 64 [ 335.317283] binder: 15783:15784 ioctl c0306201 20000600 returned -22 23:02:18 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, 0x0, 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:18 executing program 3: openat$rtc(0xffffffffffffff9c, &(0x7f0000000340)='/dev/rtc\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) r1 = syz_open_dev$media(&(0x7f0000000380)='/dev/media#\x00', 0x7, 0x44022) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000003c0)=0x9, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xf17) unshare(0x40040400) ioctl$sock_bt_hidp_HIDPCONNDEL(0xffffffffffffffff, 0x400448c9, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x0, 0x0, 0x7, 0x0, 0x0, 0x8, 0x4000, 0x0, 0x0, 0x0, 0x1, 0x8, 0xa5c, 0x0, 0x0, 0x0, 0x1f6, 0xfff, 0x0, 0x5, 0x0, 0x5, 0x2, 0x0, 0x5, 0x8, 0x0, 0x400, 0x0, 0x2, 0x2, 0x9, 0x400, 0x4, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_bp={&(0x7f00000006c0), 0x11}, 0x0, 0x5e, 0x0, 0x0, 0x800, 0x5, 0x5}, 0x0, 0xc, 0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000700)=ANY=[@ANYBLOB="0300000060b4be5d9dc652ba3763c6468e37cff17c4f734adc795732627182eb678f2ed0e016ea39ea4346010043c9709fc34422cb4b474ec9c06e99ef56842ef518c9c63d41e12eb9f9669dbdf1a01d8dc8bae2fa4aac713e98ff9c716ef40000000000f0815d32b5a877068f19ae7375fb2d054f877db5812904faa4266671fcd824f3af54344654d844f8457de1a40f17c5f6b979a58e03f9b3c06ce6df7edd38c7013592d95bb25273c1240ae1d3d8e9c469809a0fe7da550c7821aff0d96ea21b00cf03bb79a6d22da0898f2123486f1c192830fb16bcd3b23f62e67f05e42ee1adbeb7dd0ee5a6782b1cc298266f3c7c46e978f1909edf5aca6392fda226f8528d00"/273, @ANYRES32=0x0], &(0x7f00000000c0)=0xfe10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000040)={r4}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f00000005c0)={r4, 0x4}, 0x8) syz_open_dev$ndb(&(0x7f0000000140), 0x0, 0x4200) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x200e80, 0x14) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) r6 = fanotify_init(0x0, 0x0) fanotify_mark(r6, 0x0, 0x0, r5, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x3) write$P9_RREAD(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="1a3ce226d586bf94a52bee8fcc8c3acd5cb113fadca3758d612ca43ba496b1e7772f10dc1a2a5651467a657588cdd60b93c759fd72a0f1e3e4000800000100008000000000d82779937cc4733ec1ed1f1e3be5d815beedde3496d71099b3188f62763267114ecc3f5c3907ae55e7fca6c1c9342eca4675836f2313c550fd5f7869fa379a4c70d1a8a369db91b7ae7713ea7752eae4c459cfc494d4ef81aa1ad0f20bbdc96c26d42051704f397f3755d415b37738a52f854f69021f7edaeb67c24cabd1edfe73e3562e981e9ccf7f21f6b852ccbedb9a12b2e06885d8b7d57258169ce50d10f785e958ce5b96af32b203e76b52a5531e38267fa6a6576cfec3c39ff260aa117752f397f5225f55eb2c495a83495d3a79f74373942c00b731fc8f57eeae8330caec0edb78aa4cba60eb5ba0630b95f49a6f2dc03fc9bbdf74802a3fa707c7113abcb51e4cee937c68c31b62dac9e61ae549d2df2bd4d0a9dfadc9cbb5428c00a437527404e793dd13c80d896df00c9a0a20e45f279c0ddc919f87f1d3168c8e5bafad85a89162c9ad4c1a56481766d10ce8bdcfd1b227703b14a8862d5ead8d1ba7975d646c1359e091b293947bd6cd449d75103f53787f99fdf9"], 0x153) close(0xffffffffffffffff) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff, 0x9f5, 0x63, &(0x7f0000000040)="afadd26e7504c5f39e22000b0b9b81136075d19d7e724c84e17330c2b77f599eaa454d42859a1b4ae09d7840cc7d1abca1fb636017f91eca69b09982011b18b41ab97877596225a1c1143898b8b5175ccf09dd7b3854112c49ecc0548ee15a0d70237e", 0x9439, 0x400, 0x6, 0x8, 0x0, 0x0, 0x80000000, 'syz1\x00'}) socket$inet_sctp(0x2, 0x5, 0x84) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) 23:02:18 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) close(0xffffffffffffffff) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) 23:02:18 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(0xffffffffffffffff, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r4, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 335.476982] 9pnet_virtio: no channels available for device 127.0.0.1 [ 335.495208] binder: 15797:15804 unknown command 64 [ 335.512783] binder: 15797:15804 ioctl c0306201 20000600 returned -22 [ 335.563904] binder: 15797:15816 unknown command 64 [ 335.569042] binder: 15797:15816 ioctl c0306201 20000600 returned -22 23:02:18 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x44, 0x3, &(0x7f0000000300)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@fda={0x66646185, 0x4, 0x1, 0x3}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x0, &(0x7f0000000640)=""/4096, 0x1000, 0x0, 0x1e}}, &(0x7f00000002c0)={0x0, 0x20, 0x38}}}], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="850000002f000000080000030000000095000000000000006ab27b2ed26be0014bb7ad9aa798dd475d487a17f597244a015cfac891f0d01ec2f499b8b016eb6fa1b84f5dacc0e82ede5b6a2a36eb2902773959797385e5c5909799b18b64888710afdb9dcab8f926cc56abc10306b73fa426f6434977b2a912bcff612d2afc73e6acbf530272b1ea003ff9592fb9ef06764ec219fedbc202da31521a81741c10546eb0ab286e1cdc63"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 335.807645] 9pnet_virtio: no channels available for device 127.0.0.1 [ 335.839275] binder: 15825:15826 unknown command 64 [ 335.863343] binder: 15825:15826 ioctl c0306201 20000600 returned -22 [ 335.903129] binder: 15825:15830 unknown command 64 [ 335.926445] binder: 15825:15830 ioctl c0306201 20000600 returned -22 23:02:18 executing program 4: ioperm(0x3, 0x9a6, 0xffff) syz_mount_image$hfs(&(0x7f0000000000)='hfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={[{@iocharset={'iocharset', 0x3d, 'none'}}]}) 23:02:19 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) close(0xffffffffffffffff) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) 23:02:19 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xa0a8}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="850000002f00000057000000000000009500000006000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:19 executing program 3: openat$rtc(0xffffffffffffff9c, &(0x7f0000000340)='/dev/rtc\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) r1 = syz_open_dev$media(&(0x7f0000000380)='/dev/media#\x00', 0x7, 0x44022) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000003c0)=0x9, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0xf17) unshare(0x40040400) ioctl$sock_bt_hidp_HIDPCONNDEL(0xffffffffffffffff, 0x400448c9, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x0, 0x0, 0x7, 0x0, 0x0, 0x8, 0x4000, 0x0, 0x0, 0x0, 0x1, 0x8, 0xa5c, 0x0, 0x0, 0x0, 0x1f6, 0xfff, 0x0, 0x5, 0x0, 0x5, 0x2, 0x0, 0x5, 0x8, 0x0, 0x400, 0x0, 0x2, 0x2, 0x9, 0x400, 0x4, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_bp={&(0x7f00000006c0), 0x11}, 0x0, 0x5e, 0x0, 0x0, 0x800, 0x5, 0x5}, 0x0, 0xc, 0xffffffffffffffff, 0x0) r3 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000700)=ANY=[@ANYBLOB="0300000060b4be5d9dc652ba3763c6468e37cff17c4f734adc795732627182eb678f2ed0e016ea39ea4346010043c9709fc34422cb4b474ec9c06e99ef56842ef518c9c63d41e12eb9f9669dbdf1a01d8dc8bae2fa4aac713e98ff9c716ef40000000000f0815d32b5a877068f19ae7375fb2d054f877db5812904faa4266671fcd824f3af54344654d844f8457de1a40f17c5f6b979a58e03f9b3c06ce6df7edd38c7013592d95bb25273c1240ae1d3d8e9c469809a0fe7da550c7821aff0d96ea21b00cf03bb79a6d22da0898f2123486f1c192830fb16bcd3b23f62e67f05e42ee1adbeb7dd0ee5a6782b1cc298266f3c7c46e978f1909edf5aca6392fda226f8528d00"/273, @ANYRES32=0x0], &(0x7f00000000c0)=0xfe10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000040)={r4}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f00000005c0)={r4, 0x4}, 0x8) syz_open_dev$ndb(&(0x7f0000000140), 0x0, 0x4200) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x200e80, 0x14) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) r6 = fanotify_init(0x0, 0x0) fanotify_mark(r6, 0x0, 0x0, r5, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x3) write$P9_RREAD(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="1a3ce226d586bf94a52bee8fcc8c3acd5cb113fadca3758d612ca43ba496b1e7772f10dc1a2a5651467a657588cdd60b93c759fd72a0f1e3e4000800000100008000000000d82779937cc4733ec1ed1f1e3be5d815beedde3496d71099b3188f62763267114ecc3f5c3907ae55e7fca6c1c9342eca4675836f2313c550fd5f7869fa379a4c70d1a8a369db91b7ae7713ea7752eae4c459cfc494d4ef81aa1ad0f20bbdc96c26d42051704f397f3755d415b37738a52f854f69021f7edaeb67c24cabd1edfe73e3562e981e9ccf7f21f6b852ccbedb9a12b2e06885d8b7d57258169ce50d10f785e958ce5b96af32b203e76b52a5531e38267fa6a6576cfec3c39ff260aa117752f397f5225f55eb2c495a83495d3a79f74373942c00b731fc8f57eeae8330caec0edb78aa4cba60eb5ba0630b95f49a6f2dc03fc9bbdf74802a3fa707c7113abcb51e4cee937c68c31b62dac9e61ae549d2df2bd4d0a9dfadc9cbb5428c00a437527404e793dd13c80d896df00c9a0a20e45f279c0ddc919f87f1d3168c8e5bafad85a89162c9ad4c1a56481766d10ce8bdcfd1b227703b14a8862d5ead8d1ba7975d646c1359e091b293947bd6cd449d75103f53787f99fdf9"], 0x153) close(0xffffffffffffffff) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff, 0x9f5, 0x63, &(0x7f0000000040)="afadd26e7504c5f39e22000b0b9b81136075d19d7e724c84e17330c2b77f599eaa454d42859a1b4ae09d7840cc7d1abca1fb636017f91eca69b09982011b18b41ab97877596225a1c1143898b8b5175ccf09dd7b3854112c49ecc0548ee15a0d70237e", 0x9439, 0x400, 0x6, 0x8, 0x0, 0x0, 0x80000000, 'syz1\x00'}) socket$inet_sctp(0x2, 0x5, 0x84) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) 23:02:20 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(0xffffffffffffffff, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r4, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:20 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x0) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 338.025119] binder: 15838:15845 unknown command 64 [ 338.370606] binder: 15838:15845 ioctl c0306201 20000600 returned -22 23:02:21 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) close(0xffffffffffffffff) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) 23:02:21 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x0) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:22 executing program 3: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(0xffffffffffffffff, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r4, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:22 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, 0x0, 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:22 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x1e1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 339.605305] binder: 15878:15886 unknown command 64 23:02:22 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x0) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 339.800208] binder: 15878:15886 ioctl c0306201 20000600 returned -22 23:02:22 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f00000000c0)={{0x2e, @dev={0xac, 0x14, 0x14, 0x22}, 0x4e21, 0x2, 'lc\x00', 0x38, 0x8, 0x27}, {@rand_addr=0x4, 0x4e21, 0x0, 0x5, 0x7fffffff, 0x9}}, 0x44) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r1, 0x20000000) r2 = socket$inet6(0xa, 0x6, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000040)=0x20) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r3 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg(r3, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc}}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, 0x0, 0x0, &(0x7f00000037c0)}}], 0x2, 0x0) prctl$PR_SET_THP_DISABLE(0x29, 0x1) r4 = syz_open_dev$vbi(&(0x7f0000000200)='/dev/vbi#\x00', 0x3, 0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000180)='!eth1\x9c,\x00', r4}, 0x10) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x800, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300)='TIPC\x00') sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r5, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x900}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r6, 0x800, 0x70bd2c, 0x25dfdbff, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x58f0c8037cc31280) r7 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x400440, 0x0) r8 = accept$netrom(r7, 0x0, &(0x7f0000000080)) ioctl(r8, 0x1000008914, &(0x7f0000000000)="000000000000000071048c") syz_init_net_socket$rose(0xb, 0x5, 0x0) mlock(&(0x7f0000e75000/0x1000)=nil, 0x1000) r9 = syz_open_procfs(0x0, &(0x7f00000001c0)='clear_refs\x00') writev(r9, &(0x7f0000000040)=[{&(0x7f0000000000)='+', 0x1}], 0x1) ioctl$UI_END_FF_ERASE(0xffffffffffffffff, 0x400c55cb, &(0x7f0000000280)={0x7, 0x8001}) ioctl$PPPIOCSCOMPRESS(r9, 0x4010744d) 23:02:22 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x11) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:23 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) syz_mount_image$nfs4(&(0x7f00000000c0)='nfs4\x00', &(0x7f0000000200)='./bus\x00', 0x2, 0x6, &(0x7f0000000480)=[{&(0x7f0000000240)="41e58f3eb8fcb500b0bd0eeccdbd8bde4bad82662b1e2f7cef3076eec6f29deaf6c45fff54b51535", 0x28, 0x1}, {&(0x7f0000000280)="a19ad62e60eace62205d0354c51c34c45e12712e98cafebe66a5d37a7455057be63b73fcd5c1e0b844c56a66f09646509e56bfe5575a2f93d4a3175078085c3b3cf3d26f5b98b123805c2f4761b11f3c57e0da67e923db8e1db87b91934b8514bd9758e5d3932337871d41d5a49687d9f7bead970569d63ae94de58f57c07107022399b9c37568baa1b22174f695d87f7633908ea0da705d15178eb036745ab092ff86a91e468f20358f26cedf2b45e2a21d340064617d452025c4662c", 0xbd, 0xa6}, {&(0x7f0000000340)="fe9589ec4df6ed79e6f11b1ddace0eb9ac4be004c64fde5b560ef288b96ceac04cd71a9dd80cfccf8e44b96536d11d56dc9b733aba5a6208595812083ebff13748cdd9589a7c5618c53bb186691fa0fe710e3b66b7474e4354eb2c74384352dcf3c6bed654c2c454f42858e334dcd038770e8aab2e5485cc", 0x78, 0x200}, {&(0x7f00000003c0)="f8ed920398686f468748065ea3c8063c940887f2", 0x14, 0x1000}, {&(0x7f0000000400)="e4bb8991d3736999225dadb70a9654a4764c3e00a84066d4425565c6ac0055a3bf2bbdb11f44a13684d5", 0x2a, 0x2}, {&(0x7f0000000440), 0x0, 0x4}], 0x8, &(0x7f0000000540)='syzkaller\x00') sendfile(r2, r3, 0x0, 0x800000000024) fcntl$addseals(r1, 0x409, 0xe) ioctl$UI_SET_PROPBIT(r3, 0x4004556e, 0x4) r4 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r4, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r4, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r5 = syz_open_dev$vcsa(&(0x7f0000000300)='/dev/vcsa#\x00', 0x80000001, 0x20000) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r6, r7, 0x0, 0x800000000024) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000900)={{{@in=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000580)=0x25d5752084a5cab9) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'ip6gre0\x00', r8}) bind(0xffffffffffffffff, &(0x7f0000000180)=@xdp={0x2c, 0x0, r8, 0x11}, 0x80) setsockopt$packet_drop_memb(r4, 0x107, 0x2, &(0x7f0000000440)={r8, 0x1, 0x6, @random="9b1f0d995242"}, 0x10) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000080)={0x3}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r3, 0xc08c5336, &(0x7f0000000640)={0x1, 0x4, 0x4, 'queue0\x00', 0x80000001}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:23 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) write(r0, &(0x7f0000000240)="21b5cb7699e1dd8dc43fcbfa8b7da0cce2f3e30d9be944a467d8e3e82ddf4cddeab38170b2f57b63c7a3894822fe7f406e5240c2c4b5047112694987d4be843ee57950dc3ee31d3afeb56b5761010d5a5f21e68192cae4663a7dd957e8dea737417980b94d2eb12310ba1fc6d3e3612acae10482497fe4494c4a72b1b605706b7f0558564451b3147d9e8730d8c254083acc1467f0e8a8412a4c160fa1a4af0b398d2ec9c2b5411c080582a42f652e424977da9450213e47c98cb192edb052ef0e1ca7fed167afd544cece02e59d97662c96c7561fdb808adca710e8", 0xdc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x32600) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0xda00) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) write$cgroup_int(r2, &(0x7f0000000200), 0x43400) 23:02:23 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) [ 340.113929] binder: 15910:15911 unknown command 64 [ 340.128019] binder: 15910:15911 ioctl c0306201 20000600 returned -22 23:02:23 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) 23:02:23 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = accept4(0xffffffffffffffff, &(0x7f0000000080)=@rc, &(0x7f0000000200)=0x80, 0x0) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000240)=0x1) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$EVIOCGPROP(r2, 0x80404509, &(0x7f00000002c0)=""/59) r3 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) ioctl$sock_inet6_tcp_SIOCINQ(r5, 0x541b, &(0x7f0000000280)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="0863104000000000000000000000041b61ef6159afbe425797c9a279000000000000"], 0x0, 0x0, 0x0}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r6, r7, 0x0, 0x800000000024) ioctl$KVM_IOEVENTFD(r7, 0x4040ae79, &(0x7f0000000340)={0x5000, &(0x7f0000000300), 0x8, 0xffffffffffffffff, 0x6}) ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000380)=""/163) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:23 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, 0x0, 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:23 executing program 3: openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00\x02\x17\x87:\xf4\x03\xdfc\x88,5I\xd7^\xb5D\xf7\xd7\xdb,(\x03\x00\xc2\x06MG\xcd\xe9w\xe5s\x02\xf2\xea\xb6\xabsp\x12xT8\x01\x00\xd4S\xd8F\xab.x|\x8b\x87\xb0\xa2\xf5Y>\xb1 p\x998(\xe63\xcf\x7f\xac\x89F\x03n\x96\x15zsw\x98\xca\xcb3\xb6M=h\x01i.\xa3\xda}\x190~\xe7d6\xa5\x17\xb3\xe9\xd9QV\x0f\xf3\x02\xd6\xc1\xc3n\xcd*R\x9a\x95\x12\x05K\xa0<\xc9\xe3\xed\xab\xc9\x8bK\xb3\x86\xe2\x93f\x92iKA|e\x97k :,J36\x11\xf0\x99\x96\xb7]\xfd\xe3\v\xd8\x98\xc5o\xc6\xde\x80\xf7_\xc9\x8f\xaf\xf9\xd5\xb7ui\xea\xde\xd0\xeb\xd9\xf5_\v\xe2*\xa3\xf4\xab?n\xcb\x19i\x80\x91\xd2\xf6\x14\xfe!!0\x84L\x86\x81\x95,B\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\xab*[\xa5\xb217\x93\xf3\x88\x92\xa6\xde\x11\xa2-J\x9d\xc9\xb2\x97\xa3\x88v\x9eR\x155\xc7N!\xdb\"8\xc8I\xb9c\xed\xa7!\t\x85s\xb1\xa5\xa7R2Yf\x1c\xf8\xc2z>\xb1\x9c\x02a\x87\xe9\xb8\xf8\xdcv\xb6\xe4\xa6\n\x0e\x83lM7\xcc?\xea\x19\x99\xce\x1c\x10\xd2lQ(\xc7\xe9\xef\xd2Q\vY\xf58\x10|8}uE\xaf\xb4w;\xbc\xe4\x01\xd8\xf2\xf9u\xc1Dt\'\x84\xb5\xa4\x83\xeft\xfc\xf3\t\x870xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:23 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040faffffff00000000000000000000000071b9ba43267df53d17029ee2a5920b5e9d69dcdd172f2a3bf29560b15a9fb681a7c3eccc50253b773823ead0b3e87e0eec1b95"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0xffffff55, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:23 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 340.740136] binder: 15947:15951 unknown command -1472 23:02:23 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 340.790456] binder: 15947:15951 ioctl c0306201 20000600 returned -22 23:02:23 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x6, 0x2) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000200)=""/245) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x36ca, 0x1) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r2, 0xc4c85512, &(0x7f0000000640)={{0xa, 0x1, 0x6, 0x6, '\x00', 0x80}, 0x0, [0x3810000000000000, 0x2, 0x3, 0x3f, 0x9511, 0x9, 0x3, 0x7, 0x0, 0x7, 0x0, 0x2, 0x3de69e17, 0x34daace2, 0x9a, 0xac, 0x9, 0x1, 0xb2, 0x1, 0x9, 0x4, 0x7, 0x7b0664fd, 0x1, 0x74a, 0x8, 0x7fff, 0x0, 0x2, 0xffff, 0x7f, 0x3ff, 0x9, 0x1ff, 0x0, 0x1, 0xc36, 0x158121a0, 0xca6, 0x7fff, 0xfffffffffffffff8, 0x7fffffff, 0x44, 0x200, 0x825, 0x7f, 0x100000001, 0x5, 0x1, 0x7, 0x1000, 0x6, 0x1, 0x1, 0x1000, 0x8001, 0x101, 0x400, 0x9, 0x3, 0x1f, 0xb3b6, 0x1, 0x1, 0x8001, 0x10000, 0xa, 0x5, 0x181765f5, 0x3ae35aed, 0x7, 0x8, 0x970, 0x2, 0x6, 0x6, 0x8000800000, 0x7fffffff, 0x36e, 0x8, 0x0, 0x0, 0x1, 0x101, 0x8, 0x1000, 0xfffffffffffffc01, 0x5, 0x1, 0x7ff, 0x0, 0xfffffffffffffcff, 0xffffffff, 0x6, 0x6, 0x0, 0x3, 0x8, 0x7, 0x8, 0xfffffffffffffffb, 0x6774, 0x10001, 0xffff, 0x100, 0x8, 0x81, 0xef, 0x400, 0x8, 0xffffffffffffffff, 0x1, 0x80, 0x0, 0x7, 0x1fd, 0x101, 0x8, 0xfc0, 0x50d, 0x7fff80000, 0x8, 0x1, 0x8001, 0x9, 0x7, 0xa9e]}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 340.910893] binder: 15962:15964 unknown command 64 [ 340.940240] binder: 15962:15964 ioctl c0306201 20000600 returned -22 [ 343.340556] device bridge_slave_1 left promiscuous mode [ 343.346097] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.401623] device bridge_slave_0 left promiscuous mode [ 343.407091] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.533945] device hsr_slave_1 left promiscuous mode [ 343.595294] device hsr_slave_0 left promiscuous mode [ 343.655150] team0 (unregistering): Port device team_slave_1 removed [ 343.666240] team0 (unregistering): Port device team_slave_0 removed [ 343.677128] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 343.716608] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 343.807551] bond0 (unregistering): Released all slaves [ 345.750883] IPVS: ftp: loaded support on port[0] = 21 [ 346.578014] chnl_net:caif_netlink_parms(): no params data found [ 346.610541] bridge0: port 1(bridge_slave_0) entered blocking state [ 346.616956] bridge0: port 1(bridge_slave_0) entered disabled state [ 346.624252] device bridge_slave_0 entered promiscuous mode [ 346.631148] bridge0: port 2(bridge_slave_1) entered blocking state [ 346.637511] bridge0: port 2(bridge_slave_1) entered disabled state [ 346.644647] device bridge_slave_1 entered promiscuous mode [ 346.660644] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 346.669417] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 346.687211] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 346.694453] team0: Port device team_slave_0 added [ 346.699826] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 346.706999] team0: Port device team_slave_1 added [ 346.712404] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 346.719542] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 346.773660] device hsr_slave_0 entered promiscuous mode [ 346.810414] device hsr_slave_1 entered promiscuous mode [ 346.851437] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 346.858286] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 346.870587] bridge0: port 2(bridge_slave_1) entered blocking state [ 346.876932] bridge0: port 2(bridge_slave_1) entered forwarding state [ 346.883576] bridge0: port 1(bridge_slave_0) entered blocking state [ 346.889907] bridge0: port 1(bridge_slave_0) entered forwarding state [ 346.916930] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 346.923155] 8021q: adding VLAN 0 to HW filter on device bond0 [ 346.931514] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 346.939789] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 346.947887] bridge0: port 1(bridge_slave_0) entered disabled state [ 346.954633] bridge0: port 2(bridge_slave_1) entered disabled state [ 346.965302] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 346.971509] 8021q: adding VLAN 0 to HW filter on device team0 [ 346.979847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 346.987620] bridge0: port 1(bridge_slave_0) entered blocking state [ 346.994003] bridge0: port 1(bridge_slave_0) entered forwarding state [ 347.011530] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 347.019096] bridge0: port 2(bridge_slave_1) entered blocking state [ 347.025514] bridge0: port 2(bridge_slave_1) entered forwarding state [ 347.034127] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 347.042135] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 347.049964] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 347.059621] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 347.071898] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 347.082337] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 347.088411] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 347.096193] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 347.109265] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 347.121374] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 347.570600] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready 23:02:31 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) 23:02:31 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, 0x0, 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:31 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) 23:02:31 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="08631040564a993d006a37000000000000000000"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) prctl$PR_SET_PTRACER(0x59616d61, r1) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:31 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:31 executing program 0: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) 23:02:31 executing program 0: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) 23:02:31 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") syz_mount_image$msdos(&(0x7f0000000040)='msdos\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000017c0)={[], [{@appraise_type='appraise_type=imasig'}]}) ioctl$FIGETBSZ(0xffffffffffffffff, 0x2, &(0x7f0000000000)) [ 348.372973] binder: 15997:16001 unknown command -1723181504 [ 348.386055] binder: 15997:16001 ioctl c0306201 20000600 returned -22 [ 348.412677] binder: 15997:16009 unknown command -1723181504 23:02:31 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x3, 0xfe) write(r1, &(0x7f00000000c0)="240000001a005f0014f900"/36, 0x1cc) 23:02:31 executing program 0: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x4ffe0, 0x0) [ 348.430811] binder: 15997:16009 ioctl c0306201 20000600 returned -22 23:02:31 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$VIDIOC_QUERY_EXT_CTRL(r2, 0xc0e85667, &(0x7f0000000200)={0x40000000, 0x7, "2e6c369221a7af06f91b224a6bdb64aadccf81f67c8f94ed6b836a5e47d6ab67", 0x2, 0x7fff, 0x1, 0x93e, 0x3ff, 0x7, 0x1b8, 0x1ff, [0xfa, 0x9, 0xce3, 0xdb3]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:31 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 348.653405] FAT-fs (loop3): Unrecognized mount option "appraise_type=imasig" or missing value 23:02:31 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="b7000000000000000000800100009d00000000001d000000a2bac64dfa4c82fe848eac7651d3b27b9eae23dfbec8fa8cc904db55ebbf8a1f53f757e148657aaf6f4ba7cac2df54fe581e835d2e00000000724f69c29174334a9e00468342c4e1965a04a503ae7ab73e50fad7924b64a9002dc20c7f467c33751015bb90526053b8a7a219c3d86455807ce022c6f420dbae05a7b7ecc198b069b5d3e1116fb2c82310b38a37018e4d9bb3efe90dca0d9228f75e6406468022d443dfba278d7f76db5b5bfa2002b625469b883bdf3fd9fa816b102d7d50da6f11db610000000000000000"], &(0x7f0000003ff6)='syzkaller\x00', 0x0, 0xc3, &(0x7f00000002c0)=""/195}, 0x48) [ 348.776380] FAT-fs (loop3): Unrecognized mount option "appraise_type=imasig" or missing value [ 348.816374] binder: 16032:16043 unknown command 64 [ 348.828165] binder: 16032:16043 ioctl c0306201 20000600 returned -22 [ 348.897276] binder: 16032:16043 unknown command 64 [ 348.914484] binder: 16032:16043 ioctl c0306201 20000600 returned -22 23:02:32 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x0) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:32 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="500000001000050700"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000800030000000000250012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000005388c68bbe9150124d8730fe3be852ce026523ad6e5c213c60b93b80f76dd35ba0f2e09522865014d078e659c12c8ad7b2da106c6f9be9af573f9dbd327983c9ea4d82d58214486d927de7910f67462ce2404c62aa0b06a8b17f2544e42558fec6c4b01621581fbaa975c0e401c524b85cd131defa9797a52aba44329fcc7117c8ebb1813939396dfe2913e22e78c38daddff8654251fe9767f7f1cc8f789c0772de55190611971a983936573cbe482d68c9e30b9ed76725f6f437c614af4e00000000"], 0x200}}, 0x0) 23:02:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="4000000010003b0e00"/20, @ANYRES32=0x0, @ANYBLOB="c30200000000000008000a00d416eeb87f86f118cac1c808721b05473431ededd73dc0e2c73f5e607e9a523dd734786d2ea14af98e74474588828c6d2fd0078e05bc90fc400b0f86ada0d6f8699146cf96a1bb0434363771126cdf1a588342bd1f6229b59403b75a0c0060e900abebe1b141531bb1895826e5833be66a71d9251d7ac658311e0b60c58d4674e81f441e0c0e85d70856829b37b2eab6924c010000000000000014c000"/179, @ANYRES32=0x6, @ANYRESOCT=0x0], 0x5}, 0x1, 0x0, 0x0, 0x4000001}, 0x800) 23:02:32 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x0, 0x3, &(0x7f0000000000), 0x0, 0x0, 0x0}) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x4, &(0x7f00000000c0)=0x80, 0x4) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0xc, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 23:02:32 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0x80044dff, 0x0) 23:02:32 executing program 3: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:32 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000080)}, 0x0, 0x0, 0xd88a}, 0x0, 0xb, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='trusted.overlay.upper\x00', &(0x7f0000000340)={0x0, 0xfb, 0x105, 0x2, 0x3f, "9c18107ae49c1c4dd50f8a7665d18c28", "c49298704ee499f6f80c3ef12c5b80761c5dd212e5953ee452d1d05e48a723acec080eb7f5696081fafaac19cbd66fb540b67251c25833e587258ab7407e1348f6baf8e278cb558c0666282d74839cca86aa649e7c6532a781fe1f0a7ab4c22849c8f768cd832179c5978990c8ba48384dd5b012738e39159775000cc27e127a2dd4093f00c4c3ccc4d097efb1f8b782ac00213c19fe761cd2aec74fe7f2ed6519a4e9ec54879b340bfc8f2c2d8ff52476197b4a3e61084b9999f59e883b71fc152b00ce10d4d3e9952ffc839e564338033f996434aa615871b881c0c876f494671dfbcfdd48e1ee5efc1d98ff66d235"}, 0x105, 0x0) r1 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r1, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r2 = socket$inet_udp(0x2, 0x2, 0x0) getpeername(r2, &(0x7f00000007c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @initdev}}}}, &(0x7f0000000840)=0x80) connect$bt_l2cap(r1, &(0x7f00000004c0)={0x1f, 0x3, {0x0, 0x40, 0x81, 0xfd, 0x3, 0x7}, 0x28, 0xb6}, 0xe) connect$tipc(0xffffffffffffffff, &(0x7f0000000280)=@id={0x1e, 0x3, 0x1, {0x4e22, 0x3}}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000500)=@pptp={0x18, 0x2, {0x0, @remote}}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000580)=""/59, 0x3b}, {&(0x7f00000005c0)=""/37, 0x25}], 0x2, &(0x7f0000000680)=""/201, 0xc9}, 0xa0000020) ioctl$PPPIOCSFLAGS1(r3, 0x40047459, &(0x7f0000000480)=0x9006000) ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000000200)={@broadcast}, &(0x7f0000000240)=0xc) [ 349.219344] netlink: 21 bytes leftover after parsing attributes in process `syz-executor.4'. 23:02:32 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x410c3, 0x0) ftruncate(r1, 0x88001) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) ioctl$VIDIOC_ENCODER_CMD(r3, 0xc028564d, &(0x7f0000000080)={0x1, 0x1, [0x5, 0x0, 0x7, 0x4, 0x5, 0x5b, 0x9, 0x3]}) sendfile(r0, r1, 0x0, 0x800000000024) setsockopt$inet6_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000040)=@gcm_128={{0x303}, "0d7d497422fd2e56", '\x00', "767433f2", "1ac86c127c0e8e69"}, 0x28) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x80, 0x0, 0x7f, 0x19336fa905faef17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[]}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) getgid() ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00'}) creat(0x0, 0x0) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) getresuid(0x0, 0x0, &(0x7f0000000380)) [ 349.516106] binder: 16077:16086 unknown command 64 23:02:32 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:32 executing program 3: r0 = socket$inet6(0xa, 0x8000008000080003, 0x5) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c00000011003586000000000000000007000000", @ANYRES32=r2, @ANYBLOB="00000005000000000c001a000600000003000400"], 0x2c}}, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) r5 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r5, &(0x7f0000000040)={0x10000000}) 23:02:32 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 349.554682] binder: 16077:16086 ioctl c0306201 20000600 returned -22 23:02:32 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 349.667504] binder: 16098:16101 unknown command 64 [ 349.679302] binder: 16098:16101 ioctl c0306201 20000600 returned -22 [ 349.786512] binder: 16110:16112 unknown command 64 [ 349.800241] binder: 16110:16112 ioctl c0306201 20000600 returned -22 23:02:33 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x0) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:33 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x11) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) ioctl$sock_SIOCSIFBR(r3, 0x8941, &(0x7f0000000200)=@add_del={0x2, &(0x7f0000000140)='ip6gretap0\x00'}) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000040)={0x100000001, 0x0, 0x0, 0x7}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x365d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) close(r5) r6 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x1, 0x400200) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0], 0x1}) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r5, r7, 0x0, 0x800000000024) r8 = socket$inet6(0xa, 0x400000000001, 0x0) close(r8) r9 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r9, 0x88001) sendfile(r8, r9, 0x0, 0x800000000024) bind$inet6(r9, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000000)=0xfff, 0xfffffffffffffced) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r0, 0x0, 0xffffffb4, 0x0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x15}}, 0x4}, 0x368) memfd_create(0x0, 0x7) socket$alg(0x26, 0x5, 0x0) 23:02:33 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:33 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) link(&(0x7f0000000080)='./bus\x00', &(0x7f0000000100)='./bus\x00') write$cgroup_subtree(r0, &(0x7f0000000040)=ANY=[@ANYPTR64], 0xff39) write$cgroup_pid(r3, &(0x7f0000000180), 0x12) 23:02:33 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0x80044dff, 0x0) [ 350.045950] binder: 16120:16125 unknown command 64 23:02:33 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="0c631040000200"/20], 0x370, 0x0, 0x0}) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x80812, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180), 0x8}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) accept4$unix(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000200)=0x6e, 0x800) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x88001) sendfile(r0, r1, 0x0, 0x800000000024) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'ip_vti0\x00', 0x100}) [ 350.073507] binder: 16120:16125 ioctl c0306201 20000600 returned -22 23:02:33 executing program 3: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0x80044dff, 0x0) 23:02:33 executing program 2: clone(0x500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x3cb, 0x3, &(0x7f0000000000), 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080), 0x8}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000040)={r3, @in6={{0xa, 0x4e22, 0x0, @loopback, 0x46cd}}, 0xe00, 0x0, 0x0, 0x4, 0x100000000}, &(0x7f0000000100)=0x98) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f00000000c0)=@assoc_value={r3, 0x9}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000240)={0x8, 0x0, 0x5, 0x400, r4}, &(0x7f0000000280)=0x10) [ 350.379040] binder: 16155:16156 unknown command 0 [ 350.387083] binder: 16155:16156 ioctl c0306201 20000600 returned -22 23:02:33 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 350.437704] binder: 16157:16161 unknown command 0 23:02:33 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="0863104000c606d6d24990df198fbb39f89f4301"], 0x0, 0x0, 0x0}) open_by_handle_at(r0, &(0x7f0000000200)={0xa2, 0x0, "a9599153d151f4af8c4784782a2582f86d08bd95e939bf5ad7006bd6feaab2fc006da341820294052b4d51d3029563fac16a6e34bd4f4f33cff758c7f8812f63954abb8a87de49d11c6c5f8aeb224df8d6c17c61fdf4c6e9873421accd35fe6a8b9d5a6738476a7a272841c750503e88eea1bbdf512fa1330d3b7e030e9b86ae8147662ce5932adbf5aa3435ed104392ec7ec2b183e55761c7e6"}, 0x200) fcntl$setflags(r0, 0x2, 0x1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x6, 0xffffffffffffffff, 0x8, &(0x7f0000000080), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) [ 350.474934] binder: 16157:16161 ioctl c0306201 20000600 returned -22 [ 350.580824] binder: 16171:16172 unknown command 113639488 [ 350.587017] binder: 16171:16172 ioctl c0306201 20000600 returned -22 23:02:33 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xe758}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x61}, 0x10}, 0x70) r1 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0xfb, 0x2) ioctl$BLKFLSBUF(r1, 0x1261, &(0x7f0000000200)=0x9) r2 = socket$inet6(0xa, 0x400000000001, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) syz_open_dev$rtc(&(0x7f0000000380)='/dev/rtc#\x00', 0x7, 0x400440) sendfile(r3, r4, 0x0, 0x800000000024) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, r5, 0x4, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xa3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1000}, @TIPC_NLA_MON_REF={0x8}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x1090}, 0x20004000) close(r2) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x88001) sendfile(r2, r6, 0x0, 0x800000000024) ioctl$PIO_CMAP(r6, 0x4b71, &(0x7f0000000080)={0xffffffffffffffff, 0x1, 0x9c, 0x6, 0xfffffffffffffffa, 0x5}) 23:02:33 executing program 1: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0x80044dff, 0x0) [ 350.686291] binder: 16177:16178 unknown command 64 [ 350.691722] binder: 16177:16178 ioctl c0306201 20000600 returned -22 [ 350.768957] binder: 16177:16182 unknown command 64 [ 350.792126] binder: 16177:16182 ioctl c0306201 20000600 returned -22 23:02:33 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x0) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:33 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x11) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) ioctl$sock_SIOCSIFBR(r3, 0x8941, &(0x7f0000000200)=@add_del={0x2, &(0x7f0000000140)='ip6gretap0\x00'}) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000040)={0x100000001, 0x0, 0x0, 0x7}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x365d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) close(r5) r6 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x1, 0x400200) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0], 0x1}) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r5, r7, 0x0, 0x800000000024) r8 = socket$inet6(0xa, 0x400000000001, 0x0) close(r8) r9 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r9, 0x88001) sendfile(r8, r9, 0x0, 0x800000000024) bind$inet6(r9, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000000)=0xfff, 0xfffffffffffffced) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r0, 0x0, 0xffffffb4, 0x0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x15}}, 0x4}, 0x368) memfd_create(0x0, 0x7) socket$alg(0x26, 0x5, 0x0) 23:02:34 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000040)={r2, @in6={{0xa, 0x4e22, 0x0, @loopback, 0x46cd}}, 0xe00, 0x0, 0x0, 0x4, 0x100000000}, &(0x7f0000000100)=0x98) setsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f00000000c0)=@assoc_value={r2, 0xfffffffe}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 23:02:34 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x11) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) ioctl$sock_SIOCSIFBR(r3, 0x8941, &(0x7f0000000200)=@add_del={0x2, &(0x7f0000000140)='ip6gretap0\x00'}) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000040)={0x100000001, 0x0, 0x0, 0x7}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x365d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) close(r5) r6 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x1, 0x400200) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0], 0x1}) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r5, r7, 0x0, 0x800000000024) r8 = socket$inet6(0xa, 0x400000000001, 0x0) close(r8) r9 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r9, 0x88001) sendfile(r8, r9, 0x0, 0x800000000024) bind$inet6(r9, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000000)=0xfff, 0xfffffffffffffced) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r0, 0x0, 0xffffffb4, 0x0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x15}}, 0x4}, 0x368) memfd_create(0x0, 0x7) socket$alg(0x26, 0x5, 0x0) 23:02:34 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x11) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) ioctl$sock_SIOCSIFBR(r3, 0x8941, &(0x7f0000000200)=@add_del={0x2, &(0x7f0000000140)='ip6gretap0\x00'}) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f0000000040)={0x100000001, 0x0, 0x0, 0x7}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x365d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) close(r5) r6 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x1, 0x400200) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0], 0x1}) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r5, r7, 0x0, 0x800000000024) r8 = socket$inet6(0xa, 0x400000000001, 0x0) close(r8) r9 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r9, 0x88001) sendfile(r8, r9, 0x0, 0x800000000024) bind$inet6(r9, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000000)=0xfff, 0xfffffffffffffced) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r0, 0x0, 0xffffffb4, 0x0, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x15}}, 0x4}, 0x368) memfd_create(0x0, 0x7) socket$alg(0x26, 0x5, 0x0) [ 351.199040] binder: 16204:16205 unknown command 64 [ 351.206546] binder: 16204:16205 ioctl c0306201 20000600 returned -22 23:02:34 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:34 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) openat$tun(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/net/tun\x00', 0x240003, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) r4 = syz_open_dev$vcsa(&(0x7f0000000300)='/dev/vcsa#\x00', 0x80000001, 0x20000) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000340)={{{@in=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000ac0)=0xe8) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'ip6gre0\x00', r5}) bind(0xffffffffffffffff, &(0x7f0000000180)=@xdp={0x2c, 0x0, r5, 0x11}, 0x80) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000400)={@local, @local, @rand_addr="d334dfa53b785eedbd5d58ddb75e898e", 0x4, 0x8001, 0x6, 0x0, 0xfffffffffffffffd, 0x800000, r5}) close(r1) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x88001) sendfile(r1, r6, 0x0, 0x800000000024) r7 = socket(0x11, 0x800000003, 0x0) bind(r7, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000380)={0x84, 0x0, &(0x7f0000000240)=[@increfs_done={0x40106308, 0x3}, @acquire={0x40046305, 0x1}, @clear_death={0x400c630f, 0x2}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000080)={@flat=@binder={0x73622a85, 0xa, 0x2}, @fd, @fd={0x66642a85, 0x0, r7}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}, 0x1c40}, @acquire={0x40046305, 0x1}, @register_looper], 0x68, 0x0, &(0x7f0000000300)="ba044f2cbe4aeeb1c696465b508d3b8d9abb81d02dec5aea2523448bb619a72595e59d15ce91e726e07aefdb5181f5b36fffc3b6de14fbbc7136d53f13c89740f5f5d9642cc284fdf47b72bcd3303a439ff470f65c82c38469d48f6319bd534d87e85a6cb5a98e70"}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 351.519075] binder: 16230:16231 unknown command 64 [ 351.531060] binder: 16230:16231 ioctl c0306201 20000600 returned -22 23:02:34 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x4000, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000640)={'filter\x00', 0x7, 0x4, 0x480, 0x140, 0x258, 0x140, 0x398, 0x398, 0x398, 0x4, &(0x7f00000000c0), {[{{@arp={@loopback, @remote, 0xffffffff, 0xff, @mac=@random="840085a64334", {[0xff, 0x0, 0x0, 0x7f, 0xff]}, @empty, {[0x0, 0x0, 0x0, 0xff, 0xff, 0xff]}, 0x8054, 0xe0, 0x81, 0x3, 0x3f, 0x3, 'syzkaller0\x00', 'ipddp0\x00', {}, {}, 0x0, 0x84}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, 0x0, 0xffffffff}}}, {{@uncond, 0xf0, 0x118}, @unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2}}}, {{@arp={@dev={0xac, 0x14, 0x14, 0x29}, @empty, 0xc29eef115909035f, 0x0, @mac=@link_local, {[0xff, 0xff, 0xff, 0x0, 0xff, 0xff]}, @mac=@dev={[], 0xd}, {[0xff, 0x1fe, 0xff, 0xff, 0xff, 0x1fe]}, 0x5, 0x2de, 0x0, 0x0, 0x1, 0x0, 'rose0\x00', 'rose0\x00', {0xff}, {0xff}, 0x0, 0xa0}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@random="5fe5ab7f7613", @multicast1, @remote, 0x0, 0x1}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4d0) 23:02:34 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 351.788140] binder: 16238:16239 unknown command 64 [ 351.793495] binder: 16238:16239 ioctl c0306201 20000600 returned -22 [ 351.815667] binder: 16238:16242 unknown command 64 [ 351.820911] binder: 16238:16242 ioctl c0306201 20000600 returned -22 23:02:34 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(0x0, 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:34 executing program 4 (fault-call:21 fault-nth:0): open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 351.863715] binder: 16243:16245 unknown command 64 [ 351.869292] binder: 16243:16245 ioctl c0306201 20000600 returned -22 [ 351.881237] binder: 16243:16248 unknown command 64 [ 351.886216] binder: 16243:16248 ioctl c0306201 20000600 returned -22 23:02:34 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="850000002f0000005700"/24], &(0x7f0000000000)='syzkaller\x00'}, 0x48) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x163002, 0x4d) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) setsockopt$CAIFSO_REQ_PARAM(r2, 0x116, 0x80, &(0x7f0000000080)="fb30b20d9f55658a075bef363ac53a9bd625790bf6e7852634c32fd3bf381aaf43e2c903b40311e67722b91fdb7ffe87ad9dd4cc4c2400fc4fae499a5c0f70ac678fdf8098", 0x45) [ 351.985112] binder: 16254:16256 unknown command 64 [ 351.990449] binder: 16254:16256 ioctl c0306201 20000600 returned -22 [ 352.009458] binder: 16254:16263 unknown command 64 [ 352.014687] binder: 16254:16263 ioctl c0306201 20000600 returned -22 23:02:35 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="086310400000000000000000000000000031214766eefd97fd0e29002adc7a5ca8bfda4ee2"], 0x0, 0x0, 0x0}) openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x200, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:35 executing program 1: socket$nl_route(0x10, 0x3, 0x0) r0 = getpid() sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_NET_NS_PID={0x8, 0x13, r0}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) capget(&(0x7f0000000200)={0x20071026, r0}, &(0x7f0000000240)={0x0, 0x400, 0x0, 0x7f, 0x37b4bc7d, 0xac}) chdir(0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000740)=@mangle={'mangle\x00', 0x1f, 0x6, 0x530, 0x2d0, 0x0, 0x1b8, 0x3b8, 0x3b8, 0x498, 0x498, 0x498, 0x498, 0x498, 0x6, &(0x7f00000002c0), {[{{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x18}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ip={@broadcast, @multicast2, 0xff, 0xff, 'syzkaller1\x00', 'syz_tun\x00', {0x80}, {0xff}, 0xff, 0x2, 0x40}, 0x0, 0x98, 0xd0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffff, 0x2, 0x1}, {0x2, 0x81, 0x4}, {0x7f, 0x22, 0xd1}, 0x2, 0xff}}}, {{@ip={@multicast1, @loopback, 0x0, 0xffffffff, 'yam0\x00', 'ip6tnl0\x00', {0x7f}, {0xff}, 0xe1, 0x0, 0x2}, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@addrtype={0x30, 'addrtype\x00', 0x0, {0x2, 0x40}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x8}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@icmp={0x28, 'icmp\x00', 0x0, {0x5, 0x3f, 0x8}}]}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00'}}, {{@uncond, 0x0, 0xb8, 0xe0, 0x0, {}, [@common=@socket0={0x20, 'socket\x00'}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x2, 0x20}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x590) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, 0x0) mkdir(&(0x7f0000000700)='./file1\x00', 0x8f) r2 = creat(&(0x7f0000000000)='./file1/file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='overlay\x00', 0x0, &(0x7f0000000d40)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000008b80)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x0, 0x4}}, 0x20) r3 = syz_open_dev$vivid(&(0x7f0000000140)='/dev/video#\x00', 0x0, 0x2) getrlimit(0x4, &(0x7f0000000100)) ioctl$VIDIOC_G_PARM(r3, 0xc0cc5615, &(0x7f0000000280)={0x0, @raw_data="e2c07d6cf34bf7373565792741030de9a1e6aed734cf96219aef2e7161b85c9bcef026dd8b9ed964f27968e1ae04e4d670f21d37430ba4a233cb3210be29d673e331782805750fb60d88599cb98b2fdfb5c8d37b2d44b2670d24b2cff3eeb345da7557447501fd0b92c09a9f1dda3cf986ccfdc0c44cd457c286c7d9e167854fe4c2da327c794b44d6d17d0b6d6a14ba1d6ad70966091586e5db2b4c3f4f50e18fabe3d3a5eda11b4052545e8ed7aecc0acc3e9a6bdd565d51eed7bab197e5747bdc554a61b0dacc"}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r3, 0x4020565a, &(0x7f00000003c0)={0x8001007, 0x7fffffff}) chdir(&(0x7f0000000180)='./file0\x00') pivot_root(&(0x7f0000000340)='./file2\x00', &(0x7f0000000440)='./file1/file0\x00') link(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='./file1\x00') ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) socket$netlink(0x10, 0x3, 0x2) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f0000000380)={0xa927, 0x13a}) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x40000012, 0xffffffffffffffff, 0x0) 23:02:35 executing program 3: prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x9, 0x8000000000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000004c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001800)=""/255, 0xff}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r4 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) setsockopt$inet6_opts(r4, 0x29, 0x37, &(0x7f00000001c0)=@srh={0x32, 0x10, 0x4, 0x8, 0x7f, 0x20, 0x3, [@initdev={0xfe, 0x88, [], 0x0, 0x0}, @empty, @mcast2, @mcast1, @remote, @rand_addr="8bf0303b24f41f2774fa4258c1c0631f", @empty, @empty]}, 0x88) sendmmsg(r4, &(0x7f00000092c0), 0x400000000000064, 0x0) [ 352.117886] FAULT_INJECTION: forcing a failure. [ 352.117886] name failslab, interval 1, probability 0, space 0, times 0 [ 352.129867] CPU: 0 PID: 16267 Comm: syz-executor.4 Not tainted 4.14.146 #0 [ 352.136903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 352.146267] Call Trace: [ 352.148888] dump_stack+0x138/0x197 [ 352.152542] should_fail.cold+0x10f/0x159 [ 352.156713] should_failslab+0xdb/0x130 [ 352.160708] kmem_cache_alloc_trace+0x2e9/0x790 [ 352.165392] ? snd_ctl_find_numid+0xc1/0x120 [ 352.169815] ? snd_ctl_find_numid+0x6c/0x120 [ 352.174247] snd_mixer_oss_get_volume1_sw.isra.0+0x96/0x320 [ 352.175708] binder: 16268:16270 unknown command 64 [ 352.179977] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 352.179996] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 352.180008] ? avc_ss_reset+0x110/0x110 [ 352.180023] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 352.180032] ? lock_downgrade+0x6e0/0x6e0 [ 352.180042] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 352.180053] ? snd_mixer_oss_proc_read+0x250/0x250 [ 352.189187] binder: 16268:16270 ioctl c0306201 20000600 returned -22 [ 352.190097] ? __might_sleep+0x93/0xb0 [ 352.190108] ? __fget+0x210/0x370 [ 352.190123] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 352.190131] snd_mixer_oss_ioctl+0x47/0x60 [ 352.190142] do_vfs_ioctl+0x7ae/0x1060 [ 352.190156] ? selinux_file_mprotect+0x5d0/0x5d0 [ 352.250654] ? lock_downgrade+0x6e0/0x6e0 [ 352.254804] ? ioctl_preallocate+0x1c0/0x1c0 [ 352.259205] ? __fget+0x237/0x370 [ 352.262657] ? security_file_ioctl+0x89/0xb0 [ 352.267059] SyS_ioctl+0x8f/0xc0 [ 352.270417] ? do_vfs_ioctl+0x1060/0x1060 [ 352.274561] do_syscall_64+0x1e8/0x640 [ 352.278456] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 352.283299] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 352.288497] RIP: 0033:0x459a29 [ 352.291677] RSP: 002b:00007fd8fdaa6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 352.299378] RAX: ffffffffffffffda RBX: 00007fd8fdaa6c90 RCX: 0000000000459a29 [ 352.306650] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000006 [ 352.313912] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 352.321174] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8fdaa76d4 [ 352.328435] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000007 23:02:35 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 352.463936] binder: 16268:16280 unknown command 64 23:02:35 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = gettid() sched_setattr(r1, &(0x7f0000000080)={0x30, 0x0, 0x1, 0x5, 0x1000, 0x8, 0x1f, 0x4}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 352.493522] binder: 16268:16280 ioctl c0306201 20000600 returned -22 [ 352.506673] capability: warning: `syz-executor.1' uses deprecated v2 capabilities in a way that may be insecure [ 352.586456] binder: 16287:16290 unknown command 64 [ 352.644806] binder: 16287:16290 ioctl c0306201 20000600 returned -22 23:02:35 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="850000002f000000570000000104000000fcffff0080000026cfd4254d4ddae9ca319d735a29d49be51417a827eed339f8806dd941e641e6faa32bb302fbb8ff62ba89e1ec55f685896b3242c18124a64eb990f0f0aaa0bd59c3bcdcf86e3011fb9048e9248c5e80738d3ec179efbccd0cbeab2a84d57871c35e792059218d5ee73810cd2e5409b8007b7c62c7ac03600771451916742766b6b615dcec19f869cb96aee53a21f968204649ca2d7536e2d90c72985a4483bbdf62"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:35 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(0x0, 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 352.846208] binder: 16295:16297 unknown command 64 23:02:35 executing program 4 (fault-call:21 fault-nth:1): open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:35 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=ANY=[@ANYBLOB="8500006ddbfe3757000000000000109500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:35 executing program 1: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0xcf1e) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) ioctl$EVIOCSKEYCODE_V2(r3, 0x40284504, &(0x7f00000000c0)={0x9c, 0xe, 0x8, 0x5, "6368eab17ee404542acfe1bef86219157b3ccfae024a37b4877030c22ab74f37"}) syz_mount_image$nfs4(&(0x7f0000000300)='nfs4\x00', &(0x7f0000000340)='./bus\x00', 0x2, 0x9, &(0x7f00000009c0)=[{&(0x7f0000000380)="e5405f209a7ffd641fe272b20d1bd0e602dadabc059fa999a35a15d96a7753fcee54af53b812e5d81c0b69ac83b7bf0cec77cd6e82d95cade6d75a899fbbfde2f775f2b545f14fb48309809a191bf10204e49bd9e49ad12891f93fc7738086ae14bb5e4844e64d8d584a283f20573be2a0ba540ad04edeead5dcc9ddf85884de6cc89c2b137e160f957ae73084c745eddc8d87911eef51f7130b0ef3b2ff050163e6de694971fb6b1f3b04f68fd26eb8682677b3baec2080f180828053b5d3ebe1910f21bb6cdba83b433b606021a0cc14f58fac614eef5dce3276203684012001f015408dbfec010866f6643044a52352aaa59ae23265", 0xf7, 0x3f}, {&(0x7f0000000480)="45a8077dd7438bcab4e9d481eb8f758201ee1ba345510e1bd52211806c9adbd2ba8a4d60b3bd2acd467a4c4a6c07fec062b23302d1a972edb4a1c86e4090e701627597afa0e863ed13d57cdd32c04d3c4546e17aab510617cc3772686786d0108f1b85802bc9424786e4929285dbeeb8706b99e2a48392d4fc15487a3d55b7ffb85c7faa057c3494db72b878409ae8c84249c5dae880aaff50ba183796676dd2d5cb9be7a4725605476cc75c9b84c09c", 0xb0, 0x1}, {&(0x7f0000000540)="ce1f00aed0ec613a63a5f9bc6c1cb9a394eb7797a5ca1c5860bee868518b235cdabbb99629d2b29fe37451b90f08808a819a0543c7d5b861ea096d08543ab44b20500672c3bfeec554e2096fa9ce257c2f071bc863f7f546377456b5b975749f2405292cdf00b759f48814f41ca3cd03ad72388afc32ea7edf26e4592e1eac2044e2c1b61cf96e523674ea2263c4fc61c2258891bcda509294910848cb47ddb9aeeeaeb95f71b2b8337ca5667bfaa9b525fa3ee98083386dd3eb6ad78a20d462e6a19bbefc0ad9", 0xc7, 0x80000001}, {&(0x7f0000000640)="afe066c1cc31fd61a47786cb028361291a6b36fc58333e7ce03e35ff0bcb37352e09d0553252876a71b770a58082769be8ff86333add2232d457c131572d883e2018473fcf282843db1ef9048dbafba37871b5548ffd4ffbc4295b", 0x5b, 0xffffffffffffea4c}, {&(0x7f00000006c0)="9f7b70fce3d8ff59779d8ca8f9f5c7dbb9c4d0e7d652c536", 0x18, 0x1}, {&(0x7f0000000700)="2ea72d7a59bd2996efa66eb08a9b1b19cbe128c883787125511dda67408a8c00a0846dea17c0556a922bd2e0e859c181330b80d03b24e7ed0aad29aad926e6609e91a4e01a8405962ae31590133c8af76d01d73c98861f0ed2a86d98c22fa4eee634b9219748abcc09c48a480cbe551a5f0a275d38ca8b484ba1a860eee62a0409993a8f402290fb67771051a9d4025d18fec4190e35", 0x96, 0xd0}, {&(0x7f00000007c0)="817ac2261fafaa5cd14f01657b39bcb92298fa8c3cf1d049", 0x18, 0x6}, {&(0x7f0000000800)="16cbdba33ff0a3d5dbc05d3b3561c27d24df27fc379ea40909ef907eeb2a2d952ae5173d0def35fdfd7aa284ad6dda80815eeb74470ce3884a565fbf0a5305947a87771bade32e11028d05406c0a25ea63d0924c2736c6d9e3398491e6472f6638712ba01031d40495822bd993fd6a5d3f9f83f9bfa427c9d6f513c5d723b02f79e21e14edd98f5f9c392bfe301d9ce5d426f273ae4fc4532a1359eb30597734803ea4752ef252fb94adf7ae97c4a12f5c47dbbdce15b3ec79", 0xb9, 0x4}, {&(0x7f00000008c0)="40993e310cb767e938688f846a160bdf98563f0e25b1a4e78d5d299c99e365af53efac90cc61da7c49a3953deba94784e1d0b4f6678c9aaa5312f7493f4ffbbdf527f6836464c712a4acab60bd8b8f2492eea8e8c4fe42975f376f3da1f72ef37a86839f8302a0286b330afbb5e88260d3a6c655720cfa013532a8ab5402a02c07ebd0a2e5ec8c66fee63f5f463e8ee2b6ad5bcfdddf3a5b9941ad1e88acd94d12a6acb0462cc381d486b2f5463bd72cb5333555fc25ada4a6c975807d7d175b76de1bf4f5a27c27224e939f6ed019770a33a6effbc32b5595bca587532d1f32137c546ccd6b795a42d0820975cc7490", 0xf0, 0x80}], 0x21, &(0x7f0000000ac0)='/dev/dlm-control\x00') openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x143000, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(0xffffffffffffffff, 0x80045700, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r1, &(0x7f00000038c0), 0x4000000000000a8, 0x0) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000001680)='/dev/dlm_plock\x00', 0x40, 0x0) setsockopt$RXRPC_SECURITY_KEY(r4, 0x110, 0x1, &(0x7f0000000280)='\x00', 0x1) r5 = socket(0x0, 0x2, 0x2) r6 = syz_open_dev$radio(0x0, 0x2, 0x2) bind$netlink(r6, 0x0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r5, 0x10e, 0xa, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x4c000) sendmsg$TIPC_NL_MEDIA_GET(r4, &(0x7f0000000240)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x20, 0x0, 0x0, 0x0, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x4001048) r7 = gettid() sched_rr_get_interval(r7, &(0x7f00000002c0)) [ 352.889526] binder: 16295:16297 ioctl c0306201 20000600 returned -22 23:02:35 executing program 3: write$binfmt_script(0xffffffffffffffff, &(0x7f0000000780)=ANY=[@ANYBLOB="2cae7186000000f84582a70a7afb01000000000000cd15c0d03382919b617206f48845890700000000000000e8b754ef30d4dd35d51cf34dd9d3d813f42ab79cc1d9cda1a29a418083b6195c556fdb8a66daecad9c00e56116bfb42854921ca0bda45c12760349355e2f2f13e72b3eb6e800f2a49bd830c06a1b2e65c9068100000000000000550a2b47b490af76634e4c84fcbac36af36ca1440388ce9a0820958790ebe2bbd51843ad4eb14e041bb633ceca744890a009f0a0af8f50b5fcfc12db67ffa1f9e1c648263cad0c903b43607c93403c4b0783e553323b"], 0xdc) rt_sigsuspend(0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000002c0)='comm\x00') open(0x0, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) io_setup(0x3b24, &(0x7f0000000740)=0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) io_submit(r1, 0x6c2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000780), 0x4000}]) [ 352.967428] binder: 16307:16308 unknown command 64 [ 352.973026] binder: 16307:16308 ioctl c0306201 20000600 returned -22 [ 353.046138] binder: 16307:16314 unknown command 64 [ 353.080319] binder: 16307:16314 ioctl c0306201 20000600 returned -22 [ 353.180994] FAULT_INJECTION: forcing a failure. [ 353.180994] name failslab, interval 1, probability 0, space 0, times 0 [ 353.192572] CPU: 1 PID: 16323 Comm: syz-executor.4 Not tainted 4.14.146 #0 [ 353.199617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 353.208982] Call Trace: [ 353.211574] dump_stack+0x138/0x197 [ 353.215225] should_fail.cold+0x10f/0x159 [ 353.219373] should_failslab+0xdb/0x130 [ 353.223356] kmem_cache_alloc_trace+0x2e9/0x790 [ 353.228028] snd_mixer_oss_get_volume1_sw.isra.0+0xce/0x320 [ 353.228043] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 353.228053] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 353.244463] ? avc_ss_reset+0x110/0x110 [ 353.248455] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 353.253137] ? lock_downgrade+0x6e0/0x6e0 [ 353.257379] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 353.257389] ? snd_mixer_oss_proc_read+0x250/0x250 [ 353.257417] ? __might_sleep+0x93/0xb0 [ 353.271810] ? __fget+0x210/0x370 [ 353.275295] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 353.280333] snd_mixer_oss_ioctl+0x47/0x60 [ 353.284573] do_vfs_ioctl+0x7ae/0x1060 [ 353.288468] ? selinux_file_mprotect+0x5d0/0x5d0 [ 353.293231] ? lock_downgrade+0x6e0/0x6e0 [ 353.297382] ? ioctl_preallocate+0x1c0/0x1c0 [ 353.301801] ? __fget+0x237/0x370 [ 353.305262] ? security_file_ioctl+0x89/0xb0 [ 353.309677] SyS_ioctl+0x8f/0xc0 [ 353.313050] ? do_vfs_ioctl+0x1060/0x1060 [ 353.317208] do_syscall_64+0x1e8/0x640 [ 353.321102] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 353.325988] entry_SYSCALL_64_after_hwframe+0x42/0xb7 23:02:36 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000580)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @empty}, {0xa, 0x0, 0x0, @local}, r4}}, 0x48) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000200)={0x16, 0x98, 0xfa00, {&(0x7f00000000c0)={0xffffffffffffffff}, 0x4, r4, 0x1c, 0x1, @in6={0xa, 0x4e24, 0x882e, @remote, 0x6}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f00000002c0)={0x11, 0x10, 0xfa00, {&(0x7f0000000080), r5}}, 0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 353.331185] RIP: 0033:0x459a29 [ 353.334376] RSP: 002b:00007fd8fda85c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 353.342093] RAX: ffffffffffffffda RBX: 00007fd8fda85c90 RCX: 0000000000459a29 [ 353.349394] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000006 [ 353.356781] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 353.364058] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8fda866d4 [ 353.371337] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000007 [ 353.373062] binder: 16326:16327 unknown command 64 23:02:36 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:36 executing program 4 (fault-call:21 fault-nth:2): open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:36 executing program 3: mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) socketpair(0x9, 0x5, 0x7, &(0x7f0000000000)) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='./file0,lowerdir=.:file0,workdir=./file1\x00\x00\x00\x00\x00\x00\x00\x00\x00']) umount2(&(0x7f0000000080)='./file0\x00', 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x88001) sendfile(r0, r1, 0x0, 0x800000000024) r2 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x2412, 0x100) renameat2(r1, &(0x7f0000000040)='./file1\x00', r2, &(0x7f00000001c0)='./file2\x00', 0x4) [ 353.499829] binder: 16326:16327 ioctl c0306201 20000600 returned -22 [ 353.582275] overlayfs: unrecognized mount option "./file0" or missing value 23:02:36 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000200)={{{@in=@loopback, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@empty}}, &(0x7f0000000300)=0xe8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r5, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r6, r7, 0x0, 0x800000000024) getsockopt$inet6_IPV6_IPSEC_POLICY(r7, 0x29, 0x22, &(0x7f0000000340)={{{@in6=@mcast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@ipv4={[], [], @initdev}}}, &(0x7f0000000440)=0xe8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r10, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r12, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r13, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r14, 0x0) r15 = geteuid() lstat(&(0x7f0000000080)='./bus\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000280)='./control\x00', 0x0, r16) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$system_posix_acl(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='system.posix_acl_access\x00', &(0x7f00000006c0)=ANY=[@ANYBLOB="02000000010006000000000002000200", @ANYRES32=r3, @ANYBLOB="02000f00", @ANYRES32=r5, @ANYBLOB="02000000", @ANYRES32=r8, @ANYBLOB="02000600", @ANYRES32=r10, @ANYBLOB='\b', @ANYRES32=r12, @ANYBLOB="02000400", @ANYRES32=r14, @ANYBLOB="02000500", @ANYRES32=r15, @ANYBLOB="02000100", @ANYRES32, @ANYBLOB="040004000000000008000200", @ANYRES32=r16, @ANYBLOB="08000400", @ANYRES32=r17, @ANYBLOB="08000200", @ANYRES32=0x0, @ANYBLOB="1000040000000000200017e4b5dfa8f1d0dc2ab5ebc68a000000004276915931c2f7087cde13b0ad2a0b389e2b9dd1ac145aa9fb280f88344a6c636241890f76ca1053ae3f993c"], 0x7c, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="850000002f000000570000000000000095000000000000dcbaa70c9d00d22e4b4b332d8bdf3bb1ed44085f7169ffde00000000000059e1a37287d895254ecebd0d10fb3a2961430c22c7660be9f8d12f7d8100095b8ea4a5585d13aec6de21b03aacfe49044ec33e4943cb2415c63075"], &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 353.642780] FAULT_INJECTION: forcing a failure. [ 353.642780] name failslab, interval 1, probability 0, space 0, times 0 [ 353.654117] CPU: 1 PID: 16354 Comm: syz-executor.4 Not tainted 4.14.146 #0 [ 353.661137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 353.661145] Call Trace: [ 353.673112] dump_stack+0x138/0x197 [ 353.676752] should_fail.cold+0x10f/0x159 [ 353.676773] should_failslab+0xdb/0x130 [ 353.684884] kmem_cache_alloc_trace+0x2e9/0x790 [ 353.689577] snd_mixer_oss_get_volume1_sw.isra.0+0x96/0x320 [ 353.695306] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 353.700426] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 353.706072] ? avc_ss_reset+0x110/0x110 [ 353.710078] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 353.714759] ? lock_downgrade+0x6e0/0x6e0 [ 353.718924] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 353.724563] ? snd_mixer_oss_proc_read+0x250/0x250 [ 353.729504] ? _remove_lock.isra.0+0x280/0x300 [ 353.734102] ? __might_sleep+0x93/0xb0 [ 353.734114] ? __fget+0x210/0x370 [ 353.734132] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 353.734142] snd_mixer_oss_ioctl+0x47/0x60 [ 353.734153] do_vfs_ioctl+0x7ae/0x1060 [ 353.734164] ? selinux_file_mprotect+0x5d0/0x5d0 [ 353.734174] ? lock_downgrade+0x6e0/0x6e0 [ 353.734184] ? ioctl_preallocate+0x1c0/0x1c0 [ 353.734199] ? __fget+0x237/0x370 [ 353.734215] ? security_file_ioctl+0x89/0xb0 [ 353.741539] SyS_ioctl+0x8f/0xc0 [ 353.741549] ? do_vfs_ioctl+0x1060/0x1060 [ 353.741564] do_syscall_64+0x1e8/0x640 [ 353.741573] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 353.741593] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 353.741600] RIP: 0033:0x459a29 [ 353.741605] RSP: 002b:00007fd8fdaa6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 353.741614] RAX: ffffffffffffffda RBX: 00007fd8fdaa6c90 RCX: 0000000000459a29 [ 353.741620] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000006 [ 353.741625] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 353.741630] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8fdaa76d4 23:02:36 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(0x0, 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 353.741635] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000007 23:02:36 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000002880)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="48c0"]) preadv(r2, &(0x7f0000000740)=[{&(0x7f0000000600)=""/164, 0xa4}], 0x1, 0x0) read$FUSE(r2, &(0x7f0000000780), 0x1000) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r1) write$FUSE_INIT(r2, &(0x7f0000000300)={0x50, 0x0, 0x1}, 0x50) listxattr(&(0x7f0000000000)='./file0\x00', 0x0, 0xfffffffffffffe80) write$FUSE_DIRENT(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="10000000daffffff020000000a000000"], 0x10) ioctl$VIDIOC_ENUMAUDOUT(0xffffffffffffffff, 0xc0345642, &(0x7f0000000080)={0x7, "f9ab9e8c41898b460d02413cabe7bdb0317c0b19011c17ccde43caebccd7a044", 0x2, 0x1}) [ 353.882347] overlayfs: unrecognized mount option "./file0" or missing value 23:02:36 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x481, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012000c00010076244b1a0f6c6574682400000018000200140001", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x48}}, 0x0) 23:02:36 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x101, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000500)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0xfffffffffffffde3, 0x3, &(0x7f0000000380)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={@flat=@handle={0x73682a85, 0x4, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/219, 0x0, 0x2, 0x13}, @fda={0x66646185, 0x5, 0x10000000, 0x1c}}, &(0x7f00000000c0)}, 0x40}, @register_looper], 0xffffffffffffff0a, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) fallocate(r2, 0x18, 0x401, 0x4) r4 = socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f00000004c0)='./bus\x00', 0x400000, 0x40) ftruncate(0xffffffffffffffff, 0x88001) sendfile(r4, 0xffffffffffffffff, 0x0, 0x800000000024) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r6, 0x0) r7 = socket$inet6(0xa, 0x400000000001, 0x0) close(r7) r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r8, 0x88001) sendfile(r7, r8, 0x0, 0x800000000024) r9 = accept$nfc_llcp(r8, &(0x7f0000000580), &(0x7f0000000640)=0x60) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3c) ptrace$cont(0x18, r10, 0x0, 0x0) ptrace$setregs(0xd, r10, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r10, 0x0, 0x0) sendmsg$netlink(r0, &(0x7f0000000800)={&(0x7f0000000540)=@proc={0x10, 0x0, 0x25dfdbfc, 0xa0822640}, 0xc, &(0x7f00000007c0)=[{&(0x7f0000000680)={0x13c, 0x3c, 0x2, 0x70bd29, 0x25dfdbff, "", [@nested={0x12c, 0x8f, [@typed={0x8, 0x2c, @uid=r6}, @typed={0x8, 0x3b, @fd=r9}, @typed={0x8, 0x42, @ipv4=@broadcast}, @typed={0x8, 0x64, @pid=r10}, @typed={0x8, 0x56, @ipv4=@loopback}, @generic="d43e25884c664b1069ed96818b799a3eb4af2a28db031e42a459a397aef9d0fedd9a4889f2bab0f6295b0c7ad17e957b6d3262c99e4a7b66be5f5b0095a7a24753a70a6ce183928c08718b01e4de140f72681dd74aac37321a484caeabb8bdd9d2453138204101821019aa52b44d73ece926d90525e18a917cc024b60abb83c7af6df17e1edce842d52bf08218874f020c344b4f1aa54e8b3155db8ecab44da253dcadaba30ccda436222d7d75af91aec1f635933a6e1f0dd972a4b592721b07e82e3931aa7174fdc37bf08548c4e3287e9747b948dfad4c2529a7d5b5869de5b22a223cf37e7e9a3b7921f4f05a2849e2", @typed={0xc, 0x1a, @binary="186608d7dac1"}]}]}, 0x13c}], 0x1, 0x0, 0x0, 0x4000010}, 0x411c) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5335, &(0x7f0000000400)={0x2, 0x7f, 0xfffffff7, 'queue0\x00', 0x9}) msgget(0x0, 0x509) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) [ 353.976331] binder: 16378:16379 ioctl c0306201 20000600 returned -14 23:02:37 executing program 2: ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f0000000080)={0x2, 0xfffffffb, 0x40, 0x0, 0x4}) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r1, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f0000000280)={@nl=@unspec, {&(0x7f0000000200)=""/49, 0x31}, &(0x7f0000000240), 0x2}, 0xa0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="0863104000000000000000000000000000000000b8250e08ecf2f1e2cb38fbbc494d7b13b9167384247f7c9229cf142ddb51ac1f3905fa1d5409db1179"], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:37 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x101, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000500)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0xfffffffffffffde3, 0x3, &(0x7f0000000380)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={@flat=@handle={0x73682a85, 0x4, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/219, 0x0, 0x2, 0x13}, @fda={0x66646185, 0x5, 0x10000000, 0x1c}}, &(0x7f00000000c0)}, 0x40}, @register_looper], 0xffffffffffffff0a, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) fallocate(r2, 0x18, 0x401, 0x4) r4 = socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f00000004c0)='./bus\x00', 0x400000, 0x40) ftruncate(0xffffffffffffffff, 0x88001) sendfile(r4, 0xffffffffffffffff, 0x0, 0x800000000024) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r6, 0x0) r7 = socket$inet6(0xa, 0x400000000001, 0x0) close(r7) r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r8, 0x88001) sendfile(r7, r8, 0x0, 0x800000000024) r9 = accept$nfc_llcp(r8, &(0x7f0000000580), &(0x7f0000000640)=0x60) r10 = gettid() ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x3c) ptrace$cont(0x18, r10, 0x0, 0x0) ptrace$setregs(0xd, r10, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r10, 0x0, 0x0) sendmsg$netlink(r0, &(0x7f0000000800)={&(0x7f0000000540)=@proc={0x10, 0x0, 0x25dfdbfc, 0xa0822640}, 0xc, &(0x7f00000007c0)=[{&(0x7f0000000680)={0x13c, 0x3c, 0x2, 0x70bd29, 0x25dfdbff, "", [@nested={0x12c, 0x8f, [@typed={0x8, 0x2c, @uid=r6}, @typed={0x8, 0x3b, @fd=r9}, @typed={0x8, 0x42, @ipv4=@broadcast}, @typed={0x8, 0x64, @pid=r10}, @typed={0x8, 0x56, @ipv4=@loopback}, @generic="d43e25884c664b1069ed96818b799a3eb4af2a28db031e42a459a397aef9d0fedd9a4889f2bab0f6295b0c7ad17e957b6d3262c99e4a7b66be5f5b0095a7a24753a70a6ce183928c08718b01e4de140f72681dd74aac37321a484caeabb8bdd9d2453138204101821019aa52b44d73ece926d90525e18a917cc024b60abb83c7af6df17e1edce842d52bf08218874f020c344b4f1aa54e8b3155db8ecab44da253dcadaba30ccda436222d7d75af91aec1f635933a6e1f0dd972a4b592721b07e82e3931aa7174fdc37bf08548c4e3287e9747b948dfad4c2529a7d5b5869de5b22a223cf37e7e9a3b7921f4f05a2849e2", @typed={0xc, 0x1a, @binary="186608d7dac1"}]}]}, 0x13c}], 0x1, 0x0, 0x0, 0x4000010}, 0x411c) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5335, &(0x7f0000000400)={0x2, 0x7f, 0xfffffff7, 'queue0\x00', 0x9}) msgget(0x0, 0x509) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:37 executing program 1: r0 = socket$inet6_sctp(0xa, 0x4000000000000001, 0x84) arch_prctl$ARCH_SET_CPUID(0x1012, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x3, 0x0, @loopback}, 0x1c) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0xee00, r2, 0x0) sendto$inet6(r0, &(0x7f0000847fff)='X', 0xb, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 354.215424] binder: 16390:16393 unknown command 64 [ 354.221821] binder: 16390:16393 ioctl c0306201 20000600 returned -22 [ 354.246557] binder: 16391:16395 ioctl c0306201 20000600 returned -14 23:02:37 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, 0x0, 0x0) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:37 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) getsockopt$inet_mreqn(r2, 0x0, 0x20, &(0x7f0000000280)={@rand_addr, @remote, 0x0}, &(0x7f00000002c0)=0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x2, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], r3, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0xffffffff}}, 0xffffffffffffff86) [ 354.363403] binder: 16402:16405 unknown command 64 23:02:37 executing program 4 (fault-call:21 fault-nth:3): open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:37 executing program 3: setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000080)={0x0, 0x0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/audio\x00', 0x80, 0x0) ioctl$KVM_SET_PIT(r4, 0x8048ae66, &(0x7f00000002c0)={[{0x5, 0x1ff, 0x9, 0x58, 0x4, 0x93, 0xff, 0x7f, 0xfc, 0x5, 0x81, 0xba, 0x4}, {0x5, 0x9, 0x3, 0x7f, 0xb5, 0x0, 0x7, 0x6, 0x2, 0x9, 0x0, 0x7, 0x9f5a}, {0x2, 0xff, 0x1, 0x2, 0x1f, 0xd0, 0x2, 0x7, 0x2, 0x8, 0x8, 0x38, 0x5}], 0x3}) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) ioctl$sock_ifreq(0xffffffffffffffff, 0x8937, &(0x7f0000000100)={'veth0\x00', @ifru_settings={0x10001, 0x0, @fr=0x0}}) getsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f0000000280), &(0x7f0000000580)=0x4) sched_setattr(0x0, 0x0, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) r6 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) fchdir(r6) ioctl$PIO_SCRNMAP(r6, 0x4b41, &(0x7f0000000140)="f24a3937c8255886a4067e077776b3996cc3e75d4c7fff021b67f1d317f66233b65fd59d5444dde9153ca2d8854359a033d70393c6238a1a022ca90ba68abffbc0997cf071129d550efeccefc35f7701dcbba3625b863ca407f8487eed825a86ca946732ab2bfaa6596166e0232f6ad8be0973ae3e5305c605e119cf68a0cf12056f827b4d4fdc0a058d811e0be37ca92b93ede0de1b0412de9d4c2b4eb17630921c88de495072dd5303a6") ioctl$sock_inet6_SIOCADDRT(r5, 0x89a0, &(0x7f0000000340)={@dev={0xfe, 0x80, [], 0x23}, @remote, @dev={0xfe, 0x80, [], 0xa}, 0x1, 0xfffc, 0x0, 0x100}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 23:02:37 executing program 1: pselect6(0x40, &(0x7f00000000c0)={0x1, 0x8, 0x8087, 0x4, 0xa06, 0x1, 0x7ff, 0x1c54}, &(0x7f0000000200)={0x2, 0x6, 0x7fff, 0x5, 0x100000000, 0x7, 0x5ee, 0x4fe}, &(0x7f0000000240)={0x3, 0x6, 0x8, 0x3, 0x80000001, 0x9, 0x71c1, 0x6}, &(0x7f0000000280)={0x77359400}, &(0x7f0000000400)={&(0x7f00000003c0)={0xc69}, 0x8}) preadv(0xffffffffffffffff, &(0x7f0000001300), 0x0, 0x10000000) ioctl$DRM_IOCTL_SET_MASTER(0xffffffffffffffff, 0x641e) syz_init_net_socket$netrom(0x6, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$tipc2(0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x9) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/snmp\x00') preadv(r0, &(0x7f0000001300), 0x0, 0x10000000) ioctl$PPPIOCSMRRU(r0, 0x4004743b, &(0x7f0000000380)=0x80) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x2001, 0x0) ioctl$KVM_GET_XSAVE(0xffffffffffffffff, 0x9000aea4, &(0x7f0000000800)) write$vhci(0xffffffffffffffff, 0x0, 0x0) symlink(&(0x7f0000000040)='./file1\x00', &(0x7f0000000000)='.//ile0\x00') mkdir(&(0x7f0000000340)='./file0\x00', 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000500)={0x0, 0x5, 0x0, 0x0, 0xa251}, &(0x7f0000000540)=0x18) mount$overlay(0x400000, &(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="75707065726469723d2e2f66696cc1e676ba8b0c7965302c6c6f7765726469723d2e3a66696c65302c776f726b6469723d"]) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) renameat(r1, &(0x7f0000000180)='.//ile0\x00', r1, &(0x7f00000007c0)='./file0/f.le.\x00') [ 354.399472] binder: 16402:16405 ioctl c0306201 20000600 returned -22 [ 354.539476] overlayfs: unrecognized mount option "workdir=" or missing value [ 354.645738] FAULT_INJECTION: forcing a failure. [ 354.645738] name failslab, interval 1, probability 0, space 0, times 0 [ 354.657031] CPU: 0 PID: 16433 Comm: syz-executor.4 Not tainted 4.14.146 #0 [ 354.664054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 354.673428] Call Trace: [ 354.676024] dump_stack+0x138/0x197 [ 354.679653] should_fail.cold+0x10f/0x159 [ 354.683794] should_failslab+0xdb/0x130 [ 354.687756] kmem_cache_alloc_trace+0x2e9/0x790 [ 354.692428] snd_mixer_oss_get_volume1_sw.isra.0+0xce/0x320 [ 354.698129] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 354.703222] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 354.708844] ? avc_ss_reset+0x110/0x110 [ 354.712807] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 354.717458] ? lock_downgrade+0x6e0/0x6e0 [ 354.721592] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 354.727201] ? snd_mixer_oss_proc_read+0x250/0x250 [ 354.732137] ? __might_sleep+0x93/0xb0 [ 354.736019] ? __fget+0x210/0x370 [ 354.739506] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 354.744555] snd_mixer_oss_ioctl+0x47/0x60 [ 354.748784] do_vfs_ioctl+0x7ae/0x1060 [ 354.752706] ? selinux_file_mprotect+0x5d0/0x5d0 [ 354.757446] ? lock_downgrade+0x6e0/0x6e0 [ 354.761575] ? ioctl_preallocate+0x1c0/0x1c0 [ 354.766008] ? __fget+0x237/0x370 [ 354.769446] ? security_file_ioctl+0x89/0xb0 [ 354.773837] SyS_ioctl+0x8f/0xc0 [ 354.777185] ? do_vfs_ioctl+0x1060/0x1060 [ 354.781363] do_syscall_64+0x1e8/0x640 [ 354.785232] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 354.790066] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 354.795286] RIP: 0033:0x459a29 [ 354.798458] RSP: 002b:00007fd8fda64c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 354.806193] RAX: ffffffffffffffda RBX: 00007fd8fda64c90 RCX: 0000000000459a29 [ 354.813456] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000006 [ 354.820741] RBP: 000000000075c1c0 R08: 0000000000000000 R09: 0000000000000000 [ 354.828017] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8fda656d4 [ 354.835279] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000007 23:02:37 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f00000000c0)={{0x77359400}, {r1, r2+30000000}}, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000600)={0x14, 0x3, &(0x7f0000000000)=[@increfs_done], 0x0, 0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x8, 0x3, &(0x7f0000c91000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0x57}}, &(0x7f0000000000)='syzkaller\x00'}, 0x48) 23:02:37 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:37 executing program 4 (fault-call:21 fault-nth:4): open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 354.939401] binder: 16435:16439 unknown command 64 [ 354.948534] overlayfs: unrecognized mount option "workdir=" or missing value [ 354.969324] binder: 16435:16439 ioctl c0306201 20000600 returned -22 23:02:38 executing program 2: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(0x0, 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:38 executing program 1: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(0x0, 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 355.220495] FAULT_INJECTION: forcing a failure. [ 355.220495] name failslab, interval 1, probability 0, space 0, times 0 [ 355.231777] CPU: 1 PID: 16463 Comm: syz-executor.4 Not tainted 4.14.146 #0 [ 355.238797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 355.248152] Call Trace: [ 355.250755] dump_stack+0x138/0x197 [ 355.254378] should_fail.cold+0x10f/0x159 [ 355.258514] should_failslab+0xdb/0x130 [ 355.262475] kmem_cache_alloc_trace+0x2e9/0x790 [ 355.267135] snd_mixer_oss_get_volume1_sw.isra.0+0x96/0x320 [ 355.272834] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 355.277921] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 355.283527] ? avc_ss_reset+0x110/0x110 [ 355.287489] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 355.292141] ? lock_downgrade+0x6e0/0x6e0 [ 355.296277] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 355.301884] ? snd_mixer_oss_proc_read+0x250/0x250 [ 355.306818] ? __might_sleep+0x93/0xb0 [ 355.310691] ? __fget+0x210/0x370 [ 355.314131] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 355.319128] snd_mixer_oss_ioctl+0x47/0x60 [ 355.323345] do_vfs_ioctl+0x7ae/0x1060 [ 355.336503] ? selinux_file_mprotect+0x5d0/0x5d0 [ 355.341328] ? lock_downgrade+0x6e0/0x6e0 [ 355.345457] ? ioctl_preallocate+0x1c0/0x1c0 [ 355.349851] ? __fget+0x237/0x370 [ 355.353293] ? security_file_ioctl+0x89/0xb0 [ 355.357693] SyS_ioctl+0x8f/0xc0 [ 355.361041] ? do_vfs_ioctl+0x1060/0x1060 [ 355.365175] do_syscall_64+0x1e8/0x640 [ 355.369042] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 355.373872] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 355.384255] RIP: 0033:0x459a29 [ 355.387423] RSP: 002b:00007fd8fda64c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 355.395111] RAX: ffffffffffffffda RBX: 00007fd8fda64c90 RCX: 0000000000459a29 [ 355.402362] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000006 [ 355.409623] RBP: 000000000075c1c0 R08: 0000000000000000 R09: 0000000000000000 [ 355.416873] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8fda656d4 [ 355.424123] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000007 23:02:38 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, 0x0, 0x0) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:38 executing program 3: syz_emit_ethernet(0x69, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaaaaaaaa020000ff000091002900810049000011545540f514579000dd18180b4f2502010033891af2a972d39e38c811081526b3209472b6a4b1bb0400bd5ad8f0ff1141fc5dd429b55dff40f77269a51fdda03b48ab95d3825f43af714137f4f46fa6018a332a"], 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000040)={0x1}) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cpuset.effective_cpus\x00', 0x26e1, 0x0) socket$alg(0x26, 0x5, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f00000001c0)={0x1, 0x7e, 0x0, 0x6}, 0x10) socket$inet6(0xa, 0x9, 0x7fc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000300)=0x6) r2 = bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffdc1) ioctl(r2, 0x10000, &(0x7f0000000140)="153f6234488dd25d766070") socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000540)={0xffffffffffffffff}) r4 = socket(0x11, 0x3, 0x8) r5 = syz_open_dev$amidi(&(0x7f0000000340)='/dev/amidi#\x00', 0x6, 0x10000) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000800)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000440)=r6) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x10}) ioctl$RTC_WKALM_RD(r5, 0x80287010, &(0x7f00000002c0)) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @empty, 0x4e24, 0x3, 'lblcr\x00', 0x3a, 0x0, 0x3c}, {@remote, 0x4e21, 0x6, 0xffff, 0x7f, 0x2}}, 0x44) r7 = memfd_create(&(0x7f0000000c40)='memory.events\x00\xf0\xb5zCw/Z3\xac\xa2\xd2\xc4\x1c~\xf9M\xe7\xd2R\xe9\x1f\x99 >\xa7\xfe\xb6\xcbQH\xf5\xee\xdfL\xbev\x98\'\x14\xbd\"\xcfT\xde\xe7\x11+\xa5\x9b\xbdMy\xc7\x9b\x9a\x8d\xf5\x978\xb8\x8e>X\xeaq\x9a\xc4\x90\x14\xf5\xae\x90\v\x06\x86\xd1\x1d\x82n\xfa7\xe7}\xc9\xf1u\xee\xb9\xf2\ar\xc8\xeb\x15\x93\xf7\xd5\x14\x8dD\x88\xe4\xca3\x032f\x11%s\xc28\x94\xb9\xd8\xa2\x86\x8c\xf9\xa3;G\x90\xef\xbf\xd9\xb5j}\xec\xc9\x1f&r\xb9I\xba`\xc0\xfen\xf0\xe8\x03\xf0\xee\x82\xbd5b=\xd9\xda^\xb7k`\xedz\x86P\xba\xc9\v\x1fgt\xbaN\xfe7)\xd5\xa4\xf9\xc0\xfa\f_\x15\xd5\xe2v\r)\xa6\xdc\xe3B\x17\xb2\xb2\a\xad\xe6\xa0*\x95\xb2\x91,^\xed3o\x1di\x14\x81>\xa8\xdcb\xe7\x8a\xfc', 0x0) write$binfmt_misc(r5, &(0x7f0000000c40)=ANY=[], 0x0) close(r1) r8 = dup3(r1, r7, 0x10000) setsockopt$inet_sctp_SCTP_EVENTS(r8, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x1, 0x40, 0x7, 0x1f, 0x6, 0x100000000, 0x8001, 0x7d, 0x2, 0x86}, 0xb) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[]}}, 0xffffffffbffffffc) r9 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) epoll_create1(0x0) sendmsg$nl_route(r9, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000400)=@ipv4_newrule={0x2c, 0x20, 0xf29, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@FRA_GENERIC_POLICY=@FRA_UID_RANGE={0xc}]}, 0xfc70}}, 0x0) 23:02:38 executing program 4 (fault-call:21 fault-nth:5): open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 355.748299] bridge0: port 3(team0) entered blocking state [ 355.818767] FAULT_INJECTION: forcing a failure. [ 355.818767] name failslab, interval 1, probability 0, space 0, times 0 [ 355.830457] CPU: 1 PID: 16484 Comm: syz-executor.4 Not tainted 4.14.146 #0 [ 355.837485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 355.846840] Call Trace: [ 355.849425] dump_stack+0x138/0x197 [ 355.853050] should_fail.cold+0x10f/0x159 [ 355.857190] should_failslab+0xdb/0x130 [ 355.861149] kmem_cache_alloc_trace+0x2e9/0x790 [ 355.865809] snd_mixer_oss_get_volume1_sw.isra.0+0xce/0x320 [ 355.871531] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 355.876624] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 355.882241] ? avc_ss_reset+0x110/0x110 [ 355.886210] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 355.890865] ? lock_downgrade+0x6e0/0x6e0 [ 355.894999] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 355.900605] ? snd_mixer_oss_proc_read+0x250/0x250 [ 355.905545] ? __might_sleep+0x93/0xb0 [ 355.909413] ? __fget+0x210/0x370 [ 355.912850] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 355.917847] snd_mixer_oss_ioctl+0x47/0x60 [ 355.922067] do_vfs_ioctl+0x7ae/0x1060 [ 355.925939] ? selinux_file_mprotect+0x5d0/0x5d0 [ 355.930676] ? lock_downgrade+0x6e0/0x6e0 [ 355.934810] ? ioctl_preallocate+0x1c0/0x1c0 [ 355.939226] ? __fget+0x237/0x370 [ 355.942676] ? security_file_ioctl+0x89/0xb0 [ 355.947079] SyS_ioctl+0x8f/0xc0 [ 355.950433] ? do_vfs_ioctl+0x1060/0x1060 [ 355.954569] do_syscall_64+0x1e8/0x640 [ 355.958435] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 355.963262] entry_SYSCALL_64_after_hwframe+0x42/0xb7 23:02:39 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 355.968447] RIP: 0033:0x459a29 [ 355.971617] RSP: 002b:00007fd8fdaa6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 355.979323] RAX: ffffffffffffffda RBX: 00007fd8fdaa6c90 RCX: 0000000000459a29 [ 355.986577] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000006 [ 355.993828] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 356.001081] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8fdaa76d4 [ 356.008344] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000007 23:02:39 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) ioctl$TIOCSLCKTRMIOS(r0, 0x5457, &(0x7f0000000100)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_GROUP_FWD_MASK={0x8, 0x9, 0xffff}]}}}]}, 0x3c}}, 0x0) 23:02:39 executing program 2: r0 = socket$inet6(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r4 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) write$P9_RVERSION(r4, &(0x7f0000000140)={0x15, 0x65, 0xffff, 0x4, 0x8, '9P2000.L'}, 0x15) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) bind$packet(r3, &(0x7f0000000080)={0x11, 0x96, 0x0, 0x1, 0x9, 0x6, @random="1fd7de9b0cad"}, 0x14) ioctl(r1, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") sendmsg(r0, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="5500000018007f1412fe01b2a4a280930a06000000a84306910000000b000f0035020000060000001900154006000001d40000dc1338d54400009b84136ef75afb83de44110016000d0002000000060cec4faba7d4", 0x55}], 0x1}, 0x0) [ 356.069354] bridge0: port 3(team0) entered disabled state [ 356.103858] device team0 entered promiscuous mode [ 356.118417] device team_slave_0 entered promiscuous mode [ 356.135380] device team_slave_1 entered promiscuous mode [ 356.163650] bridge0: port 3(team0) entered blocking state [ 356.169639] bridge0: port 3(team0) entered forwarding state [ 356.313674] netlink: 9 bytes leftover after parsing attributes in process `syz-executor.2'. 23:02:39 executing program 3: syz_emit_ethernet(0x69, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaaaaaaaa020000ff000091002900810049000011545540f514579000dd18180b4f2502010033891af2a972d39e38c811081526b3209472b6a4b1bb0400bd5ad8f0ff1141fc5dd429b55dff40f77269a51fdda03b48ab95d3825f43af714137f4f46fa6018a332a"], 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000040)={0x1}) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cpuset.effective_cpus\x00', 0x26e1, 0x0) socket$alg(0x26, 0x5, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f00000001c0)={0x1, 0x7e, 0x0, 0x6}, 0x10) socket$inet6(0xa, 0x9, 0x7fc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000300)=0x6) r2 = bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffdc1) ioctl(r2, 0x10000, &(0x7f0000000140)="153f6234488dd25d766070") socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000540)={0xffffffffffffffff}) r4 = socket(0x11, 0x3, 0x8) r5 = syz_open_dev$amidi(&(0x7f0000000340)='/dev/amidi#\x00', 0x6, 0x10000) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000800)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000440)=r6) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x10}) ioctl$RTC_WKALM_RD(r5, 0x80287010, &(0x7f00000002c0)) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @empty, 0x4e24, 0x3, 'lblcr\x00', 0x3a, 0x0, 0x3c}, {@remote, 0x4e21, 0x6, 0xffff, 0x7f, 0x2}}, 0x44) r7 = memfd_create(&(0x7f0000000c40)='memory.events\x00\xf0\xb5zCw/Z3\xac\xa2\xd2\xc4\x1c~\xf9M\xe7\xd2R\xe9\x1f\x99 >\xa7\xfe\xb6\xcbQH\xf5\xee\xdfL\xbev\x98\'\x14\xbd\"\xcfT\xde\xe7\x11+\xa5\x9b\xbdMy\xc7\x9b\x9a\x8d\xf5\x978\xb8\x8e>X\xeaq\x9a\xc4\x90\x14\xf5\xae\x90\v\x06\x86\xd1\x1d\x82n\xfa7\xe7}\xc9\xf1u\xee\xb9\xf2\ar\xc8\xeb\x15\x93\xf7\xd5\x14\x8dD\x88\xe4\xca3\x032f\x11%s\xc28\x94\xb9\xd8\xa2\x86\x8c\xf9\xa3;G\x90\xef\xbf\xd9\xb5j}\xec\xc9\x1f&r\xb9I\xba`\xc0\xfen\xf0\xe8\x03\xf0\xee\x82\xbd5b=\xd9\xda^\xb7k`\xedz\x86P\xba\xc9\v\x1fgt\xbaN\xfe7)\xd5\xa4\xf9\xc0\xfa\f_\x15\xd5\xe2v\r)\xa6\xdc\xe3B\x17\xb2\xb2\a\xad\xe6\xa0*\x95\xb2\x91,^\xed3o\x1di\x14\x81>\xa8\xdcb\xe7\x8a\xfc', 0x0) write$binfmt_misc(r5, &(0x7f0000000c40)=ANY=[], 0x0) close(r1) r8 = dup3(r1, r7, 0x10000) setsockopt$inet_sctp_SCTP_EVENTS(r8, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x1, 0x40, 0x7, 0x1f, 0x6, 0x100000000, 0x8001, 0x7d, 0x2, 0x86}, 0xb) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[]}}, 0xffffffffbffffffc) r9 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) epoll_create1(0x0) sendmsg$nl_route(r9, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000400)=@ipv4_newrule={0x2c, 0x20, 0xf29, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@FRA_GENERIC_POLICY=@FRA_UID_RANGE={0xc}]}, 0xfc70}}, 0x0) 23:02:39 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mkdir(&(0x7f0000000180)='./file1\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="757070657c6469723d2e2f66696c65302c6c6f77657264040000000000000065302c776c65315c0058fa75d193709ea970ecfde14e6a5ca3132709ed9bc1c912cabf225a834ee96d3a4ee9cdcd1c9c2873e0a44c254d7ab90916fe8735b72fa4f75ca52c4df96b9745cf7810cb0b6ac9cd735c224bb48145234ac1a6e86282d71dc49880848a92567914990218144c8b331edaad3ea484b0d926e6ef13a0007b60ba85a1d5a4a7d822e34f403258ddc7f3a1258e8405"]) setxattr(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)=@known='trusted.overlay.impure\x00', 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x88001) sendfile(r0, r1, 0x0, 0x800000000024) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0xae, 0x8001}}) 23:02:39 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, 0x0, 0x0) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:39 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x3, &(0x7f00000001c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x19f}]) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) r4 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r4, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r4, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) setsockopt$EBT_SO_SET_COUNTERS(r4, 0x0, 0x81, &(0x7f00000000c0)={'filter\x00', 0x0, 0x0, 0x0, [], 0x0, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x78) sendfile(r2, r3, 0x0, 0x800000000024) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000080)={0x0, @aes128}) 23:02:39 executing program 4 (fault-call:21 fault-nth:6): open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 356.509168] overlayfs: unrecognized mount option "uppe|dir=./file0" or missing value 23:02:39 executing program 3: syz_emit_ethernet(0x69, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaaaaaaaa020000ff000091002900810049000011545540f514579000dd18180b4f2502010033891af2a972d39e38c811081526b3209472b6a4b1bb0400bd5ad8f0ff1141fc5dd429b55dff40f77269a51fdda03b48ab95d3825f43af714137f4f46fa6018a332a"], 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000040)={0x1}) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cpuset.effective_cpus\x00', 0x26e1, 0x0) socket$alg(0x26, 0x5, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f00000001c0)={0x1, 0x7e, 0x0, 0x6}, 0x10) socket$inet6(0xa, 0x9, 0x7fc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000300)=0x6) r2 = bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffdc1) ioctl(r2, 0x10000, &(0x7f0000000140)="153f6234488dd25d766070") socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000540)={0xffffffffffffffff}) r4 = socket(0x11, 0x3, 0x8) r5 = syz_open_dev$amidi(&(0x7f0000000340)='/dev/amidi#\x00', 0x6, 0x10000) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000800)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000440)=r6) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x10}) ioctl$RTC_WKALM_RD(r5, 0x80287010, &(0x7f00000002c0)) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @empty, 0x4e24, 0x3, 'lblcr\x00', 0x3a, 0x0, 0x3c}, {@remote, 0x4e21, 0x6, 0xffff, 0x7f, 0x2}}, 0x44) r7 = memfd_create(&(0x7f0000000c40)='memory.events\x00\xf0\xb5zCw/Z3\xac\xa2\xd2\xc4\x1c~\xf9M\xe7\xd2R\xe9\x1f\x99 >\xa7\xfe\xb6\xcbQH\xf5\xee\xdfL\xbev\x98\'\x14\xbd\"\xcfT\xde\xe7\x11+\xa5\x9b\xbdMy\xc7\x9b\x9a\x8d\xf5\x978\xb8\x8e>X\xeaq\x9a\xc4\x90\x14\xf5\xae\x90\v\x06\x86\xd1\x1d\x82n\xfa7\xe7}\xc9\xf1u\xee\xb9\xf2\ar\xc8\xeb\x15\x93\xf7\xd5\x14\x8dD\x88\xe4\xca3\x032f\x11%s\xc28\x94\xb9\xd8\xa2\x86\x8c\xf9\xa3;G\x90\xef\xbf\xd9\xb5j}\xec\xc9\x1f&r\xb9I\xba`\xc0\xfen\xf0\xe8\x03\xf0\xee\x82\xbd5b=\xd9\xda^\xb7k`\xedz\x86P\xba\xc9\v\x1fgt\xbaN\xfe7)\xd5\xa4\xf9\xc0\xfa\f_\x15\xd5\xe2v\r)\xa6\xdc\xe3B\x17\xb2\xb2\a\xad\xe6\xa0*\x95\xb2\x91,^\xed3o\x1di\x14\x81>\xa8\xdcb\xe7\x8a\xfc', 0x0) write$binfmt_misc(r5, &(0x7f0000000c40)=ANY=[], 0x0) close(r1) r8 = dup3(r1, r7, 0x10000) setsockopt$inet_sctp_SCTP_EVENTS(r8, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x1, 0x40, 0x7, 0x1f, 0x6, 0x100000000, 0x8001, 0x7d, 0x2, 0x86}, 0xb) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[]}}, 0xffffffffbffffffc) r9 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) epoll_create1(0x0) sendmsg$nl_route(r9, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000400)=@ipv4_newrule={0x2c, 0x20, 0xf29, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@FRA_GENERIC_POLICY=@FRA_UID_RANGE={0xc}]}, 0xfc70}}, 0x0) [ 356.595285] overlayfs: unrecognized mount option "uppe|dir=./file0" or missing value 23:02:39 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$gfs2(&(0x7f0000000000)='gfs2\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="6c6f63636f6f6b9255ab512f37c234839b12a70b6845399cf3719adb46e1173be89e0b38d1ace17c54894998708d0e8c2d9e3356af6922ca06dfbd80bf470946a223242108bda2cf366a3860d2a5a860e10559705503970bc37a04857ce5468d394b909c6f6f937da00ffb59893d9d613bee5d7a7abe1dcaa1436bfd7f4d69fb3d5b928e44d047bb627b4d1cf3786c30f2c07e3fd11f4e23ab47a27ca25cd3ad1caa565c53cd709a8eb3a912611c3809db0d88aab96830d17adee7962259bf68a4f279c221b378e3e81ba3282c03bb9b49fe3c563e0aac27a5f3a64a1050326d7282d2b8b5920b001000000000000072becd672e46621ec38752488433ba1281103879d81bf443cf655caefd4814ec92cf650e0dff9f055e8f9dc646f9d752a7b5635740e8e4873f888ba6c4d22e095e94502397b551f9e039229f0e6fb4b494ff6840ec3f0aca2910d589e6229bd53f9c0116a22350a178a5e9d88e1b2aea448c67d5394aa79540b4e24f1b74a3eee490fc7fb5bb70f9784eb66b748e6e789de50467d329239705638066e34240627fd3d8e44d1f56c423494d4947d9ff8db362d642371a4561fe23b13d717cad61f6aca09ee3057a78da08404538141ff5f8dd97de"]) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) fsetxattr$security_selinux(r2, &(0x7f0000000180)='security.selinux\x00', &(0x7f0000000200)='system_u:object_r:console_device_t:s0\x00', 0x26, 0x0) [ 356.700465] FAULT_INJECTION: forcing a failure. [ 356.700465] name failslab, interval 1, probability 0, space 0, times 0 [ 356.711882] CPU: 0 PID: 16529 Comm: syz-executor.4 Not tainted 4.14.146 #0 [ 356.718900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 356.718906] Call Trace: [ 356.718927] dump_stack+0x138/0x197 [ 356.718951] should_fail.cold+0x10f/0x159 [ 356.718973] should_failslab+0xdb/0x130 [ 356.730843] gfs2: invalid mount option: loccook’U«Q/7Â4ƒ›§ hE9œóqšÛFá;èž 8Ѭá|T‰I˜pŒ-ž3V¯i"Êß½€¿G F¢#$!½¢Ï6j8`Ò¥¨`áYpU— Ãz…|åF9Kœoo“} ûY‰=a;î]zz¾Ê¡CkýMiû=[’ŽDÐG»b{Móxl0òÀ~?ÑN#«G¢|¢\Ó­ªV\SÍpšŽ³©a8 Û ˆª¹h0ÑzÞç–"Y¿h¤òyÂ!³xãè£( [ 356.730925] kmem_cache_alloc_trace+0x2e9/0x790 [ 356.730948] snd_mixer_oss_get_volume1_sw.isra.0+0x96/0x320 [ 356.734819] gfs2: can't parse mount arguments [ 356.742816] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 356.742830] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 356.742842] ? avc_ss_reset+0x110/0x110 [ 356.742857] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 356.742867] ? lock_downgrade+0x6e0/0x6e0 [ 356.742876] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 356.742887] ? snd_mixer_oss_proc_read+0x250/0x250 [ 356.742911] ? __might_sleep+0x93/0xb0 [ 356.796847] audit: type=1400 audit(1569884559.690:71): avc: denied { relabelto } for pid=16526 comm="syz-executor.1" name="bus" dev="sda1" ino=16785 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:console_device_t:s0 tclass=file permissive=1 [ 356.798254] ? __fget+0x210/0x370 [ 356.798277] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 356.798288] snd_mixer_oss_ioctl+0x47/0x60 [ 356.798301] do_vfs_ioctl+0x7ae/0x1060 [ 356.798314] ? selinux_file_mprotect+0x5d0/0x5d0 [ 356.867404] ? lock_downgrade+0x6e0/0x6e0 [ 356.871549] ? ioctl_preallocate+0x1c0/0x1c0 [ 356.875955] ? __fget+0x237/0x370 [ 356.879396] ? security_file_ioctl+0x89/0xb0 [ 356.883790] SyS_ioctl+0x8f/0xc0 [ 356.887136] ? do_vfs_ioctl+0x1060/0x1060 [ 356.891273] do_syscall_64+0x1e8/0x640 [ 356.895141] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 356.899982] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 356.905158] RIP: 0033:0x459a29 [ 356.908327] RSP: 002b:00007fd8fdaa6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 356.916021] RAX: ffffffffffffffda RBX: 00007fd8fdaa6c90 RCX: 0000000000459a29 [ 356.923285] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000006 [ 356.930558] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 356.937810] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8fdaa76d4 23:02:39 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:39 executing program 3: syz_emit_ethernet(0x69, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaaaaaaaa020000ff000091002900810049000011545540f514579000dd18180b4f2502010033891af2a972d39e38c811081526b3209472b6a4b1bb0400bd5ad8f0ff1141fc5dd429b55dff40f77269a51fdda03b48ab95d3825f43af714137f4f46fa6018a332a"], 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000040)={0x1}) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cpuset.effective_cpus\x00', 0x26e1, 0x0) socket$alg(0x26, 0x5, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f00000001c0)={0x1, 0x7e, 0x0, 0x6}, 0x10) socket$inet6(0xa, 0x9, 0x7fc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000300)=0x6) r2 = bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffdc1) ioctl(r2, 0x10000, &(0x7f0000000140)="153f6234488dd25d766070") socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000540)={0xffffffffffffffff}) r4 = socket(0x11, 0x3, 0x8) r5 = syz_open_dev$amidi(&(0x7f0000000340)='/dev/amidi#\x00', 0x6, 0x10000) ioctl$TIOCGSID(r5, 0x5429, &(0x7f0000000800)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000440)=r6) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x10}) ioctl$RTC_WKALM_RD(r5, 0x80287010, &(0x7f00000002c0)) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @empty, 0x4e24, 0x3, 'lblcr\x00', 0x3a, 0x0, 0x3c}, {@remote, 0x4e21, 0x6, 0xffff, 0x7f, 0x2}}, 0x44) r7 = memfd_create(&(0x7f0000000c40)='memory.events\x00\xf0\xb5zCw/Z3\xac\xa2\xd2\xc4\x1c~\xf9M\xe7\xd2R\xe9\x1f\x99 >\xa7\xfe\xb6\xcbQH\xf5\xee\xdfL\xbev\x98\'\x14\xbd\"\xcfT\xde\xe7\x11+\xa5\x9b\xbdMy\xc7\x9b\x9a\x8d\xf5\x978\xb8\x8e>X\xeaq\x9a\xc4\x90\x14\xf5\xae\x90\v\x06\x86\xd1\x1d\x82n\xfa7\xe7}\xc9\xf1u\xee\xb9\xf2\ar\xc8\xeb\x15\x93\xf7\xd5\x14\x8dD\x88\xe4\xca3\x032f\x11%s\xc28\x94\xb9\xd8\xa2\x86\x8c\xf9\xa3;G\x90\xef\xbf\xd9\xb5j}\xec\xc9\x1f&r\xb9I\xba`\xc0\xfen\xf0\xe8\x03\xf0\xee\x82\xbd5b=\xd9\xda^\xb7k`\xedz\x86P\xba\xc9\v\x1fgt\xbaN\xfe7)\xd5\xa4\xf9\xc0\xfa\f_\x15\xd5\xe2v\r)\xa6\xdc\xe3B\x17\xb2\xb2\a\xad\xe6\xa0*\x95\xb2\x91,^\xed3o\x1di\x14\x81>\xa8\xdcb\xe7\x8a\xfc', 0x0) write$binfmt_misc(r5, &(0x7f0000000c40)=ANY=[], 0x0) close(r1) r8 = dup3(r1, r7, 0x10000) setsockopt$inet_sctp_SCTP_EVENTS(r8, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x1, 0x40, 0x7, 0x1f, 0x6, 0x100000000, 0x8001, 0x7d, 0x2, 0x86}, 0xb) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[]}}, 0xffffffffbffffffc) r9 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) epoll_create1(0x0) sendmsg$nl_route(r9, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000400)=@ipv4_newrule={0x2c, 0x20, 0xf29, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, [@FRA_GENERIC_POLICY=@FRA_UID_RANGE={0xc}]}, 0xfc70}}, 0x0) [ 356.945062] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000007 [ 356.967679] audit: type=1400 audit(1569884559.930:72): avc: denied { read } for pid=16526 comm="syz-executor.1" path="/root/syzkaller-testdir480194756/syzkaller.QUV8HF/223/bus" dev="sda1" ino=16785 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:console_device_t:s0 tclass=file permissive=1 [ 357.025818] gfs2: invalid mount option: loccook’U«Q/7Â4ƒ›§ hE9œóqšÛFá;èž 8Ѭá|T‰I˜pŒ-ž3V¯i"Êß½€¿G F¢#$!½¢Ï6j8`Ò¥¨`áYpU— Ãz…|åF9Kœoo“} ûY‰=a;î]zz¾Ê¡CkýMiû=[’ŽDÐG»b{Móxl0òÀ~?ÑN#«G¢|¢\Ó­ªV\SÍpšŽ³©a8 Û ˆª¹h0ÑzÞç–"Y¿h¤òyÂ!³xãè£( [ 357.098245] gfs2: can't parse mount arguments [ 357.107353] audit: type=1400 audit(1569884559.940:73): avc: denied { write } for pid=16526 comm="syz-executor.1" path="/root/syzkaller-testdir480194756/syzkaller.QUV8HF/223/bus" dev="sda1" ino=16785 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:console_device_t:s0 tclass=file permissive=1 23:02:40 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$FUSE_WRITE(r0, &(0x7f00000000c0)={0x18, 0x0, 0x3, {0x2}}, 0x18) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) fsetxattr$security_smack_entry(r3, &(0x7f0000000140)='security.SMACK64MMAP\x00', &(0x7f0000000180)='\x00', 0x1, 0x1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x7fffff, 0x12, r0, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0xc020660b, &(0x7f0000000000)) 23:02:40 executing program 3: r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000), 0x1c) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, 0x0) splice(0xffffffffffffffff, &(0x7f0000000100), 0xffffffffffffffff, &(0x7f0000000400)=0x3ff, 0x5, 0x9502bb7e212d3429) listen(r1, 0x6) r2 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) r3 = socket$kcm(0x29, 0x5, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') setsockopt(r3, 0x10d, 0x800000000d, &(0x7f0000000700)="07d46c8e3963bef1855a3907e3ada98ff400d535bca5a88523a4570c2c3dc139b128d75bf990b1010fdb2ffac1dacf3b24c3ea82c8276bb5c259c3c4a11084a46aea90273a2eaabc11d8dff0fe8bc65578eaf2145a97e646f489491476f5f85e2c68418d94c9f8dd509f83e8229aac9a7a88147afb59d8e1110c034927ccf989ab98e852baa6fe410dfd426fb711c912fec7abbc5124e115534819f57006c8803966de673a0705a965472c1cef0bacac6f5b81db328fd67d9d54e50b2f5cbffaa6f29a191de49adb2d65ccca3eb3384b08584e76df094464c4ee4dc3591ebe4120114e906a51e5a8f58d14ae5ea688eb099a8fc6bf412622d5c728f7409fcf2900a969e9e12137b1", 0x108) connect$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) r5 = fcntl$getown(0xffffffffffffffff, 0x9) process_vm_writev(r5, &(0x7f0000000280)=[{0x0}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) ioctl$KVM_S390_UCAS_UNMAP(r2, 0x4018ae51, &(0x7f0000000040)={0x20}) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b97b60036465b89900c09a2ecc9ac85c032e0a7b63c94d6b722731d4d96741e526e8cfe25c234d4807389013f75170798963469469b5e4d07b6dec81d9a5a2b8a040ac50402103f8ee2d00219f5307eaea1edbaa4a69fa24cb742d42003968f7335a756800"/126], 0x1}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) r6 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r6) 23:02:40 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x0, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:40 executing program 2: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x2282, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000580)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000040)='\x00', 0x0) ftruncate(r1, 0x1000000) sendfile(r0, r1, &(0x7f00000000c0)=0xf18001, 0xeefffdef) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000440)={0x0, 0x4}, &(0x7f0000000600)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000180), 0x10) socket$inet(0x2, 0x1, 0x0) r2 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r2, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r2, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) r5 = socket$inet6(0xa, 0x400000000001, 0x0) close(r5) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x88001) sendfile(r5, r6, 0x0, 0x800000000024) r7 = socket$inet6(0xa, 0x400000000001, 0x0) close(r7) r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r8, 0x88001) sendfile(r7, r8, 0x0, 0x800000000024) r9 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r9, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r9, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000740)=ANY=[@ANYRES32=r9, @ANYRESDEC], &(0x7f000095dffc)=0x2) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000c80)={0x0, 0x1}, 0x0) close(0xffffffffffffffff) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) semget(0x2, 0x1, 0x48c) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$nullb(0xffffffffffffff9c, &(0x7f0000000880)='/dev/nullb0\x00', 0x400a02, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000800)=[{{&(0x7f0000000200)={0xa, 0x0, 0x7fff, @ipv4={[], [], @remote}, 0x7}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000240)="eb4818d18128f333dd2fe26cef961ed712c0c0e2e029f398cae3c9843764484f47f210258cc2e9e05a81b0abab5dbbe47f6e5847bf0ba70df29a8cef58bec908d8785a1324b2cd8951633507339280a020534f5e8bcf0be38d1a4e7fa634834b4266ef66f06b58ab8c8e2e32ba623737139c52", 0x73}, {&(0x7f0000000300)="4099bfdaae79604e915a48412ec4004b54a0f8c92cd2467901e716097b2ae690f86596563a9060ccda5f70bcb2fba8974004bc81ffbee128d895b5345cb23b03edcc148ef6e84b85df0ce5ac279b8cb91dcdcfe4b0dc1652210e892c4996b176794999a075b183ceb7dad25796d2586b36299c9d24af474e4f3c653f2b41fc80c4187f67c302423e69b4a0c86b50fc19ec6b8ebf745e027316", 0x99}], 0x2, &(0x7f0000000400)=ANY=[@ANYBLOB="1400000000006d512f4ce196e19900000000010000000000"], 0x18}}, {{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000480)="9e80b4f04e4f87b4cfb9d2973e0bf8630f3ed0ebd4ca44f4624a1f905bf8af50558716a396205b22d17989fa5a28e9c1a08e52ccd0eb51a639e5ef5337b69d9bbdc62ffb952376e56f79d35bada09fad289695aba42f15859a4ace56ca13341d43c3a259095edfb7d0ed9adcd9bd59d4bcdc0462d77709bdb4204c63e6f48b0bed52232118b28804e719844757022e2ed9d849204b6afd78fc0663c9b625a48807aca786b36e787f9a5ef32f6d30ecaa467f803cb3caad840ee15de0ec37d41c8109d58d32", 0xc5}, {&(0x7f0000000640)}, {&(0x7f0000000680)="364f553e5d02a0da84003034224cf368942743596e26", 0x16}], 0x3, &(0x7f0000000780)=[@flowinfo={{0x14}}, @rthdr={{0x38, 0x29, 0x39, {0xba, 0x4, 0x1, 0x1f, 0x0, [@loopback, @empty]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x8001}}, @flowinfo={{0x14, 0x29, 0xb, 0x1}}], 0x80}}], 0x2, 0x4000000) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) [ 357.314043] audit: type=1400 audit(1569884560.040:74): avc: denied { open } for pid=16526 comm="syz-executor.1" path="/root/syzkaller-testdir480194756/syzkaller.QUV8HF/223/bus" dev="sda1" ino=16785 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:console_device_t:s0 tclass=file permissive=1 [ 357.374764] audit: type=1400 audit(1569884560.230:75): avc: denied { getattr } for pid=6865 comm="syz-executor.1" path="/root/syzkaller-testdir480194756/syzkaller.QUV8HF/223/bus" dev="sda1" ino=16785 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:console_device_t:s0 tclass=file permissive=1 23:02:40 executing program 4 (fault-call:21 fault-nth:7): open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 357.518862] audit: type=1400 audit(1569884560.230:76): avc: denied { unlink } for pid=6865 comm="syz-executor.1" name="bus" dev="sda1" ino=16785 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:console_device_t:s0 tclass=file permissive=1 [ 357.592140] device nr0 entered promiscuous mode [ 357.642080] FAULT_INJECTION: forcing a failure. [ 357.642080] name failslab, interval 1, probability 0, space 0, times 0 [ 357.653418] CPU: 0 PID: 16573 Comm: syz-executor.4 Not tainted 4.14.146 #0 [ 357.660453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 357.669815] Call Trace: [ 357.672404] dump_stack+0x138/0x197 [ 357.676027] should_fail.cold+0x10f/0x159 [ 357.680164] should_failslab+0xdb/0x130 [ 357.684122] kmem_cache_alloc_trace+0x2e9/0x790 [ 357.688783] snd_mixer_oss_get_volume1_sw.isra.0+0xce/0x320 [ 357.694484] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 357.699568] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 357.705178] ? avc_ss_reset+0x110/0x110 [ 357.709138] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 357.713790] ? lock_downgrade+0x6e0/0x6e0 [ 357.717921] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 357.723525] ? snd_mixer_oss_proc_read+0x250/0x250 [ 357.728459] ? __might_sleep+0x93/0xb0 [ 357.732341] ? __fget+0x210/0x370 [ 357.735778] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 357.740774] snd_mixer_oss_ioctl+0x47/0x60 [ 357.744995] do_vfs_ioctl+0x7ae/0x1060 [ 357.748863] ? selinux_file_mprotect+0x5d0/0x5d0 [ 357.753609] ? lock_downgrade+0x6e0/0x6e0 [ 357.757739] ? ioctl_preallocate+0x1c0/0x1c0 [ 357.762137] ? __fget+0x237/0x370 [ 357.765577] ? security_file_ioctl+0x89/0xb0 [ 357.769967] SyS_ioctl+0x8f/0xc0 [ 357.773314] ? do_vfs_ioctl+0x1060/0x1060 [ 357.777450] do_syscall_64+0x1e8/0x640 [ 357.781334] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 357.786251] entry_SYSCALL_64_after_hwframe+0x42/0xb7 23:02:40 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 357.791423] RIP: 0033:0x459a29 [ 357.794594] RSP: 002b:00007fd8fdaa6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 357.802285] RAX: ffffffffffffffda RBX: 00007fd8fdaa6c90 RCX: 0000000000459a29 [ 357.809537] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000006 [ 357.816788] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 357.824042] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8fdaa76d4 [ 357.831290] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000007 23:02:41 executing program 3: r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000), 0x1c) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, 0x0) splice(0xffffffffffffffff, &(0x7f0000000100), 0xffffffffffffffff, &(0x7f0000000400)=0x3ff, 0x5, 0x9502bb7e212d3429) listen(r1, 0x6) r2 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) r3 = socket$kcm(0x29, 0x5, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') setsockopt(r3, 0x10d, 0x800000000d, &(0x7f0000000700)="07d46c8e3963bef1855a3907e3ada98ff400d535bca5a88523a4570c2c3dc139b128d75bf990b1010fdb2ffac1dacf3b24c3ea82c8276bb5c259c3c4a11084a46aea90273a2eaabc11d8dff0fe8bc65578eaf2145a97e646f489491476f5f85e2c68418d94c9f8dd509f83e8229aac9a7a88147afb59d8e1110c034927ccf989ab98e852baa6fe410dfd426fb711c912fec7abbc5124e115534819f57006c8803966de673a0705a965472c1cef0bacac6f5b81db328fd67d9d54e50b2f5cbffaa6f29a191de49adb2d65ccca3eb3384b08584e76df094464c4ee4dc3591ebe4120114e906a51e5a8f58d14ae5ea688eb099a8fc6bf412622d5c728f7409fcf2900a969e9e12137b1", 0x108) connect$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) r5 = fcntl$getown(0xffffffffffffffff, 0x9) process_vm_writev(r5, &(0x7f0000000280)=[{0x0}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) ioctl$KVM_S390_UCAS_UNMAP(r2, 0x4018ae51, &(0x7f0000000040)={0x20}) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b97b60036465b89900c09a2ecc9ac85c032e0a7b63c94d6b722731d4d96741e526e8cfe25c234d4807389013f75170798963469469b5e4d07b6dec81d9a5a2b8a040ac50402103f8ee2d00219f5307eaea1edbaa4a69fa24cb742d42003968f7335a756800"/126], 0x1}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) r6 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r6) 23:02:41 executing program 4 (fault-call:21 fault-nth:8): open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:41 executing program 1: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)}, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x85aeaaac1f1135c, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000d65000)={0x0, 0x0, 0x0}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000180)='./file1\x00', &(0x7f0000000300)) lstat(0x0, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYRES16], 0x2, 0x4}, 0x10) r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000180)='./file1\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffdb0}, 0x8, 0x0) read(r3, &(0x7f0000000340)=""/128, 0x80) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="30000000000000004700000000000000cbe35ebe1078c73a8a96ecd232460386d5579128c24642812bcd14ce709a3a93461d3dd5428e10297620c950af3197e4cfc7d5b614404afdb95afc2a80f9da6cdd69c1c64d681a21714462d0cd3ee2627d20a43dc273355fd39c0b5617b6b5c04c75ff7f0000000000006cbd1498a31237230a7c7a9d2e71becd6e3cc98723fe606de74fb38bd83ce566c8c6cc3162f63b1bf4d5ff1d1d4eed8c65536683119145ace3980fd03b6caa447104f30bea1283f13ce119dbc7f5c57abd9339ad2eb8f55da19e953fa0387aa2bd2c2b0ec7a09d8073da2589b896812947ecd6b0c2424e1863bac14400c37b8c6b2e8ee3b3852f03aac28c4a1c2433df35471621f85a11861ff89907b4fbd166dfbd4679499bea9a16025f0df584ac993d97cbe66271865719e7a7615004f9a379f9eb3ac371c4f4e77e63f00fea66b9d9370efcb97176431879228fe53ae973e5a54e91a3cae5c1af94", @ANYRES32, @ANYRESHEX=r3, @ANYRES32, @ANYRES32=r1, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="b7772b7e6449fef156cc9e100817bf4ef61bdbdf1ca1a632e78f"], 0x192, 0x4}, 0x0) stat(0x0, 0x0) lstat(0x0, 0x0) add_key(&(0x7f0000000540)='big_key\x00', 0x0, &(0x7f00000005c0)="3ad332c8de86787575e4d6d1ffd44a0a2150ce9e9fff0b379fe87498528a04ad006b382a01ac6f45e0f7f9fe399d2dc304c1382cb03239a3f5c468782865b4ae4a5cb07d211ab39c28769a87ea8e6619542cf7495ba6f23f278616a2874d2d204a44c67433c541caf0a6e2dd3499ba67a5ec28fde086913f3bc8881f", 0x7c, 0xfffffffffffffff9) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f00000017c0)=[{0x0}, {&(0x7f0000000200)}], 0x2}, 0x10) setgroups(0x1, &(0x7f00000003c0)=[r2]) 23:02:41 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x0, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 358.325189] FAULT_INJECTION: forcing a failure. [ 358.325189] name failslab, interval 1, probability 0, space 0, times 0 [ 358.336670] CPU: 1 PID: 16599 Comm: syz-executor.4 Not tainted 4.14.146 #0 [ 358.343715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 358.353079] Call Trace: [ 358.355685] dump_stack+0x138/0x197 [ 358.359339] should_fail.cold+0x10f/0x159 [ 358.363511] should_failslab+0xdb/0x130 [ 358.367500] kmem_cache_alloc_trace+0x2e9/0x790 [ 358.372192] snd_mixer_oss_get_volume1_sw.isra.0+0x96/0x320 [ 358.377924] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 358.383038] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 358.388668] ? avc_ss_reset+0x110/0x110 [ 358.392759] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 358.397430] ? lock_downgrade+0x6e0/0x6e0 [ 358.401582] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 358.407214] ? snd_mixer_oss_proc_read+0x250/0x250 [ 358.412170] ? __might_sleep+0x93/0xb0 [ 358.416057] ? __fget+0x210/0x370 [ 358.419519] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 358.424536] snd_mixer_oss_ioctl+0x47/0x60 [ 358.428780] do_vfs_ioctl+0x7ae/0x1060 [ 358.432676] ? selinux_file_mprotect+0x5d0/0x5d0 [ 358.437463] ? lock_downgrade+0x6e0/0x6e0 [ 358.441619] ? ioctl_preallocate+0x1c0/0x1c0 [ 358.446030] ? __fget+0x237/0x370 [ 358.449483] ? security_file_ioctl+0x89/0xb0 [ 358.453899] SyS_ioctl+0x8f/0xc0 [ 358.457261] ? do_vfs_ioctl+0x1060/0x1060 [ 358.461412] do_syscall_64+0x1e8/0x640 [ 358.465299] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 358.470153] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 358.475337] RIP: 0033:0x459a29 [ 358.478514] RSP: 002b:00007fd8fdaa6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 358.486224] RAX: ffffffffffffffda RBX: 00007fd8fdaa6c90 RCX: 0000000000459a29 [ 358.493513] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000006 [ 358.500783] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 358.508056] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8fdaa76d4 [ 358.515331] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000007 23:02:41 executing program 1: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)}, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x85aeaaac1f1135c, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000d65000)={0x0, 0x0, 0x0}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000180)='./file1\x00', &(0x7f0000000300)) lstat(0x0, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYRES16], 0x2, 0x4}, 0x10) r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000180)='./file1\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffdb0}, 0x8, 0x0) read(r3, &(0x7f0000000340)=""/128, 0x80) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="30000000000000004700000000000000cbe35ebe1078c73a8a96ecd232460386d5579128c24642812bcd14ce709a3a93461d3dd5428e10297620c950af3197e4cfc7d5b614404afdb95afc2a80f9da6cdd69c1c64d681a21714462d0cd3ee2627d20a43dc273355fd39c0b5617b6b5c04c75ff7f0000000000006cbd1498a31237230a7c7a9d2e71becd6e3cc98723fe606de74fb38bd83ce566c8c6cc3162f63b1bf4d5ff1d1d4eed8c65536683119145ace3980fd03b6caa447104f30bea1283f13ce119dbc7f5c57abd9339ad2eb8f55da19e953fa0387aa2bd2c2b0ec7a09d8073da2589b896812947ecd6b0c2424e1863bac14400c37b8c6b2e8ee3b3852f03aac28c4a1c2433df35471621f85a11861ff89907b4fbd166dfbd4679499bea9a16025f0df584ac993d97cbe66271865719e7a7615004f9a379f9eb3ac371c4f4e77e63f00fea66b9d9370efcb97176431879228fe53ae973e5a54e91a3cae5c1af94", @ANYRES32, @ANYRESHEX=r3, @ANYRES32, @ANYRES32=r1, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="b7772b7e6449fef156cc9e100817bf4ef61bdbdf1ca1a632e78f"], 0x192, 0x4}, 0x0) stat(0x0, 0x0) lstat(0x0, 0x0) add_key(&(0x7f0000000540)='big_key\x00', 0x0, &(0x7f00000005c0)="3ad332c8de86787575e4d6d1ffd44a0a2150ce9e9fff0b379fe87498528a04ad006b382a01ac6f45e0f7f9fe399d2dc304c1382cb03239a3f5c468782865b4ae4a5cb07d211ab39c28769a87ea8e6619542cf7495ba6f23f278616a2874d2d204a44c67433c541caf0a6e2dd3499ba67a5ec28fde086913f3bc8881f", 0x7c, 0xfffffffffffffff9) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f00000017c0)=[{0x0}, {&(0x7f0000000200)}], 0x2}, 0x10) setgroups(0x1, &(0x7f00000003c0)=[r2]) 23:02:41 executing program 3: r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000), 0x1c) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, 0x0) splice(0xffffffffffffffff, &(0x7f0000000100), 0xffffffffffffffff, &(0x7f0000000400)=0x3ff, 0x5, 0x9502bb7e212d3429) listen(r1, 0x6) r2 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) r3 = socket$kcm(0x29, 0x5, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') setsockopt(r3, 0x10d, 0x800000000d, &(0x7f0000000700)="07d46c8e3963bef1855a3907e3ada98ff400d535bca5a88523a4570c2c3dc139b128d75bf990b1010fdb2ffac1dacf3b24c3ea82c8276bb5c259c3c4a11084a46aea90273a2eaabc11d8dff0fe8bc65578eaf2145a97e646f489491476f5f85e2c68418d94c9f8dd509f83e8229aac9a7a88147afb59d8e1110c034927ccf989ab98e852baa6fe410dfd426fb711c912fec7abbc5124e115534819f57006c8803966de673a0705a965472c1cef0bacac6f5b81db328fd67d9d54e50b2f5cbffaa6f29a191de49adb2d65ccca3eb3384b08584e76df094464c4ee4dc3591ebe4120114e906a51e5a8f58d14ae5ea688eb099a8fc6bf412622d5c728f7409fcf2900a969e9e12137b1", 0x108) connect$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) r5 = fcntl$getown(0xffffffffffffffff, 0x9) process_vm_writev(r5, &(0x7f0000000280)=[{0x0}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) ioctl$KVM_S390_UCAS_UNMAP(r2, 0x4018ae51, &(0x7f0000000040)={0x20}) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b97b60036465b89900c09a2ecc9ac85c032e0a7b63c94d6b722731d4d96741e526e8cfe25c234d4807389013f75170798963469469b5e4d07b6dec81d9a5a2b8a040ac50402103f8ee2d00219f5307eaea1edbaa4a69fa24cb742d42003968f7335a756800"/126], 0x1}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) r6 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r6) 23:02:41 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)}, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x85aeaaac1f1135c, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000d65000)={0x0, 0x0, 0x0}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000180)='./file1\x00', &(0x7f0000000300)) lstat(0x0, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYRES16], 0x2, 0x4}, 0x10) r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000180)='./file1\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffdb0}, 0x8, 0x0) read(r3, &(0x7f0000000340)=""/128, 0x80) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="30000000000000004700000000000000cbe35ebe1078c73a8a96ecd232460386d5579128c24642812bcd14ce709a3a93461d3dd5428e10297620c950af3197e4cfc7d5b614404afdb95afc2a80f9da6cdd69c1c64d681a21714462d0cd3ee2627d20a43dc273355fd39c0b5617b6b5c04c75ff7f0000000000006cbd1498a31237230a7c7a9d2e71becd6e3cc98723fe606de74fb38bd83ce566c8c6cc3162f63b1bf4d5ff1d1d4eed8c65536683119145ace3980fd03b6caa447104f30bea1283f13ce119dbc7f5c57abd9339ad2eb8f55da19e953fa0387aa2bd2c2b0ec7a09d8073da2589b896812947ecd6b0c2424e1863bac14400c37b8c6b2e8ee3b3852f03aac28c4a1c2433df35471621f85a11861ff89907b4fbd166dfbd4679499bea9a16025f0df584ac993d97cbe66271865719e7a7615004f9a379f9eb3ac371c4f4e77e63f00fea66b9d9370efcb97176431879228fe53ae973e5a54e91a3cae5c1af94", @ANYRES32, @ANYRESHEX=r3, @ANYRES32, @ANYRES32=r1, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="b7772b7e6449fef156cc9e100817bf4ef61bdbdf1ca1a632e78f"], 0x192, 0x4}, 0x0) stat(0x0, 0x0) lstat(0x0, 0x0) add_key(&(0x7f0000000540)='big_key\x00', 0x0, &(0x7f00000005c0)="3ad332c8de86787575e4d6d1ffd44a0a2150ce9e9fff0b379fe87498528a04ad006b382a01ac6f45e0f7f9fe399d2dc304c1382cb03239a3f5c468782865b4ae4a5cb07d211ab39c28769a87ea8e6619542cf7495ba6f23f278616a2874d2d204a44c67433c541caf0a6e2dd3499ba67a5ec28fde086913f3bc8881f", 0x7c, 0xfffffffffffffff9) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f00000017c0)=[{0x0}, {&(0x7f0000000200)}], 0x2}, 0x10) setgroups(0x1, &(0x7f00000003c0)=[r2]) 23:02:41 executing program 1: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) r0 = socket$inet(0x10, 0x3, 0xc) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)}, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x85aeaaac1f1135c, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000d65000)={0x0, 0x0, 0x0}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000180)='./file1\x00', &(0x7f0000000300)) lstat(0x0, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYRES16], 0x2, 0x4}, 0x10) r1 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000180)='./file1\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffdb0}, 0x8, 0x0) read(r3, &(0x7f0000000340)=""/128, 0x80) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="30000000000000004700000000000000cbe35ebe1078c73a8a96ecd232460386d5579128c24642812bcd14ce709a3a93461d3dd5428e10297620c950af3197e4cfc7d5b614404afdb95afc2a80f9da6cdd69c1c64d681a21714462d0cd3ee2627d20a43dc273355fd39c0b5617b6b5c04c75ff7f0000000000006cbd1498a31237230a7c7a9d2e71becd6e3cc98723fe606de74fb38bd83ce566c8c6cc3162f63b1bf4d5ff1d1d4eed8c65536683119145ace3980fd03b6caa447104f30bea1283f13ce119dbc7f5c57abd9339ad2eb8f55da19e953fa0387aa2bd2c2b0ec7a09d8073da2589b896812947ecd6b0c2424e1863bac14400c37b8c6b2e8ee3b3852f03aac28c4a1c2433df35471621f85a11861ff89907b4fbd166dfbd4679499bea9a16025f0df584ac993d97cbe66271865719e7a7615004f9a379f9eb3ac371c4f4e77e63f00fea66b9d9370efcb97176431879228fe53ae973e5a54e91a3cae5c1af94", @ANYRES32, @ANYRESHEX=r3, @ANYRES32, @ANYRES32=r1, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="b7772b7e6449fef156cc9e100817bf4ef61bdbdf1ca1a632e78f"], 0x192, 0x4}, 0x0) stat(0x0, 0x0) lstat(0x0, 0x0) add_key(&(0x7f0000000540)='big_key\x00', 0x0, &(0x7f00000005c0)="3ad332c8de86787575e4d6d1ffd44a0a2150ce9e9fff0b379fe87498528a04ad006b382a01ac6f45e0f7f9fe399d2dc304c1382cb03239a3f5c468782865b4ae4a5cb07d211ab39c28769a87ea8e6619542cf7495ba6f23f278616a2874d2d204a44c67433c541caf0a6e2dd3499ba67a5ec28fde086913f3bc8881f", 0x7c, 0xfffffffffffffff9) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f00000017c0)=[{0x0}, {&(0x7f0000000200)}], 0x2}, 0x10) setgroups(0x1, &(0x7f00000003c0)=[r2]) 23:02:41 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000f0000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) getpid() sched_setscheduler(0x0, 0x5, &(0x7f00000002c0)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) write$evdev(r0, &(0x7f00000001c0)=[{{0x0, 0x2710}, 0xe, 0x8, 0x4}, {{0x0, 0x2710}, 0x0, 0x5d4, 0x6}, {{r3, r4/1000+10000}, 0x1b, 0x6, 0xe01}, {{r5, r6/1000+30000}, 0x5, 0x7, 0x1000}, {{}, 0x17, 0x8}, {{0x77359400}, 0x12, 0x1, 0x8001}], 0x90) socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) close(r7) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x0) r8 = open(0x0, 0x2, 0x4) getsockopt$inet_IP_XFRM_POLICY(r8, 0x0, 0x11, 0x0, &(0x7f0000000380)) openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x0, 0x0) r9 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x5, 0x8000) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) getsockopt$IP6T_SO_GET_INFO(r9, 0x29, 0x40, &(0x7f0000000300)={'mangle\x00'}, &(0x7f0000000280)=0x54) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000040)={r12, @in6={{0xa, 0x4e22, 0x0, @loopback, 0x46cd}}, 0xe00, 0x0, 0x0, 0x4, 0x100000000}, &(0x7f0000000100)=0x98) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000003c0)={r12, 0x3ff}, 0x8) ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) 23:02:41 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="11dca50d5e0bcfe47bf070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000280)=0x14) dup3(r2, r1, 0x0) 23:02:41 executing program 4 (fault-call:21 fault-nth:9): open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 359.029952] device nr0 entered promiscuous mode [ 359.228653] FAULT_INJECTION: forcing a failure. [ 359.228653] name failslab, interval 1, probability 0, space 0, times 0 [ 359.240116] CPU: 0 PID: 16653 Comm: syz-executor.4 Not tainted 4.14.146 #0 [ 359.247138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 359.256513] Call Trace: [ 359.259121] dump_stack+0x138/0x197 [ 359.262769] should_fail.cold+0x10f/0x159 [ 359.266913] should_failslab+0xdb/0x130 [ 359.270879] kmem_cache_alloc_trace+0x2e9/0x790 [ 359.275540] snd_mixer_oss_get_volume1_sw.isra.0+0xce/0x320 [ 359.281237] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 359.286322] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 359.291932] ? avc_ss_reset+0x110/0x110 [ 359.295907] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 359.300558] ? lock_downgrade+0x6e0/0x6e0 [ 359.304689] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 359.310296] ? snd_mixer_oss_proc_read+0x250/0x250 [ 359.315218] ? __might_sleep+0x93/0xb0 [ 359.319096] ? __fget+0x210/0x370 [ 359.322535] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 359.327533] snd_mixer_oss_ioctl+0x47/0x60 [ 359.331749] do_vfs_ioctl+0x7ae/0x1060 [ 359.335618] ? selinux_file_mprotect+0x5d0/0x5d0 [ 359.340368] ? lock_downgrade+0x6e0/0x6e0 [ 359.344499] ? ioctl_preallocate+0x1c0/0x1c0 [ 359.348901] ? __fget+0x237/0x370 [ 359.352343] ? security_file_ioctl+0x89/0xb0 [ 359.356735] SyS_ioctl+0x8f/0xc0 [ 359.360087] ? do_vfs_ioctl+0x1060/0x1060 [ 359.364220] do_syscall_64+0x1e8/0x640 [ 359.368088] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 359.372915] entry_SYSCALL_64_after_hwframe+0x42/0xb7 23:02:42 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x0, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 359.378084] RIP: 0033:0x459a29 [ 359.381254] RSP: 002b:00007fd8fdaa6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 359.388941] RAX: ffffffffffffffda RBX: 00007fd8fdaa6c90 RCX: 0000000000459a29 [ 359.396192] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000006 [ 359.403441] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 359.410704] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8fdaa76d4 [ 359.417954] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000007 23:02:42 executing program 3: r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000), 0x1c) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, 0x0) splice(0xffffffffffffffff, &(0x7f0000000100), 0xffffffffffffffff, &(0x7f0000000400)=0x3ff, 0x5, 0x9502bb7e212d3429) listen(r1, 0x6) r2 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) r3 = socket$kcm(0x29, 0x5, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') setsockopt(r3, 0x10d, 0x800000000d, &(0x7f0000000700)="07d46c8e3963bef1855a3907e3ada98ff400d535bca5a88523a4570c2c3dc139b128d75bf990b1010fdb2ffac1dacf3b24c3ea82c8276bb5c259c3c4a11084a46aea90273a2eaabc11d8dff0fe8bc65578eaf2145a97e646f489491476f5f85e2c68418d94c9f8dd509f83e8229aac9a7a88147afb59d8e1110c034927ccf989ab98e852baa6fe410dfd426fb711c912fec7abbc5124e115534819f57006c8803966de673a0705a965472c1cef0bacac6f5b81db328fd67d9d54e50b2f5cbffaa6f29a191de49adb2d65ccca3eb3384b08584e76df094464c4ee4dc3591ebe4120114e906a51e5a8f58d14ae5ea688eb099a8fc6bf412622d5c728f7409fcf2900a969e9e12137b1", 0x108) connect$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) r5 = fcntl$getown(0xffffffffffffffff, 0x9) process_vm_writev(r5, &(0x7f0000000280)=[{0x0}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) ioctl$KVM_S390_UCAS_UNMAP(r2, 0x4018ae51, &(0x7f0000000040)={0x20}) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b97b60036465b89900c09a2ecc9ac85c032e0a7b63c94d6b722731d4d96741e526e8cfe25c234d4807389013f75170798963469469b5e4d07b6dec81d9a5a2b8a040ac50402103f8ee2d00219f5307eaea1edbaa4a69fa24cb742d42003968f7335a756800"/126], 0x1}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) r6 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r6) 23:02:42 executing program 1: socket(0x11, 0x0, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000300), &(0x7f0000000340)=0x4) dup(0xffffffffffffffff) syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x1, 0x2) ioctl$VIDIOC_LOG_STATUS(0xffffffffffffffff, 0x5646, 0x0) syz_open_dev$radio(0x0, 0x0, 0x2) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00') r1 = gettid() tkill(r1, 0x3c) chdir(0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r3, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_open_dev$adsp(&(0x7f0000000200)='/dev/adsp#\x00', 0x1, 0x40000) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000440)={r7}) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r8, &(0x7f00000016c0)={&(0x7f0000001600)={0x10, 0x0, 0x0, 0x21120c10}, 0xc, &(0x7f0000001680)={&(0x7f0000001640)=ANY=[@ANYBLOB="01010000", @ANYRES16=r9, @ANYBLOB="804028bd7000fcdbdf25100000000c0009000800014009000000"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r6, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000380)={0x1f4, r9, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x20, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x8164}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7ff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}]}, @TIPC_NLA_LINK={0x10, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_BEARER={0xf4, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @loopback}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x9, @mcast2, 0x8a0}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff0000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3800}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'rose0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_SOCK={0x8, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0x30, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_BEARER={0x84, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x1f, @empty, 0x4}}, {0x14, 0x2, @in={0x2, 0x4e24, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xe}}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x5, @loopback, 0x9d}}}}]}]}, 0x1f4}, 0x1, 0x0, 0x0, 0x800}, 0x18000) fcntl$setpipe(r5, 0x407, 0x0) write(r5, &(0x7f0000000340), 0x41395527) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="0000000000000000280012000c00010076657468000000e1170002de1300010028b60000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x48}}, 0x0) 23:02:42 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 359.698889] devpts: called with bogus options [ 359.755447] device nr0 entered promiscuous mode 23:02:43 executing program 4 (fault-call:21 fault-nth:10): open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:43 executing program 3: open(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x24) listen(r0, 0x8) listen(r0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0xaf, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x4030582a, &(0x7f0000000000)) [ 360.168364] audit: type=1400 audit(1569884563.140:77): avc: denied { sys_ptrace } for pid=16649 comm="ps" capability=19 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=cap_userns permissive=1 23:02:43 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:43 executing program 3: open(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x24) listen(r0, 0x8) listen(r0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0xaf, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x4030582a, &(0x7f0000000000)) 23:02:43 executing program 1: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x200000000d8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) mount(0x0, &(0x7f0000000480)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) symlink(&(0x7f0000000240)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') write$UHID_GET_REPORT_REPLY(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x1, 0x0) ioctl$PIO_UNIMAPCLR(r0, 0x4b68, &(0x7f0000000100)={0x8, 0x20, 0xfffe}) openat$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0)='memory.swap.max\x00', 0x2, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) getsockopt$inet_sctp_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, &(0x7f0000000080), 0x0) unlink(&(0x7f0000000180)='./file0\x00') setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000300)=[@in6={0xa, 0x4e23, 0x3f, @loopback}, @in6={0xa, 0x4e24, 0x0, @rand_addr="7ef1f5a4b557f07c5c33c6b47f782057"}, @in={0x2, 0x4e21, @empty}, @in={0x2, 0x4e24, @rand_addr=0x6}, @in6={0xa, 0x4e21, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x31f8}], 0x74) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$DRM_IOCTL_INFO_BUFS(r0, 0xc0106418, &(0x7f0000000140)={0x6, 0x9, 0xfffffeff, 0x5, 0x4}) 23:02:43 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:43 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) connect$pppoe(r1, &(0x7f0000000140)={0x18, 0x0, {0x5, @local, 'bridge0\x00'}}, 0x1e) sendmmsg(r1, &(0x7f000000d180), 0x4000000000000eb, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x100000, 0x0) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, 0x0) 23:02:43 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="400000000000000008001b000000"], 0x30}}, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0x0, 0x0) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f0000000200)={0x0, {0x2, 0x4e22, @rand_addr=0x6}, {0x2, 0x4e21, @remote}, {0x2, 0x4e24, @loopback}, 0x65, 0x0, 0x0, 0x0, 0x7, &(0x7f00000001c0)='bridge0\x00', 0x3, 0xfffffffffffffffa, 0x81}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xfffffffffffffe5d, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0) 23:02:44 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = socket$inet6(0xa, 0x400000000001, 0x0) close(r5) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) sendfile(r5, r6, 0x0, 0x800000000024) r7 = ioctl$TIOCGPTPEER(r6, 0x5441, 0xffffffff) ioctl$TCSETX(r7, 0x5433, &(0x7f0000000100)={0x3, 0x101, [0x3, 0x1, 0x3, 0xffff, 0x3f], 0x6}) r8 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) ioctl$TIOCGETD(r4, 0x5424, &(0x7f00000000c0)) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r8, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r9 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r9, 0x80044dff, 0x0) [ 361.077710] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 23:02:44 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:44 executing program 3: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="9d", 0x1}], 0x1, 0x0) move_pages(0x0, 0x1, &(0x7f0000000140)=[&(0x7f0000000000/0x2000)=nil], &(0x7f00000001c0)=[0x1], &(0x7f0000000200), 0x0) [ 361.228282] bridge0: port 2(bridge_slave_1) entered disabled state [ 361.235650] bridge0: port 1(bridge_slave_0) entered disabled state 23:02:44 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:44 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) connect$pppoe(r1, &(0x7f0000000140)={0x18, 0x0, {0x5, @local, 'bridge0\x00'}}, 0x1e) sendmmsg(r1, &(0x7f000000d180), 0x4000000000000eb, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x100000, 0x0) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, 0x0) 23:02:44 executing program 3: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="9d", 0x1}], 0x1, 0x0) move_pages(0x0, 0x1, &(0x7f0000000140)=[&(0x7f0000000000/0x2000)=nil], &(0x7f00000001c0)=[0x1], &(0x7f0000000200), 0x0) [ 361.943116] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 23:02:44 executing program 3: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="9d", 0x1}], 0x1, 0x0) move_pages(0x0, 0x1, &(0x7f0000000140)=[&(0x7f0000000000/0x2000)=nil], &(0x7f00000001c0)=[0x1], &(0x7f0000000200), 0x0) 23:02:45 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 361.985877] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 362.039892] 8021q: adding VLAN 0 to HW filter on device bond0 [ 362.067816] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 362.084368] 8021q: adding VLAN 0 to HW filter on device team0 [ 362.141732] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 362.213766] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 23:02:45 executing program 3: r0 = socket$l2tp(0x18, 0x1, 0x1) accept(r0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000), 0x1c) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, 0x0) splice(0xffffffffffffffff, &(0x7f0000000100), 0xffffffffffffffff, &(0x7f0000000400)=0x3ff, 0x5, 0x9502bb7e212d3429) listen(r1, 0x6) r2 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x8000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x1ff) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, 0x0) r3 = socket$kcm(0x29, 0x5, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) fadvise64(r4, 0x0, 0x0, 0x5) setsockopt(r3, 0x10d, 0x800000000d, &(0x7f0000000700)="07d46c8e3963bef1855a3907e3ada98ff400d535bca5a88523a4570c2c3dc139b128d75bf990b1010fdb2ffac1dacf3b24c3ea82c8276bb5c259c3c4a11084a46aea90273a2eaabc11d8dff0fe8bc65578eaf2145a97e646f489491476f5f85e2c68418d94c9f8dd509f83e8229aac9a7a88147afb59d8e1110c034927ccf989ab98e852baa6fe410dfd426fb711c912fec7abbc5124e115534819f57006c8803966de673a0705a965472c1cef0bacac6f5b81db328fd67d9d54e50b2f5cbffaa6f29a191de49adb2d65ccca3eb3384b08584e76df094464c4ee4dc3591ebe4120114e906a51e5a8f58d14ae5ea688eb099a8fc6bf412622d5c728f7409fcf2900a969e9e12137b1", 0x108) connect$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000001c0)={'hwsim0\x00', 0x7132}) r7 = fcntl$getown(0xffffffffffffffff, 0x9) process_vm_writev(r7, &(0x7f0000000280)=[{0x0}, {0x0}, {&(0x7f0000000640)=""/143, 0x8f}], 0x3, &(0x7f0000000ac0)=[{&(0x7f00000003c0)=""/23, 0x17}], 0x1, 0x0) ioctl$KVM_S390_UCAS_UNMAP(r2, 0x4018ae51, &(0x7f0000000040)={0x20}) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="6331f62311ac5e298c5fd2b97b56a221a200b557e0a935f2c25ccc9ac85c032e0a7b63c94d6b7227317e080000e526e8cfe25c234d4807389013f75170798963469469b5e4d07b6dec81d9a5a2b8a040ac50402103f8ee2d00219f5307eaea1edbaa4a69fa24cb742d42003968f7335a7568"], 0x1}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='io.stat\x00', 0x0, 0x0) r8 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r8) 23:02:45 executing program 2: socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) getxattr(0x0, 0x0, 0x0, 0xffcd) r0 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000080)={'syz'}, &(0x7f0000000400)="585ccbc4ed83b8361cb55d9a4ac32d08648f300d19c1a6464914dc5500b66347b3c7218a9dfc0189f64219209906a53f9169000032a133d4b444025e0cf22ce6117f28000042e3d35228897501f93191b076ac446ff0022b8753a1fa748c569f435fb3bae96efb74b50ec93c2db8eae3198a29e5c0cfc60000ce0637cef580b4ec24c53d86571ff5ff70e48884ca000018cca71fcfacf40d32e4b58a8d272579d80a912da92dca0b5274ba9ff33c1e8e036e5031949762d009d308bd73f477252d0000000000004000000000000000000000000000000000195e23bf66c511268b21080e2d9090b7bae053d3539c86fb2c74ede96c1825fd4c", 0xf9, r0) r2 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f0000000240)="95c9e7ad96d33de061da4060272e0ef04897bfe0", 0x14, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r2, r1, r2}, 0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)={'poly1305-simd\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x02\x00\x00\x00\x0f\x00@\x00\x00\x01\x00'}}) keyctl$setperm(0x5, r2, 0x200000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0xff, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000002c0), 0x8}, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(0x0, &(0x7f0000000100)='./file0\x00') stat(0x0, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) r5 = accept4$x25(0xffffffffffffffff, &(0x7f0000000080)={0x9, @remote}, &(0x7f00000001c0)=0x12, 0x800) r6 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r6, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r6, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f0000000600)=ANY=[@ANYBLOB="090000000000000001000080000000000200000000000000fe2ee1f998a068587969a8e725ce3e6cddb82832df2c77ea728bf00e791476c1ee493b0b16b480e78c713c96da7f2fc755b445471e254f75638fb4", @ANYRES32=r5, @ANYBLOB="0000000002000000000000000004eb1b03585ae8768536a60004da00"/42, @ANYRES32=r6, @ANYBLOB="000000008000"/28]) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(0xffffffffffffffff, 0x114, 0xa, 0x0, 0x0) execve(0x0, &(0x7f0000000900)=[0x0, 0x0, &(0x7f0000000780)='system\\&wlan1!\x00', 0x0, 0x0, 0x0], 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000480)='127.0.0.1\x03', &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='9p\x00', 0x1000, &(0x7f0000000040)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYRESOCT]]) r7 = socket$inet6(0xa, 0x400000000001, 0x0) close(r7) r8 = open(&(0x7f0000002000)='./bus\x00', 0x6f28022d96affd2b, 0x84) ftruncate(r8, 0x88001) sendfile(r7, r8, 0x0, 0x800000000024) connect(r7, &(0x7f0000000140)=@sco={0x1f, {0x1, 0x80, 0x20, 0xff, 0x37, 0x81}}, 0x80) 23:02:45 executing program 1: r0 = timerfd_create(0x0, 0x0) read(r0, &(0x7f0000000180)=""/81, 0x51) ioctl$UI_SET_KEYBIT(r0, 0x40085400, 0x4001bf) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x80, 0x0) ioctl$PPPIOCGMRU(r1, 0x80047453, &(0x7f0000000280)) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x406a80, 0x0) accept4$nfc_llcp(r2, &(0x7f0000000080), &(0x7f0000000100)=0x60, 0x1c0000) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r1, 0x80845663, &(0x7f00000002c0)={0x0, @reserved}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCMSET(r3, 0x5418, &(0x7f0000000200)=0x40) 23:02:45 executing program 4: open(0x0, 0x7039639dd575c197, 0x154) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x23, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffe}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = gettid() ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) ptrace$cont(0x18, r4, 0x0, 0x0) ptrace$setregs(0xd, r4, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r4, 0x0, 0x0) ptrace$setregs(0xd, r4, 0x401, &(0x7f0000000380)="e582e2b851b4527a4054b4497c1a9871053ae152bfd8f1a894c7ca579da9afcec44da3ae6d87f99c22f0d4079e9f90a2370470e7088a8c57553b0ffd1bcf03e7f66112fe3afe2c86ec26e7d03454f41c77cf8f408ed5fd6926aa606f9ea43a2bbc7472f5ff66ad88b7c26a1722bc5659ba2627db69688d22534602ae3d8ed9b34571b543516c4387df606eab78e075e6b36d6cb55f4dba0cc79100d6623e01dddb8a2cb3f851b975f39360fb56a5d601d4b7599113afdeca67464612c22ce318ed99f1ef23e3b853705c7d862c41bc51b36787d6b2626d66cf66e69eb22f5092df0c3c8f8d82c84286cb852e") sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) r5 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r5, 0x40106614, &(0x7f00000000c0)) mkdir(0x0, 0x0) r6 = dup(0xffffffffffffffff) r7 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r6, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() ioctl$CAPI_GET_FLAGS(r3, 0x80044323, &(0x7f0000000100)) fchownat(r7, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r8 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r8, 0x80044dff, 0x0) 23:02:45 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:45 executing program 1: r0 = timerfd_create(0x0, 0x0) read(r0, &(0x7f0000000180)=""/81, 0x51) ioctl$UI_SET_KEYBIT(r0, 0x40085400, 0x4001bf) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x80, 0x0) ioctl$PPPIOCGMRU(r1, 0x80047453, &(0x7f0000000280)) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x406a80, 0x0) accept4$nfc_llcp(r2, &(0x7f0000000080), &(0x7f0000000100)=0x60, 0x1c0000) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r1, 0x80845663, &(0x7f00000002c0)={0x0, @reserved}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCMSET(r3, 0x5418, &(0x7f0000000200)=0x40) 23:02:45 executing program 2: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:45 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = getpgid(0x0) sched_setattr(r4, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r5 = dup(0xffffffffffffffff) r6 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r5, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r6, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r7, 0x80044dff, 0x0) 23:02:45 executing program 1: r0 = timerfd_create(0x0, 0x0) read(r0, &(0x7f0000000180)=""/81, 0x51) ioctl$UI_SET_KEYBIT(r0, 0x40085400, 0x4001bf) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x80, 0x0) ioctl$PPPIOCGMRU(r1, 0x80047453, &(0x7f0000000280)) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x406a80, 0x0) accept4$nfc_llcp(r2, &(0x7f0000000080), &(0x7f0000000100)=0x60, 0x1c0000) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r1, 0x80845663, &(0x7f00000002c0)={0x0, @reserved}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCMSET(r3, 0x5418, &(0x7f0000000200)=0x40) 23:02:45 executing program 3: r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000240)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1164, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f00000000c0)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0xfffffffffffffff8, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x9000000) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004100)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)}], 0x1, 0x0) dup(r0) 23:02:45 executing program 1: 23:02:45 executing program 1: setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x4000, 0x0) write(r0, &(0x7f0000000600)="bb8f9f640903127a53527c6fbfe65d43b0e0586f2d40c7e7df58cac83420e83662d6e39bb6d5430622431454eedeeaee423d8f210bc3525fa7927c18d5fbc91ab13c2041136047d8da9375934d00f325499bfe7712208d387d41c31821c2a22d1325b556528e9b790b74053d1ed631c6ec8126d37c87216173138c00cef396868029af5b76bebac5e38b74d8bbc6ae66b6e202b6d505710377710ea7d43edf00e1a4c1c670bb4c263ce777da81abdd5ba5a5c82f67232f9b4d6f21b2e6afa8b38e4642b0daa2acbc0478d89b88e8b2094d4248855e5e81992e60be3afff0f3c3799350615489a901a659abdeca0c615a622ebf64175f990320e0356d4a11ed62eff72b709c23dd65942e8b534d7d775d370c1e435654a2634e6ee3649c4c3bcbe39e866f1eb9972af1a9cef42e701798a53dc92a242aadbac343e1765cf8ea5665e22deda69777e52b1e9e5d3edc022256939e1eee013448294911139d5b9c6241049fecdf9b31f4cdf6cff65d71b5071ef70e1798347c8846aa5b905e83050e3e606986ed3f603d18c5cdeb11cda1ce3abddea9376231af130e19fc7601ec1ab8cb5a7de9e2174547f18225b09a54fc8720dbb91eb69c1be88e601c3c9df4f2758f39a5151951b9c6dbb419ffd783a34c9fad10f201b8724d31865e2fc1fcf48db2be713053b43a0e3943c1e2b08e8a26e946c439d891db2a80b5ffa054bc8d0177d3214056250c61a537d2ec7630fb90395df2cd6aa9c5e573365db580520bdc3f1c6b2be992e1516a4b810a11935dc780699e461d9715f70c6d103ff49bf168f3cff4c0d0d6ba5671fcd2975450b0e1a3474139cb0f2d3476fcd87a8bccbeb2f5f8a821017b879aa5b9d1fafa9f4c429a74cd2da782114d97bf031746a817dd0293c4eddc3a9ecb5afe496f4971474ccd827449409f07cf94dda2e7dbe8520b5afff10a7e3b0b4289a167fc692635b5b7426d9e771b95860b09a3e752c867213c772e48ba30a78feecc7ff26e63e1749c62b52d377ac5cc52db830c965e04ccfcfb24ceacc69cfdc2094124dd27b2d68f699476a2562bab1de117ffc2b0702ee8b0b77f85fecec3a25b37ab7eb06232c9a73b4470f1727c82581d81942abf42d3ea37957927ad3dbd0ebe46678a9f4d25c47acaac83c14210a54b71fed40df017e2be27f01e3e6ea3ea381ca14efd202858e6535ad4f79a8cdf47e385b740a70c14e3651731a45cc0ca4a56f2e903cad0384efcc364caf67e09551d35c682ebc90a9286c4d274ba1b8ced742ede4e55a62db7ef9a96fde2add05b41599fd72a79ba280cc125cb266ef21b7eeafe3ee6aa78eef33fc66454549c3ec298cb683a55a32208cf6ce88b560166159d59e65f30540f62c5437652ea7f2a02f87ca242dd2250f58e75938a9a3ded51ae6598c2aba53287ff5cdaab17be7f4310f8e07e310d52778de79e1c2e4391b254be38910aa1cf6e1ca0e75d24be97d59f7025f16c6fbd549529b74e319c58f50438765ef0e3dc394eeb75dec41b3d80435b17520c97f5cd7ee692fb86d188fb0089fbf737dc1b96b9cc49be23a38a8cd92e5075f349993d7866369dd25eccbe1481477a05fee14e0edd1617921d7fcaa8fdc642e63b64388fa5b63442ff1466b1938d02546750b01ed9c980282ccbe10f204741249aed88c555ed6fdf7f68af9209807a71bbf4f31bef5a4223466da74ba8b034df529aef6ec6610a0d25973961e50e02af22d0ca8be1b9804a5918acbdb536e8f2f441ec9d640ed15133ee747440c86fc4526c9195954528673d25c8390170f3c19cb0b0c30b9e634c7ebae96946ae97c19eabca92226da925d22be37abbe0740938ea899ec42fd529a3b1063981e4c154219df5cf5af60a29b5a8ee530905725a14b28900eae937e705401ba8f632a7bca00d9724a992afdc9ed14aac71b8e3a7ee5ca095888feb195b4e083c3b611a1c2f8d092febe3b9f5f0df61e8d3c31a643c935b76bc1ad4265164e755484beb06610510bc51e8c6da8d71123bbe83a5e4128f41cf5c486d6a60496c300c406f990bee485cbdef794f2663ee66d2b18d8e55210c25c04b1a0c6d9c5f904e72806d2d4f5e5439bcdf146343cdffe4d0d70d42a9959cff9bd50c37cd478b0b0add16aae4dc839b46bca2ac7547144b6a422aed5e2db661bcb31a82bc0fc678e71a6cb090ef772860f3008b4152b5d281033be4a77b367baec3ab8ce7c83c601b11c8199bafcd15161a5454a6a982dbc3c2e3a5172b6a63e4904817075754eccbb0188c9cb2e5da9600f567485014887463b40f189b7ec3c5c0f36d502509e402c285765c78417ce6b3aab130ee79622dcd8ada842233e73a14554ee5e4995e32b3fe4075e247eb9bdeef64d1a7436c9b5782fb2f84f74e4c6e976289729c37b5bb8200a9480d181a6b11f5ec229b818134b8334967ae935ac1d81be4776fae4cb68b6fa330e93bd8de388b38455d569159bcd166df030a6dfedf28caf4608de7243f5df2c76f6680c301d819dc67d24d2f780432a931700a253b0a5b075195c6dbfd1fe17a1c11a3dffa872a07b877adc66d069fffb6d8326e1998c5a337c3d530250cae335ceffcf81dc438a47e73490d050a053813dbe6674e42c91ae94b4a88144f36adc1b08b4bcd6ddf4058c4e08d4dc83d5fbd843ee27eaf50b297c220350260d9abbeeb6deb921e50cae0ea590cfb6f00fb3c71520f565bb769705e2481ef27cf537d29f163c9fe3d39ed9fd18dc8b0c976cd302283e430807a9d751357f89092532d89fe280c69ad36e3541b5da9dea13fd19d0434c760fe295dfd9b9e63453c7853914c50b1b77ccd4b33c8b1f31fcb1aec040ffe2f9d728d8ea84297bac2e22230ebd1488c503b05b2e433cc37ce9fc123b7d3eb244b4549e9a841e73b664c8f6621ea5a4c9ff9c1da032255311f2c063a682baf4c97e7ba552bf71af4bd64f43872b846d15c65c487089be272cfa24a33f8c50930ea0bc4b089505fb8e9e688d35a978813c38add66548d7575727ded0e7e64a5ce897da6b940df4c3dddb8b4871d773f6ebf02058518c55c19aadb0f266caf18777ae68d2bfcfb2225961fcd10538ba664fd053a443320072707533ab761b9397bd0559126b84fe9196463ae50633017ea2d80940311d9c867102b1017f34af1965d8eb61be616a0d40656e2bbb750aee6f74f788c8acb2578e8686f5f8da6a19e979c152b7ee7c7f16902120588e2ff630144b5f929ffc593e946d9717c5968aa16c2d73d689fb5cce117acda3e23e5e0116de1cb6bddfa1a84cefb22c1e2c3753017696f27b9aec5d44f15411247643b84dd4410e784b4eb5b9c68fea671976f9b51c6526e2ddb40659611b0b3bcc7e249c77396fdb8c864ea9318f9de7fd3936fcbdc732c2f8b9556ec9afeb15d5e2df890351d66074d53dddc6e8dba8c91d733623ac95a49eb69c7de37ff2364ccddb01f6500750a012c2acf32a9f6bbd9e92d17ef858fbc34575db414ea42ad87a65b11ae5506469db256c421328f45aec73bdf18562447dc2840bbe9fc84dedd0fe6276fa174f21210d40193530ec7a70a9e60bfd6b00cba4d483be59950f16fa0dbd089b5fd0bb078badfcf42270cc62fe37be22b0d81f755263d74636fa466d2574ca62b58c649936d21e949de73ea45df3acade6609413f56fc218d6f11947bf1fd629d38d8acce90ee3c1a51117601ae126bec537e3e76ce7ecc53cfeefee8aaa104aa853a65aadf27bac9849ee0122793b11cd8e4f32fb07afa39e439cb738c30a6df958160aac15c26032a61aaf614b2e6601581fb0ab8d115e045005dee3df8ea42643cbcbb0b111130c42c94b7e874cfee50d5c2eb13b3a38c417fce9d740b7d43120431a7d44bc3934ee87b112401cbee3553837b6a0b4b3faaceb46eca4064301c8060870350e256ac9d5557f674536b9d9717a82fa211e7dfb52ca410d8a4f2f6b733c2a082f247538a6c40f56cf64204e62515db692f32733ff6f4b0787ef305d5e80881375467ae603ac3600e688c42f89a4fea4fdda09a8d59e19457c654a98c8129a8c65bae3310af2b170729e18400c915d0a2f4c4fc51747846630b95ec181228bda7ef48ad389815aa82de6c4a3b0746c28c01f9ec697ff17f095e1cf9d2fe78fdab9cbb1ca7aefc8af6a0cd98444735fad79e394a8f9c2fd358c3cde4ca6d57a620d0bb52dc6ff93f034b596f407c21511cc2c5ec8b0ede7f5c0acca61939ac7f2cad820c15133e69507eaa739e9a88936f4a74f0ad1574a1591f31f582a76157d89805cb3ba5e8d10509bf7a08e928653b4f05ba797a06765b74c8759fc34178624c08a2b99e59bcff5d33af2b0f9176b56c35f4da31c751a4c2fd88a1997cd9fc9bbf78220731d4c8cea23be1fd29c36b34d8458b7021ebcfafdc7e54096e517da3eb684298f742532d776164d9c9658e5faca0a3b08afca1bc27ed357884f49fe51bd0c38057f4288f1917e36e3865310b5eed140aef6150ae363293cf7467abd5e06cd7af5e2c49e7c5253a1155741e380bccb023a0faed93d9a64512d72436f1ef4ac0904a413e45164c23413bd57274a0a951c41a9a43aed094d4ea5c480ce64663cc9d36723179e2b19a48e9277a6591bbd888a06e0f2f142cd4495be4ba7274d69ba32a2788b935b2f18c5f336cb9de062829e2e0bb476efb36c3f53a766c14314f31637a464ac59d378ad7f51bef8d88715613653a427038e0d3e4dc3948bb1d70eb55c91c92f7510b1c0387253b458d2c90d17238f9eb239c680179a6c1e0759be367963e3b4d7395fd3911626582a094e6a8d0e746242f94267a4c57d5b2360ce3a6f7f3e3c10e124a54ed24d1585bc7b731cf731c94ee00ebf070b999b9bf28d76bfec9dcf12fcce2b9c4444c706ec6b943b5f39e9151a764ba1cd0cd6c1c7cdc3aa824cf17da705be27a18fbee41be39d6ae4dd4312f5f4bfee2c5bb21d941666f9d79b0f80c9b1bace84a05d2b0e3be1c3fd04d72b4b0124595c435813969d413960fddc858730a433383f3bc0472cb7683ea569e001f", 0xe00) sendfile(r0, r1, 0x0, 0x12000) ioctl$RTC_VL_READ(r1, 0x80047013, &(0x7f0000000000)) r2 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r2, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r2, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@mcast1, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@loopback}}, &(0x7f0000000040)=0xe8) setfsuid(r3) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3) socket$can_bcm(0x1d, 0x2, 0x2) 23:02:45 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 363.151679] audit: type=1800 audit(1569884566.120:78): pid=16847 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="collect_data" cause="failed(directio)" comm="syz-executor.1" name="file0" dev="sda1" ino=17265 res=0 [ 363.225829] audit: type=1804 audit(1569884566.160:79): pid=16850 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir480194756/syzkaller.QUV8HF/236/file0" dev="sda1" ino=17265 res=1 23:02:46 executing program 5 (fault-call:21 fault-nth:0): memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 363.281136] audit: type=1800 audit(1569884566.160:80): pid=16850 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="collect_data" cause="failed(directio)" comm="syz-executor.1" name="file0" dev="sda1" ino=17265 res=0 23:02:46 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x2000, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=@newlink={0x3c, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_UPDELAY={0x8, 0x13, 0x5f5e0ff}]}}}]}, 0x3c}}, 0x0) [ 363.515082] FAULT_INJECTION: forcing a failure. [ 363.515082] name failslab, interval 1, probability 0, space 0, times 0 [ 363.527358] CPU: 1 PID: 16862 Comm: syz-executor.5 Not tainted 4.14.146 #0 [ 363.534667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 363.544040] Call Trace: [ 363.546746] dump_stack+0x138/0x197 [ 363.546771] should_fail.cold+0x10f/0x159 [ 363.546790] should_failslab+0xdb/0x130 [ 363.546806] kmem_cache_alloc_trace+0x2e9/0x790 [ 363.546828] snd_mixer_oss_get_volume1_sw.isra.0+0x96/0x320 [ 363.563417] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 363.563430] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 363.563443] ? finish_task_switch+0x178/0x650 [ 363.563455] ? switch_mm_irqs_off+0x2c5/0xec0 [ 363.563468] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 363.563478] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 363.563488] ? snd_mixer_oss_proc_read+0x250/0x250 [ 363.563499] ? trace_hardirqs_on_caller+0x400/0x590 [ 363.563511] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 363.563526] ? retint_kernel+0x2d/0x2d [ 363.563536] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 363.623667] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 363.628868] snd_mixer_oss_ioctl+0x47/0x60 [ 363.633130] do_vfs_ioctl+0x7ae/0x1060 [ 363.637044] ? selinux_file_mprotect+0x5d0/0x5d0 [ 363.641817] ? lock_downgrade+0x6e0/0x6e0 [ 363.645985] ? ioctl_preallocate+0x1c0/0x1c0 [ 363.650627] ? __fget+0x237/0x370 [ 363.654097] ? security_file_ioctl+0x89/0xb0 [ 363.658521] SyS_ioctl+0x8f/0xc0 [ 363.661904] ? do_vfs_ioctl+0x1060/0x1060 [ 363.666068] do_syscall_64+0x1e8/0x640 [ 363.670073] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 363.674935] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 363.680137] RIP: 0033:0x459a29 [ 363.683331] RSP: 002b:00007feb90741c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 363.691056] RAX: ffffffffffffffda RBX: 00007feb90741c90 RCX: 0000000000459a29 [ 363.698342] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000007 [ 363.705627] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 23:02:46 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b405000000000000e2604627f045050d5e70d7a8826e54706110a4000000000043e7cc57df6485a3498df41e8837f12f8fae3716058608c769caa853e2e81fa4aee7e93d017b397d5ded11c1be398ea0dff205f305814ed5c3b6f35379e2"], &(0x7f0000003ff6)='G\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 23:02:46 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) r3 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r3, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r3, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r3, 0x40106614, &(0x7f0000000000)) sendfile(r1, r2, 0x0, 0x800000000024) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000040)={r4, @in6={{0xa, 0x4e22, 0x0, @loopback, 0x46cd}}, 0xe00, 0x0, 0x0, 0x4, 0x100000000}, &(0x7f0000000100)=0x98) getsockopt$inet_sctp6_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f0000000200)={r4, 0x4, 0xffffffff, 0xe1}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000280)={r5, 0x1000, "bde10c415c64c21688c8103b1d40885da16b3978eace483dca77b08d5a7e46ce96817f9a9e8051e9250a8b12f0a2538d029e1bf673c0272c69550cb3198740afaf527893a14c2d5565f4a412c76656a92979f622ec148388e175534f9076bbe6c8ca510af5b39c5dc41e5342d856835b7f8d92fc4fcfb2bedf4d0543b9b76e5ddb882f8041915516bda5f74622dc4fdcc5d3dfac46b2d94a8dc5a1c203f00fed02a31fa591343dca51241ea3c6242c1c53c99f9698200b500c60e37817bce0b6f736f9d031a79b44ea7d5aefc2477729ca7fff047c49e709eee040eb55c70a218d9455cf3439ec13a491a3da8e8ae7732e2c0bec3c706ba7fa3dc1bccfd3b2bb4438da59b9bfba4579f66b8e3876abb1ae7e4f5ae1bc55df7d76e9d61816ae839d710d03462378669b91f86c98fcdc56a595db52840126e2f3b74a20dfc21f1f2ad86bec052fc55d802d07bc0f4b4e9a1347fd7e6a0bab2adde52c2c2c448f1f32f52d5b60ff062155873a6c3f45bd4306e1f85601ced76323177dfe61fcfd239376a0640a645bbb9e63c5b37874176e49cea8aa1f32a0757838e77a837bee2da9247c52f1fdc32cba13ec07b730609cea1fb1f1963462c5456051c0d27b39842d3364c7c4578b1127a1b664fdbba558956ccda99319f0d345edd2a050b2ce1ec0a0213dd5e2efbe5da83eb7cc63234a5233bc12678b0f7369e28ab5a9bff7082a9bb4310a851dba8966d1d59b3239f52f56366cda6198cf33c2c3d7473fd4ef66ca9b28cc9a1bf229a8cc3ed1fdcf58b3ef8e183cc91f52c4385b07c1a82befd141bb28ba968c1143b36c4ecc3346bca47fd3c8dc1685c8c4e49599d65eb40c7c208859e22d2133f3ed204a6cb4a2318b6c6d1829a83dd099061594eb851453c5857c97d752b7fc6daf296da0b589ffc1af6c14243191c411aa17de3bb823c7c0c2614af74d8806691d4aaee0da2517a79f4668677586a5a10d637c7d721729663b2aa7a5339227e498a3291655d6b911c02fb49776156a5f2de4701b6b1980e0c5ed0e3be830ae793c34f57c9f8e94f1a04d67f0af2d7d84fe6a42a8db5026ee71d94d47a5556097878650dad5dc4ad1c9314c5116d6291a6ddfe8927be9312c2927681376a6834c8eb2861ebe689e6e66ce1771b4a30ad369942105dc1f5ded09bec35129ddc3e46713e991a91c591cdc2ef798253d874f046f3b227eef8af57fd88c87965cfebf3072cd0f810f638acc7a6916380c9fa9dcc339611b3740a2996fb43ca20fd9629173ad90c7dbb9e9a1d80099fd35abb4b8cf0830c0d4b4d82d9b7244e98f11f21966262a8a53370ebe40cb55a27766ec964977f370fa580cd4fba7686d97dc2cdc7aa2c13ab61d0a5f922b757c96b63e6197042614796a2fb2243a18f232b3ce24e15de433da624e896f0c41dc5ea8e660b7b8706acd38b96ef23f64b4dce7917006217209783b46a0637082a96b9bc1e84858cc135a097d3691f6a4dd27fecad1d2dca337d47f9df9d2ba810449eb701f2e0238eddc283f8fa3a4fa617300b21221608529277191a91c264e619c47a66e1dbca989b146f4d10e387db6dfc7ed20da0a6e5b731fe12becb2ed1f6690c08207b90ce371752d25f44703322b3648761a95363173eb2f31b1ac7e5bf5d411bd983456bbb7acfba5c99396250f795e20069b3c767d7833abf57889c9b254f587b23c84df96d057971823f877d66b530ce1b62b96a185c47aed254fa53e30e241716627d58e7ba386f7697e2d78046567cf37b9b0143a199cc7496ba9b7445ee5031c1507fa9b24afd3675acae2c8c6310f9792968274d8ffd759b5eb597ef5f5ec83948932df77704708a314d04f3364125faea3cc6bcaadea286db948862baf41ee48bdb7b5448a080da3b1b2c328a414aba2c782cec98cf7935327def7ff1c54ca3cd55016e36af763cba4c134ce2cbff79285d3830f261e604f53dffa34cd086c86588c9f480893ff2893a2b31e720826787582e0dbfb3d65fba73cfe9fdc982072568e60f4edf503d55b1ed93b24a72ade7215d489299c62b9d4ac5e7ecd5c28192c0172f80b377d0fe5c771846854c1be9442209cd1002f5b05168047174642d163d7441f332e29c85f7fa0c156ef022d038f781c7b879067b4d82dbc3470fff88d64ec67b50f0b33fbbaa95dc40c2da6693f095a657b2809d130ce5f0fa802088cee8e49d4a73fc74cc7865a7097aebe4aa73d3f099cbd8439cb0eb1ca683973270dfb1eeee7021b9f6d16aa0d0c2621221f063eb39749e9025a9923df5c85156f003b3dbbcc5b47300f6f67053ec7d3b51196b646da790c3640821c17858c0aec8f51b9a11cc23d7651aacc07aaaca35ad72a991bc31504727f13d24c754113559ec1707f9f38c66fa8ef10c13c1d4a99c820091013446472a2c54859e150b390b809a597621918999b9a7e58d8cb848d4ce39ee4be259d757588f48c2161a52f0a6f4690190461863b5ef662ac7c73444e0675d1e0ac84bd33905e5a8b45bee5af8a1de60e1db6762d364dc3cfad76750698985d2d98d4e54fb0310f01910d3d3a96a07288739fdf3d83db40c5d499a912b20936faf6e5057daac7ccd6bf844dc54ac436721aebfd3d3076810222e987612798e53853abd2e4cbfcad2a222d1cbe44b6111af113ccca20ca3277ee1b98e4d93b14158146a1ae04645489d35106948807fe4e7d8edd8673e72f76332fd75859fea3c9897c85fc7d590ef5f3695b0f1bb4a12866c7b635a8b7e6f817099624674e6713f35fa566a70c658b78f39aafab8a0173dfe926a671f2075073d68713c82fc3f8b16df893d06887c55f23112d94ec31e4e6b9402894fbfdb299d7270fe66b84f614ab9e85db3a8e831fd302a542f46ad5b608a3966fb5058569b7d3b938b4b949c7f262d5ab04a9ece9d978e7ffa4cfda3d7d9c57d31885d1c0254f5dd668a1a2e479b560849b2182973770ed31e6375fc25664a63f00b6ce03c214c5e2c64bc6dacec42afa64e781fab04e74c9dda7f06b4e667c419008dbd08b6c2518aa313924c3449b29307335807b09272dade253dcce0e270974fc03481df844d391a3bcd3b759ec373e4f68e95b3dd37647e5a6e429e99ca78b6634171589614ecf4ceb126822505888146b0e8609d161221ac35a236e15cead4b2c5f2d043166f1657a7f1529a9c38877945b5f65d8cc694c863627bfa360d7123368bafb3bc6afb047e8583953fbe1703ec6ef75e880650abcbd84548e969c77acceb89b22af5308af3a28ab68dec8975639f970dc5fd016d361618dfd5404dd757076255c85e462f577b2f3254c603ae776ef30bfa46781a6036ab41456e7489ef6dc86776303c6e4e3808af504998cfc8ce9729ee2c8d5697d51fcfa78bd3495f76fb7e60c260a3fc5519d17ad519299e80dc603c68a33a5d90400c7776af647cf298dbb3063a8d939e24bb8efd54bbc8895e343080a04bea7d0f58963b840725271bd656b5b803851b70db59854b5886233d4cd175fea3dffdf33431a8b000387a66ae30c75389c09fcd1737a23371e7d66c28c396540e2085d9b9c90f2ffabc433b7bed67033d502bb243cfc6ecd059cc4ca16f068d8170e9f8de20be1d987485c13dc36e778fe1b63eafb9bfb28f09f696847adb0c6e79860ce1d5be6190a2cc10d390c23c8c8405af55e65dbc93c9881a4ba49b7c848afb8db87204913d3bf9eff162a285d9652a2f08f4ee56b6772f882c96cced87dec8717f9ab091ff6b35fa2aa529c129d5bdf26a7ff21aa1e6f7057b68bdc0148bd61a9712f332352bf386b9c6b672c171e8e64856399ed8d7e4017bfa168c36b2f9e888ab9a6a34e7f9c5ac60954d1df8c6bfbefee4a393b22a0e58642134ceb86b8334f46a02f8514cf59ec7849990e01437b5d738dc1807e90cd9891eec9146b1823dbe877277f3c76aa961edc21139a6249d3dbe05be80602062e06bc1617ffec57cbc863a3e41b252618e53c53eb8031efe66a204de70e522e74ff51aad3218a78b9a9e628871ea39acf38122b46fdc10a91a6d27b746a9199daa358a9feeffffd5535780f32f693bd6a6af9ffb1a1e80bd6689088dac334867f7b35e41b1aa631862cc692391f0d1b311c747d12a598f0f6c1425f59ef243b027b697074fee9dd7bacdc961b9595cddd9aedd179fab187f5d1691b9a42eff81003ed0d3082d2a2bb6dab38e36a04b87bc2684ca7ebb9938c2445a22f38f13a3d8fdebd4e30886673ad23df31abd987f1ad4d53113d23cfe0a1d93a1893dad21f77abef7213010bf2c869d490aa0c4cfefc39c703f7b6d012b03333af1420b9b3a1239ac9e48fecac8c1c53ae5ac367728a86f568ce0da1f01f7deb0517eff33e77d07a52cab3740a726b24d48d79353aea37eeb4cff3fef3dde005a6eee030d33478f534a3995e9b84a57d3fa72250704ad62eabba143cfac4037eabf7c0aaadd342100d502fca17b84118d037d611bd67f334007e05a1cc8154b631a28854c8e2e25b157374b54bdcda4c8c1afd5d48254431b0cef347435776192f9d394f169463368031d539a73ee43dda384205233861835fd37262f1a1d812aadcecce24499be5392e02b33e96443b568fdb9c8ddaa17b182e5730669557414fa2028f12cdae951173e694ff13c42bfa51ff763e86a4c20d0177876e8cb5f753d1c2cbee66bfa4f7a17f418ab95382b24b6fe6c30772022735df7edbf7c557754e3f4aa985d6717b20025de8914f03ffd471dc6b8711de7b954511e79733eca2655b11c629b44c59ccf3cee66a0460411c98774fb0568c8f96ec6c397be08e8441ae50562d60ee2d9712df045d67e799d11dd990e9262d903f3f15353705282622654b100f11c7568bf7bf4bb2a9dcd4d53d578dda0d2858d67d055b1d584fb71eb4d701a0cf4321b0cb487dbb66a910c35aa4b90f9314d8693daca138c6bf000ebfc281591d7d9d0505f88eb7331132b8f71dea98c6ad8bd21ef87481f59d2b7acbdd17f74a1579010bd2dd432c72d7e46fdf2a009f288fc2fadb66682e5e6ee9490f7a2b94d545e0a333f419c4986258893d8e57b36690b1350c66d05b83baa486ac75a2c4c133b09b522cfed7f7024fd631f7f6d9e8ae9ff0e2fec1cb6897d9a79053177683f27da038d9516cc496afb1590dfff1b7440f9d057e199eb37461d64c18724a1f701e8299f855ce8ee847a920dadc22c9bc3b3903ff81486cff89c45b51606379f844b34988a15bdab69f57a03548fdc5964989ea9c2cb84fcab505118b06cf41ccf234188a009b97f7d96e2522d7cf7afe35edc60c803912a0d16e0777fc20a16407335464e35097f6d71f7c29748d1dfba2a7d17ae36e64b4bb0dc000ccf4dc20ff876ad54fce82b729d813035c28fbe36d494e2a535c5b10103385748d37205965fba21a4ba60997b0ef6c48dcaef4a8b74395d4cd2c6e754e26ad87293ced95936473a2aa0cb11295401486161dddef8ae002e78340269905dee8ffa68cea5c9534eff6c3edc5b99650e517f7d9848469040fc48e49c095587ba0bfcda4e859c35128bfd29c50ffe34899538a7572544f9c5d90beac44dd289153a6b14e9eeabe9822944f844841706530e2623fde0e3d559be1bb8dfe3f11b11dc9ea95569289186f54a18cf96c632c54c1e1925ed8b95e6d946b8f1fd9a529c55283c5fd121015f1237468d3e3bdaafef19d2ab0e0a41d698b690c76ba5b22308c3a3be3a8f261f28424c04339f1129a9a0df54db39e05e2882d9f85a06c00dab4d2"}, &(0x7f00000012c0)=0x1008) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000180)={{0xa, 0x4e24, 0xffff, @ipv4={[], [], @rand_addr=0x2}, 0x7f}, {0xa, 0x4e24, 0x3, @ipv4={[], [], @local}, 0x5e}, 0x68e1, [0x9a, 0x2, 0x7ff, 0x694, 0x5, 0x873, 0x1, 0x80000000]}, 0x5c) sendmmsg$inet(r0, &(0x7f0000000100)=[{{&(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000040)="f0", 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0xfffffffffffffd3a, &(0x7f0000002680)=[@ip_tos_u8={{0xb, 0x84}}], 0x18}}], 0x2, 0x0) [ 363.712908] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feb907426d4 [ 363.720197] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000008 23:02:46 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) syncfs(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f0000000180)='threaded\x00', 0x9e27bacb) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000380)=0xff, 0xfffffffffffffd51) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0xffffffffffffff99) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000003c80)={0x0, &(0x7f0000003c40)}, 0x8) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") timer_create(0x7, &(0x7f00000002c0)={0x0, 0x0, 0x1, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) timer_settime(r3, 0x0, &(0x7f0000004f40)={{0x0, 0x1c9c380}, {0x77359400}}, &(0x7f0000004f80)) clock_gettime(0x3, &(0x7f0000000ac0)) clock_gettime(0x0, &(0x7f0000000b00)) clock_gettime(0x0, &(0x7f0000000b80)) timer_settime(r3, 0x3, &(0x7f0000000bc0)={{0x0, 0x989680}}, &(0x7f0000000340)) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0xb729f85e0f95469, &(0x7f0000000280)=@fragment={0xc, 0x0, 0x53, 0x734, 0x0, 0x80, 0x66}, 0xffffffffffffffc5) sendto$inet(r0, 0x0, 0x0, 0x200007fc, &(0x7f0000000b40)={0x2, 0x4e26, @broadcast}, 0xffffff7c) setsockopt$sock_int(r0, 0x1, 0x2d, &(0x7f0000000040), 0x4) clone(0x2102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = socket(0x0, 0x0, 0x3) r5 = open(&(0x7f000000fffa)='./bus\x00', 0x400000000141042, 0x0) close(r5) r6 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x105082) r7 = memfd_create(&(0x7f0000000140)='\x00\x00\x00\x00\x8c\x00'/15, 0x0) pwritev(r7, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r6, 0x4c00, r7) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r5, 0x0) socketpair$unix(0x1, 0x2004, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x800000000000012, 0x1, 0x0, 0x6, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x3, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r8 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff) ioctl$UI_SET_MSCBIT(r8, 0x40045568, 0x16) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000003fc0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000003f80)={&(0x7f0000000c00)=ANY=[@ANYBLOB="000026bd70596ddbdf2512000000100001000c0002000800020000000000640005000800010065746800080001007564f1f85ac74cc784954348a6d7700008000100756470002c000200080002000100000008000400400000000800010018000000080004000800000008000100200000001c0002000800010001000000080003000300000008000006000800010056a5000004000200080001000008000008000100332b0000080001000000000004000200080001000104000004000200a00001003400020008000300ff03000008000100170100000800030061000000080002001d90000008000400b43b00000800030002000000180001006574683a7465616d5f736c6176655f31000000002c000200080002003f000047df00030075000000080003000104000008000300d75c000008000400e0ffffff240002000800020003000000080003001600000008000200ffff00000800020000010000200007000c000300a50d000000000000080001008400000008000100c6090000b00004001400010062726f6164636173742d6c696e6b00000c00010073797a31000000000c00010073797a30000000ec863fc8b15e4d1cae83d1001c000f000800020003000000080004000000000008000200000000000c00010073797a31000000001c000700080002000400000008000700013c00070008000b00050000000800020000002d5c1b3b00000800010011000000000000000a0000f50800010016000200000000006400019e7ebc34d1bfb37acce1b675341b000c00020008000300ffffff7f08000300834300004400020008000300002000000800020000800000080004000100000008000200ffffffff08000200030000000800010003000000080004000300000008000400ffff000008000300030000002400050008000100657468000800010069620000080001007564700008000100756470000401040014fe0700080002003e03000008000100190000000c00010073797a30000000001400010062726f6164636173742d6c696e6b00003400070008000400070000000800010000001900080003002700000008000300ffffffff080002000700000008000200800000000c000700080001000a0000000c00070008000400040000000c00010073797a310000000054000700080004000900000008000400020000000800040001000000000000000002000008000400fcffffff080002000900000008000300010400000800030000000000080001000900000008001400070008000600ff0f0000083b867eb6f8ac0c1909768258f59d205b27ca194f9fddd923117ae684c7627848791e9a8b453f15bd293cb263fd7c83a07960b748afb49a5cfb9d152e1c30a5afab4a2cab9042bb6ae2b2fd8a9ef8f715e3f150b4a1c60e93cbda5f001df90ada8a18ee04efac5c38ea2848473287b1f95ad573950f1217c8b5f98fa204009023a9bb3ba9c6230f34cff3c9fa11f1fbc7a719a25822834c795f93583ce2b4e9211e3aea9800df7aa37e479f843ece2c38b465bfea5173114dd35f45265b7c495f7f2b0ba9721eea3963880788208af595e25d6cb70a46d3a696a6cb5b6a0e5ac393800c4cac33341bef97ec119c664f0ddaded84929d542068abf2c9715923dddc94d1df4e0d95ff29ac1a4e5f1cb2ac540e18bfff352eec86c32c33be4fe194f96ae06ad75c3d438b195a0a12ced262191a97499ccaa934e3818cee9a0101f94f9be827f39dcb9c18192e15a5001024eb2e56df3e458f4843612f8697380aa431bdd8b274f855b0dae21f1ab67e5b0516604d90b74f8fc7adb920804a6c4ed314e288155f5945278f0e863f02888a86106b4a0a7d6bdbec1b4241ff5876d927a3e36c0908ea93d2dd9f746cf1ac8b2f2c9e168a4fe90d6eb990e3adbf49dda5c4b67c0a89a6cc1da9e14331231e39c857bcc6b6de7bfdbd306f03568c9ff76659dbd0316db7e2dd8b20f90424fe21d32a2a7fe08c9dd00000000b8d58ed508640f23277b70f831421e99c00b6cf8c15539782621caf95e558fee5daca684ba1df57bdd00aad5e342eac54a7bac6e4bbc717b251cd49fe033c3eb43f02bd355ba5e9f21352a992aa8829083b55a41bf6cecf12bd21efecfa1a43ee8c54de26fc263a9bd533cdf6cbc42b6eb7be1ed4f1ea533e8437e80a0cfe402ba742138d9f0b92209752dfe29e245328f133e56fe6291f22fc7460000000000000000000000000073490cf731461d151f7c3480c9f779b097689c03c4b8c5ee74e114344a64f62c9aac64a33b89fc7572b951f98dbc96ab381d62105f6b3f0c920c732e5b8d0f881df75d72d6d72fc15c1cb07e0ed619ae7129dda88e7051a7aa68f3f87bf5933aeb4ddb9e50c0bb7a4e59c50ba5a31d17eda76543cea6279460e407d21ceb0bc948b66c42a6f402e2462e3e"], 0x1}, 0x1, 0x0, 0x0, 0x800}, 0x800) sendfile(r6, r7, 0x0, 0x80003) 23:02:46 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) ioprio_set$pid(0x1, r1, 0x1) r2 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x0, 0x1, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x9) ptrace$cont(0x18, r5, 0x0, 0x0) ptrace$setregs(0xd, r5, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r5, 0x0, 0x0) sched_setattr(r5, &(0x7f00000000c0)={0xc, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r6 = dup(0xffffffffffffffff) r7 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r6, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r7, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r8 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r8, 0x80044dff, 0x0) 23:02:46 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:46 executing program 3: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 363.930696] audit: type=1800 audit(1569884566.900:81): pid=16850 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="collect_data" cause="failed(directio)" comm="syz-executor.1" name="file0" dev="sda1" ino=17265 res=0 23:02:46 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x42480, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) fchmod(0xffffffffffffffff, 0x24) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f00000000c0)={0x5, 0x3}) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:47 executing program 1: mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) creat(&(0x7f0000000040)='./file0\x00', 0x0) creat(&(0x7f00000001c0)='./file0\x00', 0x0) unlink(&(0x7f0000000080)='./file0\x00') tkill(r0, 0x1000000000016) [ 364.087625] audit: type=1400 audit(1569884567.050:82): avc: denied { map } for pid=16892 comm="syz-executor.2" path="/dev/loop0" dev="devtmpfs" ino=14112 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=1 23:02:47 executing program 5 (fault-call:21 fault-nth:1): memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:47 executing program 1: openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c00000010003b0e00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012000c00dd40bf936b482eb4e595ab3e36fc4ac87f35948b8235"], 0x3c}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r1, 0x0, r1) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000000)) r2 = openat$ashmem(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000100)='/dev/null\x00') [ 364.259870] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 23:02:47 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000500)=0x5, 0x4) sendto$inet(r0, 0x0, 0x0, 0x20000801, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) r1 = perf_event_open(&(0x7f0000000140)={0x5, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$dupfd(r3, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = dup2(r0, r1) write$cgroup_type(r5, &(0x7f0000000080)='threaded\x00', 0xffeb) [ 364.409091] FAULT_INJECTION: forcing a failure. [ 364.409091] name failslab, interval 1, probability 0, space 0, times 0 [ 364.420772] CPU: 0 PID: 16916 Comm: syz-executor.5 Not tainted 4.14.146 #0 [ 364.427952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 364.437557] Call Trace: [ 364.440197] dump_stack+0x138/0x197 [ 364.443867] should_fail.cold+0x10f/0x159 [ 364.448048] should_failslab+0xdb/0x130 [ 364.452196] kmem_cache_alloc_trace+0x2e9/0x790 [ 364.456887] ? snd_ctl_find_numid+0x34/0x120 [ 364.461323] ? snd_ctl_find_numid+0x5d/0x120 [ 364.465759] snd_mixer_oss_get_volume1_sw.isra.0+0xce/0x320 [ 364.471628] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 364.476755] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 364.482403] ? snd_mixer_oss_ioctl1+0xa55/0x1590 [ 364.487188] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 364.491883] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 364.500925] ? snd_mixer_oss_proc_read+0x250/0x250 [ 364.505883] ? find_held_lock+0x35/0x130 [ 364.509982] ? __might_sleep+0x93/0xb0 [ 364.513880] ? __fget+0x210/0x370 [ 364.517358] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 364.522387] snd_mixer_oss_ioctl+0x47/0x60 [ 364.526639] do_vfs_ioctl+0x7ae/0x1060 [ 364.530756] ? selinux_file_mprotect+0x5d0/0x5d0 [ 364.535525] ? lock_downgrade+0x6e0/0x6e0 [ 364.539692] ? ioctl_preallocate+0x1c0/0x1c0 [ 364.544127] ? __fget+0x237/0x370 [ 364.547601] ? security_file_ioctl+0x89/0xb0 [ 364.552144] SyS_ioctl+0x8f/0xc0 [ 364.555538] ? do_vfs_ioctl+0x1060/0x1060 [ 364.559710] do_syscall_64+0x1e8/0x640 [ 364.563614] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 364.568592] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 364.573803] RIP: 0033:0x459a29 [ 364.577008] RSP: 002b:00007feb90741c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 364.585054] RAX: ffffffffffffffda RBX: 00007feb90741c90 RCX: 0000000000459a29 [ 364.592479] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000007 [ 364.599917] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 364.607207] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feb907426d4 [ 364.614800] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000008 23:02:47 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0xcd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendmsg$nl_netfilter(r5, &(0x7f00000025c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000380)={0x2208, 0xd, 0x9, 0x2, 0x70bd29, 0x25dfdbff, {0x1d, 0x0, 0x2}, [@generic="4beb6e233a5c8a5fc7039c34af93263324c0916bb6b8748db9d48b3a47c9b9f262cec1f448f7fbc4ba1f3d1bccc306f5bb6bedb11ac50ea88278f28167a4d8f0953dd1c39c30950f4a65aeade9ee57567bb87d61016cfa36db2440a5055b510a08acb0215aa28cc012dd2e7cffe30fe661c3ed3252445e6dde63b6c92491c5dad00fd357e034db2fd819e4aecbeda11dd6c60be92814d0c20ce98d6b4895194c5ae17673d960c4efea5f904f0bee21d54e908fcc25f3ce8bea4dd6c682fa255de56cd817389388912db5620c9d1cdeae47471618834006d645950abdba727f9491c8eac326", @generic="44f7e8780601d7f7c0afe2706f6563f75e82556dfb1ca3ce9d3fbb688b76288416de89e2eb6ee8db4da9a5637b8fd7339f9a590af2f839da31eaf412a4a548b60c6d356ef752c23e29afaf2b9cd5120a5ad6269c3bc1b56e55f933ebb57ec5a0ed45cc7986755f1334a80adb5e7fc6a2649bea6b3e713ee61ff89e15589fc567cbdfe587a259202b4274ad433e5a72f8dac77651341c06f14dc2400c7663db231a0455e2cf546ac8e0feca4fc584ccf29e6cf493e20de60b6b1a5aa7e279eb41a86f96c50ebf01b304b09f3bd9fe8f39766a98e5ec324b96110fef1cf2afcc956876de42543cef61c7199eb2b427a2bb780b15c1fc9b768192a31d345398b41722afb78a2c0e2fd7a38c86573cd71e3cfad154faf46caa20ebcd48a434f2c6631923f7821e289a11b72bf676a1920603ec4eef4eef3cc1d00cf6be660586d6066449a1d89117d76bed95fa4be48b075d6860ed0d52ab8a3882ad0ed9a792a80a2ce2ae410339ef1a7a804094b919eb8395d6b4b4aef65babffa3cb4438e8de8ea501cf9afe64a463a6b06355cdcc2d7f3c56192c515c4c82fa0369f53b391e2c1817e242153b12c15d3a745bd2840b5e9c0d86bc86a8450006b2c267805a9317584d19de823a6362c4e97c5b13ddb0c666e9159b215fca0a5fb5d2f9dd66bea117a4e698c9fb19ad5afe414260501cabf91e4003d31917bf719a717fe690577bd55cb9e0af9db94c489d8c4648245ac101b01aff20465a89b81aff5fb700c7099b8b205fe81541f9b17b996d97027eb0b0f0e97a7d43867f7e8f422e09292434b94e5b8c6bcdea0817230e41a70c5d1c9b6e065b4b11ab6933d75820583bb04c5550d9f30e2aa34be7651e7d3e0a8a078d824faa5ea6088c5936e9cc0be19e01621fb8a02297d1a854a40746d30f1c7e28fe0bc292383fd54e9bc308fb168339ec71c4117f149a7532a92f05ca4d4478033eb41e04cbaa67ba902629da9825f9a469860c32e6bb7aa8108e20e647fcf8b242b8584fc020825a63fed5fad9447ba64b70b7f4418b0c7f0cf81153505e99688ef61bb4cfed67709a0bb7a53c7437af4f0110583ee2f8be3cea3604b382f5e7caf09bed96a82467a2446fc033660231977629bf22f95f395855d95d473a3d7334710c9234ac5208a0978b1c6498e7278f323eb66ca54d991c42f756ace49c3fce105727e14f7cab355862d95b237fcb52f933697ae84ff5ba2f95f87777aa1daa4bcd60b94a8e182f095270046ea42a85056dd3f8b8bfb750ac8a5e12e58a50516ea7dce367dd9e120b0ccdaa1581c7c9d79dda6aa32d6a48e7a7930273eb9ada7f17bc094d1c224182d6987358705bb280b758f3e525e8fb25df43c51bbbcf581d34028d91ba1e7454c609c5d5a1fa82ddb6bdf324c733beb8cca2275880d2c078c21440c48510e802334b727c76b14bd10c56c7904ba1e4f6dd3cb09a1144350c87b89e3fe8aa80a36a9098cbda4201a872d650f86d0ee3fe584c70facceb463397888a2c59140b5233401be952e259cc3a08ace206514ae2f7dc390f910668930657cd2c16e80a9c2988ad27baf9f8afc0f5e12d981a387ba086341c2530e6521a79c403a169f51ae796bf8012353d0a33e3a1b3fb0ab29da054efb51e9414ff82b05977364ffa7fb6b383469fd9acded975c7eb7e01ad53b2182ac6b1f0cd2522ae85d4d705c36940e3434fc93c73cd8e426055348240bec1e0227ae5f3aa5cde5d60803f5bd1c830c0e1c77eda87f83fcbd336e55f25ba28d62543fda0054470eefdc97262f7c6b4e2266144f297d1f7d6aeb5f72f3fedcc818feb7fb5656ad5d7002e4bdcc70ed07561aa3e7acb423e6e7419e7f839a18ab28c917d1dfb5af832f6d352d00cb8f93190eca0175cfe27d91496ab660c1ca5839fb551e0d8758009f61352a15d0287335170bfe00778eb4539c5ea53d240a1dd0aa30f84e9949c569d05943b5fa73bd4ec364dbca70f123c72233df9becf772fd0fdf446a64a9c688ff4bc9ca13db905edd6ddadc752b6ee56a6115391f2d5629820856dea0306bbc54497b3590f2c0e3ca99104e9018e9c97d4c991345961b75aee6c7387412d478cef6d648b932fc54ec7a46bf8182fd715203890075c2743a66c18d0492fd52333b1d4f76a3287d2eba70bc777a31edb922a34bb4a9f5ab75611fc1f72ae8e0123cbd838b115853fd9ff4632361dc2c9bd25164701a75196911c7996970045ccff2e375b4dffaa50882e8b00fbb117ec57be071188d95b218911be60901f12689e9aa794684067180016669db1e4cb479a41b537983a3e38ce62b5f5ed8f308a8422706bf63dd039a8e5e6112d5b6aed4f0a137839b7f3accfb92293ef3f989c69cc37494bf20f931822df4e12e152494a9645067e981af2157edc4541ceaa831b6c8f1befba7a838952197e1daaf8e7e85d5ecf2ff996602b61da7757047a53a0383ebfac1cef21386d24a97dbb24cffb88f91f012ce81e7a6d5cb86a7ac9884f4c6f330fbd0faa894545c4ae23a49c0fb1b2824b1d4ab2989d97d9ec9952a4af6a2ff8248a829e061f4e70ec00f0ee56584d19f773f6a8babff2f18e157b2349fd80e80f3268335e0ff7008fd7cb1902e48e5d1675d5d09485ce91456ba014b5ca21fed73dbb8183ce04553287f6c01e95c9e68135c2f60380cbcb0887bccc76e61e7d4568b0a0e20cdc81372cfda4a36c1aa90c81f05dca2602e16b258e61c1a2db203133e884986fd17f921718ac3315334466f175ae486a03b8c393ea495c9d38a30906cc6b63d45fe4be2c13e44906c0625b9098852699d70212b90196ed7d98bd776bce8397781e81876a40ed77de32fc8e234bbf1e2cb4caf31a23b4c3b7249b5dbb31d5f4581b240b20691f2f609f0125e41fa8ca0fb230c7b5de69e0a6650b92782b875c2aa281da7b36e97979fc64518642dd8c7293d6b11a487ddec3bdd8ad2638456f5e2aea09bdec9043828d884437750e9f76df402f65faffcad7dcf98f9e48c1789f4d45346446323fea856b9d32f411937fed7604c0881a8cf7ce7bfc07759cf64ab202e8cb507af18d2d1f2496ff41bc5ba374817df8fcd3dac867a9b7d1788c5626fd928312e51fc8b364f98c54719656d0619ea480b746daa99c85ce0975c4af07b49d8edb858b11d4d1dd483e9ace19c94c73eeb69806ba72b69f2cca406a0cab045d7da751a101f5d2746a179d3dba0c0ec01f06aab9af287eee9db763e2fe7ac7ac46636e4b09bea33378ae4654d19d5cf2b5a4848cbe7b8fbca067a9fbe38ed0dbc09cc7c73e75940528d956e836a1f98554ced722b738a88040a77a4ab01c1192d5ea4305d8e3bf049545b3b3cc179565d2463cddb3b59d4554e1fe53e53a8e64d40109b07d592717da50e15f0f7839df8608f59c6ee2a9f61fd0fa31e2efda76f4afde72d910c5eef3b02f5be93b401763ee9a7772763d518cc95d51b45c334b4d96fbe16238dfdd7f8866fe5ae76b693398c8af40c68ba1b50dd7409bab02e894649e4c10c12bd147c50df5907a103c595b526ba98e193a8ee821a7aa9a01797193590520637e38908a95666cee162aebdf68f37c2126055defb00d0e3a9e25d9cc3abfedf38e70644c00cee6b63d5b9790c00b84acc8a900e4111bb3b55b890699ee8b4c21d72054258e43d2e6a189dd578a445ffced00d4ac70cf07b82963c64145b554b4c7cccc00c6a6ff7b0f2bb58aadfa2a73417a366a3a0bcef022b6cef1759c7cb4db8165fcac0e06150243423ee2b01689eb9f4361ac0b019152b41670816e99d3343039fc5d6cc4b8a0f4bf728da230b2bdec26391f8e86d444fe04f4321c05fbba74c79a69d430f48c98454c61d3bd5bc77e254000054ba01cd0af65d7b235ac64bd95c6a0572d12afc371aff1951b8bbe3347e3bc57a79263db8cd44ddf99c9b3b039cfa57d4a1f1c7e716d6734cd880d360a0816eb8d6a809a3cd1fe30a7e01bb25acf8606de6fd843a59012156989785d79da11afd69b53cc361c1bd2df558a10e89bb22be400294a3f9f9fa8fd03c104ea948f9aeed6431e302ef88b393171581772e92bdc1578486a71fbf5ddd3a3658430e2c421c627568f24d6b7b9cda7b9287cbe0ba92be2d75a537d34180b707be90ff7909cd6f0c3e009052025ab8f14789949e3adfa16a783ed9239a7415474d8b3470d88d54b76de02776686efb65332daeceba61c39174440d1e5d2a2400f56c5ed4e0fbf5961994ffddf2ce572a1ce069f0f7e847fa2d8a5024695dfa2848e90f882460788a4725022caa6e079b2e3773fa593e8aac7c9264bbf55d71a3f7a972059da7d6a69156d4fc96cad658cbe700670d3f9d3b43205813ff73282d0c0310f21b2e1586da744dd23d7955bc02287cfa12ae6d7ac278888c561f98f18f80a425dc6e6799ade99a4c00c7c3b518e80fbfc8805012ffd992275ad5f37ce47c780f8657b3b5214a430e8e86c4307b184fec97a5e21bee6502f5a648177a89d3a9772c105b4e97148deca55ef2bc4a07852ca763d5fce1a6b4e641d13ab63c1e969519bd65edde9c9a3e7ed6e0d20749e5a4689980100018cfda2d9c769edbe6ce5bbdcc9d20809badc4e99ae24a60c03d4f36311039b9f7bff13681884b5037b12a0a0d13996125a149b19c90fdb81ebfdbc3be7fc471600f3527c64cda0eb0306c679d8e6aebcfb4351bb104be2dae36b514e6615b0b676400d25342b8bcdbf765111efc983190ab7b6eb5cf0189761893d3362a4ca1c98daf8ae95c8a3a4dedf77348dc163807468218e14aac8e89d878d7ce265eb0846ce724819b34659a46b8867099f3e00fccac955c812919dcdce5e683ebee1e227b99a7261c9bde1c234d464cd2b58db02220fafef91604350667c73ea50f48810f1dccd16f31658301240a1ba5c90fc12f687968e6bc3d5ab144666141ec94ee4be81ba91d4915157637c0cb1ef9024d744b670818092697d788fe6bea12d5b87eff55a09290eb5039370ca54d5e3a5a49c25bff72cfd4f4c5ebf9bb778bc83a594bcdc6e3de88fc8f98691865ddb4a8e66794133b7ff7ad8efade2b3ef2bef8de116f4fb1fa2a8c8327a10a7c8af00b3556df297d5fa926ccff4d69192a2291c514d958ee07ea88fe3cf44bc06171a3f6380d92847ac1ae4847260de558b8acc34bef8a954256008f7610ae64c7a58570f3a1faea672b65f153f823abdd243813bc1fcd898d2c3acef8140c1ac6625bf4a902fcd22ec44b1645fba3b7a52e163c783083f078a6a86ad2c63ec842e8d2dd0fd5809688196542c9b46a2e9592a1f87a4e7ce5cb28b55a37ac1a166336d7fcda7edfd9885165020deda2e70d6e05431a838e7291ecd01ef39949aa712763a5145e485ceca8608cd0aae2922ef4ff309b9386a5aeee6b99dfa95fa956185268c812bea8eb286ea0f821e92875f6747304040ab20756b6093cb77b5bcf8e6ccdc7ac419a22ca57cbc968c1443672bffc7be85774dd875a40d70c50f27a5fc3eb86a16a569616aa54b1fb641041d170d91e0e4a6c933af21aafe4a468d1186ce1eefce448b2f08cb5a45c8209702f19965346e4b3a73312db1262e4bbed7ddfb37261eedf02f334ce923e3e48bc8ffffb7f926f870c6cb242998ed7c9ffbc649855598b308ef28f213290fc9d88c745b9f19170c4fc12601dc93a5e5e0ea56f4e9dd6cfa5ffa805ab40bb87f82485a27194008b7bb7a484b2485ac06864bd80363e198ca486c6e337e6224e48e302367171e5cd89b26fa99486fc40a", @generic="467b9f48a32e3099fbff040eb4c3e34644a74613ff7ce00aea661c340e23ac36acfea0c1c13e8af2e4f0798a18e2177fd5c13684ee27572f39ec86ea61f8e80bc72586b5b2749d25d464a9273eccaa4a90fa95d8548df92a632bdda6141c4eac7e87d3139ca5440b9ece8db139727c9f68e412ebeee733f73a456bed90cf97b6470657cc4445ccdf002287b7c0ede8f42e48cdb4fe6c98bf171c2ee0eafca508628090216ea48baa4f968977420729c8fb087efeedd868f81f531e105b4331e48496bfc8bd7e06213b405ece63b8246c91b5e6b605cd23a670dbf4cc64e6a808a5b8490d2aa3002cadaadfc0265868afa0876c209f54b2f31b60e14fa8131c5df3657027c45a317b27358e11ae63e43e8aea626ea456ba863c75c1a575e8316314eb9544ac8592302bc8414aa4e4040068543688eadf0b8be21d8414322b5952d11ba5bb52b8ae60fd439aaf0d5147dc15815df110a05b56c3cff9a4bd9f51d1d612257f670614e339e64a6f2d738496ddbfc87e341211a49e6945436d3258497be2a92b8d1a8cafb3d0d17f30f8fa967d058bcf1a1dbb71ed70e897de66ea26ac985f721e60d73e0a37d26fe40814b399426437eaa253ac554de0d005538ef7e6ead6c2891ce13353651c3fa85e35ca49b9050b0230af33d2626faa8d3b951fa3b8d4d3a63501709093bed9572de5a7c09edf417ef06e245645985b5f221fb234f61f1f298f7da4064570aa28358878fd0d7c7c7786803357badb74f299bad82768575dce9ed7143a482e4028bd42597d54f34cff27cdde54b07447d1f0bd07644aec01d1574e3f09454269a2624ec069f0777e5779b347a86c08a56a2d538d57b5c9012041395756c8deae68a1e696791d2625fb4811fe49551b5993daa930957e8089bdbe04f69518f45e2685b22e0ab1679753e54ac59c39bb33771804c2bc04ba3e44b74390d59798266389b07b214171b3ff188a3a6ae7dde78c33b4933a6c5601dd2eadf27be2ff1a4381f2f6dcf9d5c5aabd141c79be52ac0e3f147cd1a1864a51cf10b0565a193097752fc368716dd2403ff4198cbf73a8d5fd35482851bf4de50a9bbdbadfbdda6288eb1abab2f40df891889cf82556cbee591a0d0ebdd539fa7da7bb74b6893e2c17054c8e0d1e5c2af14547ef2f159227d0c6e812c6621ef0ff537a8934709b9f39a05e8ed16b8c55834a6aa0eb95eb7dbfc04225da173bd889f4db7c377eb7094f6bdd77ba236e58dac776cc176e53969904fa810e61d2aa8e783cc68aa0bf3d97db1284cc066b69c94ae7141a2c26897fd88349b06db9500145480937e9c984bef5194419f6cbdea00e065fcf3b56c6b55b878d47c1d9ba13fbc421b5570b5a10ca915202eb8a13efd34c5cc0256d4d9bcb6ed8852562e0366cc7ed4b3e82a509d692815d71a0670c40fe213ef1f896829cdc5cc7e38c33177dff505f2f58b1eab0ce8a8d88aaef39b6f00b9bb0c22ef080d20491757e2ad9c4db021464fe2a232464c614c8d86aa9b07a1de461167ac137a90463e1c5912b61d6dbad086dc00c788686f107e10f5e23a9c0218fd0bebfebd554aef1941cd22851af1096bd210537bd4fa2568ec258bd4c9657ac7050c3289346ce17f10d2fee02befb589610d9f3814f755b61f9776ccdec3bd171b0fb9e405c71cdd7c3b808542c5683cf88d83f4273c02ec5320449eeb511dc54f6d84c4cce0d1b170c18f764cf3e7da3f7ac4bd4a4b36cbc21cb1245193c0eeae604405f0fd38ca84818e56865501e4cf300c9d5203f1c79482afc0800a87eb59ba9cc92963c9bb558ab9d1695b965558247fdbe1dcd7be3a4be52e8e62e46bb8c657deb3be18e66d99d2b31d30ab6f34421e65ccbda56203c3ef53e9a54c1733e3ea0f5054d5e19a77b5907d53714f98caa849f1a723621048644ee964f56de6af554a0d7463fedebaa1cde897dfbf259a9daa68749bce925a56f217606dc84173b12467a25dc500c691432031f96d988550fb7a0642b41e35376dd31d38d7f67d7c10547b1934b614cf2f5015dd771ab50592d11c7fe235b0d22a83fc241008f481a651c8bfc064f27dfc62633c8e5a362b6c406f17c73f1d48ec47b3d91143dfba7cce30686164b9907d9d0b9fc4c82c116c52b163ff57192fff9829176a8cbcb8312858ef96d7a8d730540ea72037490c210ac8d087a5566b1fde5d1102b0addce8b05dfa736f7a082739d3e39a0cc56f7cfed266ba155acea87f2f978038f0f8fbfe2f13d3756a805e289d8d7667c14d0225276eec626e8797b45c730ab7b2986e167fefe69398285944dc6a707c81bc4df2e60f02f26a19b277939402ae3d97bde37fdc8e6c2ea817236da0406a83c9fd95b43fd46fabde431166436119bbffe131a822abd6d442a528b3a404d8be05d47f64f92a2a985f6b216912d95319725addc025b1bf6845fd1b9d5806206c6066907721abe5f0c73751dd2a418a8ccf5fc921ee28aa2e0d74cbfd3d3a2ed307cf6413e677f8eb767f414a22bac4721017337f9ee02ae7ae62c4f0661fe800b0ef7d3b4542c71c37b28161c3e68dbc0dd901ec8a414924cca813b627507d856b2723f729cc80109e69bafab291fa50cb506a379cfb4ba3b154fd711456b0359e4b0fffe6a856252b1068b088e721049a7675eee2c4671c3fe0f34aa1cb2f278e7a4aee3e1a3278b6a6cc39381336d4606ffc0bcc7cacc51d36e32302d844bc93647b98e1e0424b7281bc6f84d43454931a527b95ca5c153c4b9692a5dc3bb205e188650a32e43b133c0a1e219ab43e081358e353c7e4dc6637f301283863e0b3dadf698eb81c065a6d5d8955a979e190d818ee3c22728733e7695b4ac2c6eb8839661be5fc6dd19be08204c533b79af35c4a7d58ac9cb80ad6851eb14d6fda14e123a361c4a10d02326ee9107f0479b702a83cfbba3535089a25cdf02e2ca9184e3829a3b96e9211045becc77b2027f239578c588e76209e2b655acf7abe1bcd2e11de26f4146b93498e14db91037876b6a3ef86be412d558f1f0fd0b0303d25954f5666881ac23c0e3e045d62790c103ed835619d844a9ff08abfc344e8a6416f3262b5e1c77b6d9c667aa33bc93db891838f6c574ac299ab1f49e5fca58166b841c1580838d3bcf098099d6d8ec4101c61784b9ddb1c846808649eae2c608bfaf967f65631fe8edddb9703d6660b9ea75abbe7eae6b41d8dcb0dc9b03d33df368c48c2abce40ca554dbccc547eb6dcb9d188b7bcc0a086c4a43609ade1cd7f72c143a78344ec233c4fa7e80456d234e2a15965112cf6fa2dcfc6ff40db74e04789d9e8e1aafc6c6a77400f8abaec08d17016524de77c06ed019926e65e37f7564d4e044179fcafef65880593fcde32f09da0be51dbb2de6849f424c3a1b457f3f1e9224dda88efe6e0e2f66e6c3e063771c9a7bfbce77a4fc46554cae7d4233425f1f1e1be12a45aeb3d41cd95b406bb96df6df18578c05b0d7ac163715788b8817a27b27c75e3025b982116f14ff7ec973485bf2468c4a04b49c4cc951d4e6afa9f828e1681c350914087d5828cc087f6b5d4931b5f357200de7f588309600a303c9c3a266945d9ed5fe20e04c05e31a222131ec10a8c50e7f398f81674a8552edbcbabe7e3ec90d2c5c0bdebe9d0c856250b8c5fab14264d77e04bf50abd145c20017127875447a7157069227c4cf935c60c5b68eee3d5c5c202d66633156eed5612b02f735c98e1d6ccde81419441d3a5ea910984c324fe26c5756e01bf56a40f656f5eddf54d516a63394d58c6f030fda35772d32305a4e1111317748c4e6125731641cdfbd62c9be084e2da0d7ac07e8068125c3e09b5bab80fd952d22899cdc3726d28c25e7fe91bc4dbf81e2c98183878efd20502123c58514426d547330dbca0815076f2b498ac3dc8a54c16906c3d16c8b6724e006485707bc3ec02eabca7ac0e88eb9beca41a48864baaf399ac93e6fcc0046513d34c878f6b78aff2fa2a4bf27e0b145a856117cc368119cd7a7996b87c4be4f57173ed2e67d4da304c7b4d8aee88efcd514e464793b207d0441ae83535052f4570d5adad01a2c9420861da9c233431828226818d32fce6e7a502e360a64800cefb74be9bf0b455857b292f7d2cc102dce63b1c47a2f460b00910925648fbb50440ab4ebe2da040da29df4e53ef4daa55b46bcbff10560c64b3735a8258aafd6f43823ebcea305ac8d4bffa64b23ba381cb4ea4de0c537fc9581faf254b911c52a4accd8923fc1015ca660301dfb8e5e5089ab49f5a6e5700eacd7997fba04b6819539401ebe97218924deb296d016d8b52222b24828f82d248ae2d24dee3e906ae179b901ef42c7db15f106cdfc2600d44ea4dd787481fd478a95eb4b72e466e1f41f6351a918bb95ff880288bdcdd358d46f679eeefdb9004df969cb05089ce3ca9c15fb7ade2447c7e31417b1ef27f277eda7e0b3344eb551722e528842c351b8a3cf635981bc2a340fac74d371ad69fb960a87cc90a8a90f778da91530e7abd222026f4c75080b18a3819ba90a2da84b9cdbafb16e616d675483d47c5036c688ad1ff147f43627773a2ddeee19cc43c220370413c03f0a365c97f27e739da4730bca69d62f77f3eb76e8d2a88e276b5ddea1640242d0dc921e8e624e56dd6f62ba2392b98cf8c83f11f3793c1dcd7489e467e1f66b9e098fa60476776c72833520b7df6ab2940a5bb0b55e73d53c22272e383be4b9c44a63a4ee261e1e49c55a62e64acce8b2d91293aaf2bb9d2df1a5d0a9b713131e7e666c136aad9dd41bb0dc2ca55f1da8837a0de1f785c4d3dd875300cfabb378ed8637af155d032c5cbbefe45e6ab263f15a109a0e03cdea1a6335663774f65863c4a097703323c9c4a8cd7d87d46f95705de82675381105fc90379c3d90c97949ba9bf7d1ed9e613a03266df6dc458ee78a1117b6189578592ea1804ec0b66e8755ad44915ffb09848facdf424a6b17f19d2e2e6303ab4100563785faafe13008fc11db788df9d3322049c07c690fe56ed0785c823cf3b1232b22ac28f27fd72ffee8367e281312059875b20ae6a2f8ea0835f22731af88266e83017d16674715054e056e7038ff87ee00c077fce6156aaa93c1eab57c6fd270a3588c303df75eb0ab1265f6711fc22ae6ef684f349c435d1902e4818552f63d6224559d8c4232664c5bd035162fb4564154f012728f8ede8c05ac3b5dd77a00996859e068faee86455b0cf26aafde39c786104f2f8c57ecc629543e067c9e340f6c6b858e70e269c7b32b7ed4f5d098a533161cb411412dcfb2a9c01591d827aa06202a2afbe05ab8639ff8dbe631fdfe04dacf7ce1a396022218030c64041b9933acd3f31527692ad84394eb57132358a7d26fb8ed48ac7dac8482baa11fcffcf872eaca7c4cc2544cd9d273ba39d04b13f41d28a74f692cc72598f556d425cf7ac5cb25ad2f46a028709bce54fb3139ecd8ac8e5a328ced20adfd98a45d659065c3bacdc2a88939f60f4192ecd28d9436111828053670a4244e82c3e6a9a691c7e5d3ed3d2ce961907951f3098817f5428f0731979ee31babcea5723856e38f7d39a9d6bcf232cdb323cb842331dde7e3354292410c81313716aa1f5b54aee37f99236dadf2c40030d6f112222c7b61b4cb892d11ebf04abe39ef51b27c239974deca95a19779dde410acec724dc80c0970d28e1c55f1f4c6676de2f54a66633578d127e0a5442d72553ccdd10cd29820081b6863720f8fa010559ae7e74bc096379ce802", @generic="4f9922e3f5a5453cf2d4b879b2075eda0a646e4bcce9da5199d3ab8baffdfcaebe2620a17ae5810512c531e3174a5e75042c1cdccfab33b7339bbadd9757446765aea7d0cac4a6260cced39f3b9320e5bb3203f2b618f43abc2991f058041fa6224d6295c97e1e599cae88cbd84662db89c129d919780b197258f64e479cece8891c06a5f92757a307791fbf416786f4b869a03a5793d53573147239f1f1b893962e88c9", @typed={0x8, 0x76, @ipv4=@rand_addr=0x7}, @generic="8f9fb65258cb6077374b1af44f1e0608be78898751592380247e8a206e836772e63065e9d8cd7ca29a4c01b8d11cc02f11ed7484a75d7fcd6b6d82b15cb96b051b3e03a6968c4bcc39c3ba1ee54a6a808c7fd6b2ecad2a2f77964d0fafb3bc1d"]}, 0x2208}, 0x1, 0x0, 0x0, 0x4000}, 0x6) r6 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r6, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, &(0x7f0000002600)=0xbb) ioctl$UFFDIO_REGISTER(r7, 0x80044dff, 0x0) 23:02:47 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(0xffffffffffffffff, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:47 executing program 2: syz_open_dev$sndtimer(&(0x7f0000000340)='/dev/snd/timer\x00', 0x0, 0x0) creat(&(0x7f0000000180)='./bus\x00', 0x0) r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000100)=0x20000020) openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/hwrng\x00', 0x2a000, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88001) sendfile(r1, r2, 0x0, 0x800000000024) r3 = socket$bt_hidp(0x1f, 0x3, 0x6) fcntl$setstatus(r3, 0x4, 0x400) r4 = memfd_create(&(0x7f0000000040)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000480)='Cpuacct.stE\xae\x00', 0x275a, 0x0) r5 = creat(&(0x7f0000000240)='./bus\x00', 0x3da) fallocate(r5, 0x0, 0x0, 0x2000002) read$eventfd(r5, &(0x7f00000003c0), 0x8) fallocate(r4, 0x800000000000002, 0x6, 0x2) r6 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) r7 = socket$inet6(0xa, 0x400000000001, 0x0) r8 = dup(r7) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r7) setsockopt$inet6_tcp_int(r8, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r7, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r7, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_selinux(&(0x7f0000000100)='./bus\x00', &(0x7f0000000140)='security.selinux\x00', &(0x7f0000000200)='system_u:object_r:lvm_control_t:s0\x00', 0x23, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f00000002c0)={0x26b7, {{0xa, 0x4e24, 0x4b, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x16}}, 0x1f000000}}}, 0x88) open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x800fe) getpgid(0xffffffffffffffff) r9 = socket$inet6(0xa, 0x400000000001, 0x0) close(r9) r10 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r10, 0x88001) sendfile(r9, r10, 0x0, 0x800000000024) getsockopt$inet_IP_XFRM_POLICY(r10, 0x0, 0x11, &(0x7f00000005c0)={{{@in6=@ipv4={[], [], @empty}, @in6=@mcast1}}, {{@in6=@ipv4}, 0x0, @in=@empty}}, &(0x7f0000000080)=0xe8) getgid() getpgrp(0x0) stat(&(0x7f00000020c0)='./bus\x00', &(0x7f0000002100)) lstat(&(0x7f0000002180)='./bus\x00', &(0x7f00000021c0)) 23:02:47 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000240)='/dev/vcsa#\x00', 0x3, 0x200) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r2, 0x84, 0x1c, &(0x7f0000000280), &(0x7f00000002c0)=0x257) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x404080) ioctl$VIDIOC_ENUMAUDOUT(r4, 0xc0345642, &(0x7f0000000080)={0x7, "276d6c10464dd7c8bfb48cd9f59847382cdd73580bd12b97dffb5dbd4513f617", 0x2, 0x8d2770acd6086d4f}) r5 = socket$inet_udp(0x2, 0x2, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000400)='/proc/self/net/pfkey\x00', 0x10000, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r6, r7, 0x0, 0x800000000024) r8 = socket$inet6(0xa, 0x400000000001, 0x0) close(r8) r9 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r9, 0x88001) sendfile(r8, r9, 0x0, 0x800000000024) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x2000000000000001) close(r5) syz_open_dev$video4linux(&(0x7f0000000040)='/dev/v4l-subdev#\x00', 0x0, 0x0) r10 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r10, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r10, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) setsockopt$bt_rfcomm_RFCOMM_LM(r10, 0x12, 0x3, &(0x7f0000000200)=0x61, 0x4) setsockopt$bt_BT_RCVMTU(r4, 0x112, 0xd, &(0x7f0000000300)=0x20, 0x2) r11 = dup(r5) syz_kvm_setup_cpu$x86(r11, r3, &(0x7f0000fe7000/0x18000)=nil, 0x0, 0x3b6, 0x0, 0x0, 0x0) r12 = socket$inet6(0xa, 0x400000000001, 0x0) close(r12) r13 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r13, 0x88001) sendfile(r12, r13, 0x0, 0x800000000024) r14 = socket(0x11, 0x800000003, 0x0) r15 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r15, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r15, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) setsockopt$packet_buf(r15, 0x107, 0x1be7a18bf855d22, &(0x7f0000000480)="a200005c7a540c538f1d03f3e28f12ddb9e9231b5d673b6f65ad4e664bef316f574899d93b2726b5975a00"/55, 0xffffffffffffff1a) bind(r14, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r14, 0x84, 0x10, &(0x7f0000000100)=@sack_info={0x0, 0x8000, 0x2}, &(0x7f0000000140)=0xc) r17 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0x0, 0x0) ioctl$VIDIOC_SUBDEV_G_FMT(r17, 0xc0585604, &(0x7f0000000380)={0x1, 0x0, {0x4, 0x1800, 0x300f, 0x0, 0x8, 0x4, 0x2, 0x7}}) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r13, 0x84, 0x10, &(0x7f0000000180)=@sack_info={r16, 0x6, 0x7}, &(0x7f00000001c0)=0xc) 23:02:48 executing program 5 (fault-call:21 fault-nth:2): memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 365.233940] FAULT_INJECTION: forcing a failure. [ 365.233940] name failslab, interval 1, probability 0, space 0, times 0 [ 365.245742] CPU: 0 PID: 16955 Comm: syz-executor.5 Not tainted 4.14.146 #0 [ 365.252791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 365.262163] Call Trace: [ 365.264915] dump_stack+0x138/0x197 [ 365.268703] should_fail.cold+0x10f/0x159 [ 365.272870] should_failslab+0xdb/0x130 [ 365.272885] kmem_cache_alloc_trace+0x2e9/0x790 23:02:48 executing program 4: r0 = open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet6(0xa, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000003c0)={0xffffffffffffffff, r0, 0x0, 0x13, &(0x7f0000000380)='@^wlan0vboxnet0&[%\x00', 0xffffffffffffffff}, 0x30) ptrace$setopts(0xa50c, r3, 0x7, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) write(r5, &(0x7f0000000340), 0x41395527) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x10000048, 0xb) sched_setattr(0x0, &(0x7f0000000540)={0x30, 0x2, 0x1, 0x2, 0x3, 0x0, 0x20000000000000}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r6 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x7fffffff, 0x0) r7 = syz_open_dev$usb(&(0x7f0000000440)='/dev/bus/usb/00#/00#\x00', 0x3, 0x8000) getsockopt$inet6_mtu(r7, 0x29, 0x17, &(0x7f0000000480), &(0x7f00000004c0)=0x4) ioctl$KVM_GET_VCPU_EVENTS(r6, 0x8040ae9f, &(0x7f0000000100)) r8 = dup(0xffffffffffffffff) r9 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r8, 0xab07, 0x0) r10 = socket$inet6(0xa, 0x400000000001, 0x0) close(r10) r11 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r11, 0x88001) sendfile(r10, r11, 0x0, 0x800000000024) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r10, 0x84, 0xc, &(0x7f0000000500)=0x3, 0x4) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r5, 0x4008ae48, &(0x7f0000000400)=0x10000) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f00000001c0)={0x291, 0x7e465c50}, 0xc) geteuid() fchownat(r9, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) [ 365.281535] snd_mixer_oss_get_volume1_sw.isra.0+0x96/0x320 [ 365.281553] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 365.281563] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 365.281577] ? snd_mixer_oss_ioctl1+0x547/0x1590 [ 365.281588] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 365.281600] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 365.313496] ? snd_mixer_oss_proc_read+0x250/0x250 [ 365.318450] ? save_trace+0x290/0x290 [ 365.322285] ? __might_sleep+0x93/0xb0 [ 365.326189] ? __fget+0x210/0x370 [ 365.329671] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 365.334706] snd_mixer_oss_ioctl+0x47/0x60 [ 365.338965] do_vfs_ioctl+0x7ae/0x1060 [ 365.343143] ? selinux_file_mprotect+0x5d0/0x5d0 [ 365.343155] ? lock_downgrade+0x6e0/0x6e0 [ 365.343166] ? ioctl_preallocate+0x1c0/0x1c0 [ 365.343178] ? __fget+0x237/0x370 [ 365.352322] ? security_file_ioctl+0x89/0xb0 [ 365.352338] SyS_ioctl+0x8f/0xc0 [ 365.352347] ? do_vfs_ioctl+0x1060/0x1060 [ 365.352359] do_syscall_64+0x1e8/0x640 [ 365.352367] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 365.352384] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 365.352395] RIP: 0033:0x459a29 [ 365.390398] RSP: 002b:00007feb90741c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 365.390408] RAX: ffffffffffffffda RBX: 00007feb90741c90 RCX: 0000000000459a29 23:02:48 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xedX#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') openat$cgroup_ro(r0, &(0x7f0000000480)='mem\x00\x01y7SwaS.\x06ur\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\xfb\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:48 executing program 3: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) r2 = dup(r0) bind$inet6(r2, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback, 0x5}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f000000a400)=[{{0x0, 0x0, &(0x7f0000003480)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000003300)=""/222, 0xde}], 0x6}}], 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SET_FP_MODE(0x2d, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) fsetxattr$security_smack_transmute(r4, 0x0, 0x0, 0x100c2, 0x4) lseek(0xffffffffffffffff, 0x0, 0x0) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) ioctl$sock_inet_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) keyctl$clear(0x7, 0x0) prctl$PR_GET_NO_NEW_PRIVS(0x27) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) r6 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r6, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r6, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r7 = socket$inet6(0xa, 0x400000000001, 0x0) close(r7) r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r8, 0x88001) sendfile(r7, r8, 0x0, 0x800000000024) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r9 = socket$inet6(0xa, 0x400000000001, 0x0) close(r9) r10 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r10, 0x88001) sendfile(r9, r10, 0x0, 0x800000000024) ioctl$sock_inet6_udp_SIOCINQ(r10, 0x541b, 0x0) ftruncate(r5, 0x80003) init_module(&(0x7f0000000b00)=',-\x00', 0xffeec, &(0x7f0000000880)='\x00\x04\xbejhy\xbc\xa3\x8f:\xce\x1fS*4\x02O\xf8\xb1\x9d#\xf8\xe1\xf9\xa9G\xca\xf7\x1c\x00R~c~\xf9&\x1e\xde\xc2)i\x86\xc9\x04\x01\xcd\x92|\xad\xad.\xb3{Z\xf3\x93\xd1\xe2\fL\xcf\xce\x80\x11\x9f\x80f\xdc\xe34\x98>@\xf0\x82\xc7\bp0\x16\xa5\xb0/\x8dA\x01*\x9f}\xbeBjJ\xfa\xff\xbd\xbc\x92\x86\xbeXi\x1e\x83\x8f\xee\x8e\x03\xc2\xcb\x0e\xdc\xcb\xd4\xe4)=\x0e\xda\bF\x83\'\x05IgJ\xf3Z\xaf\xf4Z5i\xa8\tM\x82\xaf\xba\x15\xf1\x8b=`\x85\"\xa7G\x9am(\x8cF\x8b\xce?\x93mX\xcd\xac\xdb(\xbe\x9a4\x8a\xe8Fv\x7fU\x17B\x9c,\x7f\'\xafr;1\xb8_q7\x9f\fux\x1d\x84\x05eR0\x7f\x18=-#\x8f\xb7;7S\x13\xe7\f\x1a\x1c\xfb\xb1Q!F\x0f]#\xb3\x97\xea\xdc\xf6\"_\x1b]D\f\xc4\xf5\x89\xdarr\xf1E\xf3\xb8\x84\xf67\xfa\xa5\x81R\x1e\xab\xac$&`9\x83o\x8b\xc5\xfd\xd9U\n#\xa3\xdb\xf3\vuh\xed\x17\xbe\xe2\xfa\x117\xd0y\x9d\xa1E\a\xff|\xb7D\xc8\xf9\xd4Nw\xc8\x8e\xd2s\v\xdb\x1d\x1a\x01#N\xab\xe0*\xb4\xad\x84\x93\xdc\x1c\'\x9c\x0f\xd2\x88=\xcf~\x1d\x14/WX\xc5\x17Pr\x19\xc7\xcd\xd6\xee9\xb4(\x8b\xd8\aB\xa5\xe9IE\x9e\xc8\xea\xe1\xc9\x1e\x9bq\xb5\xef\x11T\r@\xd8d\xa8\x8e\xe1\xd8\x1eS\x893W+\xfe\xf9j&F \x9eJ\xd7J\xaa\xd04\x8f6\xdc?t\xe7\x00\xd8.\x9d\x8cD\xfc\x7f\xab\x84!\xfd\x18h\x7f\f\xc3Orb^|\xab\t\x1fqN\x99z\xd4\xc9\xc2\xd4F{\x84?U\xf0\x06T\x1d\x8at_\xc8\xf9YBl\'\xb7\xf2\xc25\x19\xc2&W[\x0f+n~\xa8\x9b^i\xb7\x8d\xc3be\x84\xba\xa6\xda\xf0;\xe9\f\xbeS\x89\xa9\\_\rU\"\x936\xd7d\xa8\xeb\x82\x8e\xc5\xae\xc5F\t\xb7\x17\xe6*p+\xe5\xb1\xb20\xff\x18\xb7\'\xca19\xfdy=iuY\x03g.\x9a\x8dxFnQ\x94b\xd4\xf1i\x9al:M\xdb\xfdg`tX\xf9\x1e\x00\xc2\x10B\x8d\xe8\x85\x8d\xec\xfb\xa9\xd3\xa8\xe0\xac\xe7\xe7!\x00#;\x04 =u.;\x86\xe2\xf3\x8dh\xc0\x06\xe2\x1c\x9d\xff\xef\xae\x1603\xd0jB\xear\x93\xe3\xa5\xb1\xcf') getresgid(&(0x7f0000000300), 0x0, 0x0) getgroups(0x0, 0x0) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, 0x0) sendfile(r0, r5, 0x0, 0x8000fffffffe) recvmmsg(r1, &(0x7f0000003440)=[{{&(0x7f0000001840)=@ax25, 0x80, &(0x7f0000001d80), 0x0, &(0x7f0000001e40)=""/169, 0xa9}}], 0x1, 0x2000, &(0x7f0000003500)={0x77359400}) 23:02:48 executing program 2: dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000140)={0x0, 0x0, 0x0, 0xffffffff}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180)='/dev/uinput\x00', 0x0, 0x0) r0 = semget$private(0x0, 0x0, 0x2) semctl$GETPID(r0, 0x4, 0xb, 0x0) socket$tipc(0x1e, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) setsockopt$inet6_udp_encap(r3, 0x11, 0x64, &(0x7f0000000080)=0x34fa8b2f303125e1, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, &(0x7f0000000440)=0x7) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) sendto$inet(r1, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='veth1\x00\x00\x00\x00\xff\xff\xff\xff\xff\xef\x00', 0x10) r4 = dup2(r1, r1) write$UHID_GET_REPORT_REPLY(r4, &(0x7f0000000240)={0xa, 0x0, 0x3d, 0x2}, 0x114) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f00000001c0)=0x2, 0x4) setsockopt$packet_tx_ring(r5, 0x107, 0x5, &(0x7f0000000000)=@req3={0x10000, 0x100000001, 0x10000, 0x1, 0x0, 0x0, 0x1}, 0x1c) ioctl$sock_SIOCGIFCONF(r5, 0x8912, &(0x7f0000000100)=@buf={0x4a, &(0x7f00000002c0)="d3af2443bbc0586250b24bb92f596c8bbd6984ca6b250bfa2ff5b1965dba566a60eff7292a92131f5edd2d310ef35d7aa0210e5664ffb468c59411bc1ca3fd416ee91e39e6315e94a024"}) sendto$inet(r1, &(0x7f0000000000), 0xfffffdef, 0xc0, 0x0, 0x142800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000d9000/0x600000)=nil, 0x600000, 0x8) 23:02:48 executing program 5 (fault-call:21 fault-nth:3): memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 366.036862] audit: type=1400 audit(1569884569.010:83): avc: denied { module_load } for pid=16979 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=system permissive=1 [ 366.119061] FAULT_INJECTION: forcing a failure. [ 366.119061] name failslab, interval 1, probability 0, space 0, times 0 [ 366.130640] CPU: 1 PID: 16994 Comm: syz-executor.5 Not tainted 4.14.146 #0 [ 366.137861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 366.147351] Call Trace: [ 366.150071] dump_stack+0x138/0x197 [ 366.153730] should_fail.cold+0x10f/0x159 [ 366.158058] should_failslab+0xdb/0x130 [ 366.162159] kmem_cache_alloc_trace+0x2e9/0x790 [ 366.166993] snd_mixer_oss_get_volume1_sw.isra.0+0xce/0x320 [ 366.172740] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 366.177864] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 366.183633] ? avc_ss_reset+0x110/0x110 [ 366.187635] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 366.192473] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 366.198278] ? snd_mixer_oss_proc_read+0x250/0x250 [ 366.203354] ? rcu_read_unlock_special+0x639/0xd40 [ 366.208465] ? __might_sleep+0x93/0xb0 [ 366.212362] ? __fget+0x210/0x370 23:02:49 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/attr/current\x00', 0x2, 0x0) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x40000, 0x0) r5 = openat(0xffffffffffffff9c, 0x0, 0x541100, 0x16cf05d53bfcb034) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) [ 366.215852] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 366.221020] snd_mixer_oss_ioctl+0x47/0x60 [ 366.221034] do_vfs_ioctl+0x7ae/0x1060 [ 366.221045] ? selinux_file_mprotect+0x5d0/0x5d0 [ 366.221054] ? lock_downgrade+0x6e0/0x6e0 [ 366.221064] ? ioctl_preallocate+0x1c0/0x1c0 [ 366.221075] ? __fget+0x237/0x370 [ 366.221088] ? security_file_ioctl+0x89/0xb0 [ 366.221098] SyS_ioctl+0x8f/0xc0 [ 366.221106] ? do_vfs_ioctl+0x1060/0x1060 [ 366.221118] do_syscall_64+0x1e8/0x640 [ 366.221125] ? trace_hardirqs_off_thunk+0x1a/0x1c 23:02:49 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xedX#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') openat$cgroup_ro(r0, &(0x7f0000000480)='mem\x00\x01y7SwaS.\x06ur\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\xfb\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:49 executing program 3: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xd7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x88001) sendfile(r0, r1, 0x0, 0x800000000024) ioctl(r1, 0x0, &(0x7f0000000100)="d930ec8e44f137eb41ef6dbf009ef8e47dcd6d2296d0c7bbf1d315c00b971f0ef4c14860b485a85df96ae28b6df820c1ad5267079da4e6ceb242bb0609c44e4290a84c7ce50dc9d4da7e16fbd85445e2856ea6343a777f5e8e8f7add069e185f7da141cf1649384c001e272cc17ef9707995e868e3d15e150d5bf701a00876d7073cded03e7dae5d7073de1b14e7cfbfd662971f93f1b89507c34fc7256c0b") r2 = socket$netlink(0x10, 0x3, 0xa) connect$netlink(r2, &(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x14800008}, 0xc) r3 = open(&(0x7f00000000c0)='./bus\x00', 0x800000141042, 0x0) ftruncate(r3, 0x200004) sendfile(r2, r3, 0x0, 0x8000fffffffe) 23:02:49 executing program 5 (fault-call:21 fault-nth:4): memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 366.779972] audit: type=1400 audit(1569884569.750:84): avc: denied { create } for pid=17013 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 [ 366.981249] audit: type=1400 audit(1569884569.780:85): avc: denied { connect } for pid=17013 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 [ 367.074116] FAULT_INJECTION: forcing a failure. [ 367.074116] name failslab, interval 1, probability 0, space 0, times 0 [ 367.084719] audit: type=1400 audit(1569884569.780:86): avc: denied { write } for pid=17013 comm="syz-executor.3" path="socket:[60254]" dev="sockfs" ino=60254 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 [ 367.085593] CPU: 0 PID: 17024 Comm: syz-executor.5 Not tainted 4.14.146 #0 [ 367.120908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 367.130413] Call Trace: [ 367.133036] dump_stack+0x138/0x197 [ 367.136704] should_fail.cold+0x10f/0x159 [ 367.140887] should_failslab+0xdb/0x130 [ 367.144885] kmem_cache_alloc_trace+0x2e9/0x790 [ 367.149906] snd_mixer_oss_get_volume1_sw.isra.0+0x96/0x320 [ 367.155697] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 367.160805] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 367.166437] ? avc_ss_reset+0x110/0x110 [ 367.170412] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 367.175079] ? lock_downgrade+0x6e0/0x6e0 [ 367.179307] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 367.184977] ? snd_mixer_oss_proc_read+0x250/0x250 [ 367.189954] ? perf_trace_lock+0x109/0x500 [ 367.194193] ? check_preemption_disabled+0x3c/0x250 [ 367.199207] ? perf_trace_lock+0x109/0x500 [ 367.203529] ? __might_sleep+0x93/0xb0 [ 367.207410] ? __fget+0x210/0x370 [ 367.210863] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 367.215911] snd_mixer_oss_ioctl+0x47/0x60 [ 367.220151] do_vfs_ioctl+0x7ae/0x1060 [ 367.224035] ? selinux_file_mprotect+0x5d0/0x5d0 [ 367.228806] ? lock_downgrade+0x6e0/0x6e0 [ 367.232951] ? ioctl_preallocate+0x1c0/0x1c0 [ 367.237356] ? __fget+0x237/0x370 [ 367.240898] ? security_file_ioctl+0x89/0xb0 [ 367.245342] SyS_ioctl+0x8f/0xc0 [ 367.248704] ? do_vfs_ioctl+0x1060/0x1060 [ 367.252852] do_syscall_64+0x1e8/0x640 [ 367.256820] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 367.261702] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 367.266886] RIP: 0033:0x459a29 [ 367.270068] RSP: 002b:00007feb90741c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 367.277770] RAX: ffffffffffffffda RBX: 00007feb90741c90 RCX: 0000000000459a29 [ 367.285033] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000007 [ 367.292303] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 367.299570] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feb907426d4 [ 367.306849] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000008 23:02:50 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) sched_rr_get_interval(r5, &(0x7f00000001c0)) r6 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r6, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r7, 0x80044dff, 0x0) 23:02:50 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:50 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c000100766574680000000018000200fd00010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="2c0000001600010000000000000000000a000000", @ANYRES32=r3, @ANYBLOB="08001800ff010000000000000000000000000001d1fbf49d05af54d2eeb723ed8f3dad89f62b9154"], 0x2c}}, 0x0) 23:02:50 executing program 2: dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000140)={0x0, 0x0, 0x0, 0xffffffff}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000180)='/dev/uinput\x00', 0x0, 0x0) r0 = semget$private(0x0, 0x0, 0x2) semctl$GETPID(r0, 0x4, 0xb, 0x0) socket$tipc(0x1e, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) sendfile(r2, r3, 0x0, 0x800000000024) setsockopt$inet6_udp_encap(r3, 0x11, 0x64, &(0x7f0000000080)=0x34fa8b2f303125e1, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, &(0x7f0000000440)=0x7) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) sendto$inet(r1, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='veth1\x00\x00\x00\x00\xff\xff\xff\xff\xff\xef\x00', 0x10) r4 = dup2(r1, r1) write$UHID_GET_REPORT_REPLY(r4, &(0x7f0000000240)={0xa, 0x0, 0x3d, 0x2}, 0x114) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f00000001c0)=0x2, 0x4) setsockopt$packet_tx_ring(r5, 0x107, 0x5, &(0x7f0000000000)=@req3={0x10000, 0x100000001, 0x10000, 0x1, 0x0, 0x0, 0x1}, 0x1c) ioctl$sock_SIOCGIFCONF(r5, 0x8912, &(0x7f0000000100)=@buf={0x4a, &(0x7f00000002c0)="d3af2443bbc0586250b24bb92f596c8bbd6984ca6b250bfa2ff5b1965dba566a60eff7292a92131f5edd2d310ef35d7aa0210e5664ffb468c59411bc1ca3fd416ee91e39e6315e94a024"}) sendto$inet(r1, &(0x7f0000000000), 0xfffffdef, 0xc0, 0x0, 0x142800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000d9000/0x600000)=nil, 0x600000, 0x8) [ 367.610385] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. 23:02:50 executing program 3: memfd_create(&(0x7f0000000880)='\b\xe1m1#+\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x2, 0x10000) sendmsg$rds(r4, &(0x7f0000000c80)={&(0x7f0000000140)={0x2, 0x4e22, @rand_addr=0x9783}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000200)=""/66, 0x42}, {&(0x7f0000000440)=""/76, 0x4c}, {&(0x7f00000002c0)=""/39, 0x27}], 0x3, &(0x7f00000009c0)=[@cswp={0x58, 0x114, 0x7, {{0x1, 0x7}, &(0x7f00000004c0)=0x7da, &(0x7f0000000500)=0x2, 0xffffffffffffff00, 0x8a, 0xcc, 0x0, 0x36, 0x400}}, @mask_fadd={0x58, 0x114, 0x8, {{0x10, 0x8}, &(0x7f0000000540)=0x2, &(0x7f0000000580)=0x2, 0x3ff, 0x400, 0x4, 0xffffffff00000001, 0x2, 0xf7}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f00000005c0)=""/230, 0xe6}, &(0x7f00000006c0)}}, @mask_cswp={0x58, 0x114, 0x9, {{0x3, 0x9}, &(0x7f0000000700)=0x5, &(0x7f0000000740)=0x8, 0x7, 0x7, 0xfffffffffffff612, 0x4, 0x14, 0x5}}, @mask_cswp={0x58, 0x114, 0x9, {{0xfff, 0x8}, &(0x7f0000000780)=0x200, &(0x7f00000007c0)=0x7fff, 0x9, 0x3b, 0x99, 0x2, 0xa0, 0x401}}, @fadd={0x58, 0x114, 0x6, {{0x100, 0x6}, &(0x7f0000000800)=0x692, &(0x7f0000000840), 0x400, 0x5, 0xfffffffffffffff8, 0x7, 0x20, 0x8}}, @cswp={0x58, 0x114, 0x7, {{0xfff}, &(0x7f00000008c0)=0x9, &(0x7f0000000900), 0xa7, 0x7f, 0x6, 0x7f000, 0x2, 0x7}}, @fadd={0x58, 0x114, 0x6, {{0x3, 0xe2ed}, &(0x7f0000000940)=0x9, &(0x7f0000000980)=0x4, 0x3, 0x9, 0x960, 0x3, 0x42, 0x37}}], 0x298, 0x2000081c}, 0x5ebb5615e78ec756) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) dup(0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f00000001c0), 0xc, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x40) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fchownat(0xffffffffffffffff, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) unlink(&(0x7f0000000040)='./file0\x00') setsockopt$rose(0xffffffffffffffff, 0x104, 0x2, &(0x7f0000000080), 0x4) [ 367.727554] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 23:02:50 executing program 5 (fault-call:21 fault-nth:5): memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 367.769794] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 367.840120] protocol 88fb is buggy, dev hsr_slave_0 [ 367.845484] protocol 88fb is buggy, dev hsr_slave_1 [ 367.850884] protocol 88fb is buggy, dev hsr_slave_0 [ 367.856107] protocol 88fb is buggy, dev hsr_slave_1 23:02:50 executing program 1: r0 = gettid() r1 = creat(&(0x7f0000000100)='./file0\x00', 0x10003) write$binfmt_script(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="03f3ffff24fa4a185801"], 0x1) prctl$PR_SET_PTRACER(0x59616d61, r0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x82000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = dup(0xffffffffffffffff) bind$netlink(r2, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbff, 0x8}, 0xc) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r3, 0x1000008912, &(0x7f0000000180)) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x442f) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000004c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000140)={0xffffffffffffffff}, 0xfd0d1988ddf1162c, 0x1e6012b5599ea9a}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r5, &(0x7f0000000640)={0x14, 0x88, 0xfa00, {r6, 0x10, 0x0, @in={0x2, 0x4e21, @rand_addr=0xfffff81b}}}, 0x90) syz_read_part_table(0x1, 0x8, &(0x7f0000001740)=[{&(0x7f00000001c0)="faca56071c42838ffe362f215cc223a07f058bffb4f1ded3495003e68f6ece17d8c3b1fd07d76b7861de6cb4a136301406845404084529cf8204d82515ac6cca7d0d8f525651a10df6d41db5a85dec620dd7b055cc42efa6b52901fcfbd9909634f4dd582117738c8d53179105919e9ecefe082467736a80496af412064db379c7f0df5b70162fdb701ed7dbefa89bf76265dd669b8894b1ee3d83b5368a89496fdf687a86c599ea74ba3a7c0b526f5b9e198cedef61a6314c0f965f88b0201084c4eb6039263861fe0f578be3b6b80712211a97b40cac8dbc4e011f3947ccfaca8d44708fc14277cf4dbd349c34186b453f80487f5758d1cd47", 0xfa, 0x8}, {&(0x7f00000002c0)="7998f8316468d7ae2f4517ef60f11d9de2e8dce124a1e112a04548ab88c562d3ef544e8208922b2862ba774d3bc3d079479dd805350522e12dc00342d268e07d919eb2492ab2edc1a0aa1c61b8ef2ed8611780b36724b481bec758a612494327547efd4b3b7e6d1948b32aa8db768bc8b6acac725ebf0481ac378e7ab1700239a9e7010f69219aa4d5", 0x89, 0x5}, {&(0x7f0000000380)="8622784ca7527ceeaacd064c45b7917923258dd7c89ae458ce6e9f4ce33aebce84310b446dc99ce13592c11ca2e1e6c7593d0dc36c7c80cc0df5557b19f0e9f3f83bdf59ae691a179a6e9938bc0a65136bc88d28a6d27a7c7619b27b0a7faabbf9b3f07da984766822465b5a1e9d", 0x6e}, {&(0x7f0000000400)="38ac4371347c6509f5d8ef3625f27b19717533075ccd491b92b05b040ab44dbfd1c8438a55ffbbaf02c134cee4f254325c6519df86a8068ae94cc6a4d9f18f2a8b56aa8bc4c18fc72f8c0aac3def0b7265b29b69e8702f99b3e9f92e6933c336f722eab0e0231acab3c848b25432ef290fc8bd1c2e429976f24e4f7ab3b383ded620", 0x82, 0x3f}, {&(0x7f0000000580)="8dadf0463839a39f7cfa88fa04e381d4fed979c9eeb549510b5f756338a7c5692a79f2d0c76f4f0e5aca6978dc7a6fe0abdd5223b8f956f0f8c69752ba41b0e5cf7ea4812eedc6ebc120fba22f92b8d9d254acf5888ad939ee765d42d4b46dcbf1d26415bd57c0b8002b4f3c0454ef8923733ab51694f831a39e52adca7a3c49df01142908b4", 0x86, 0xf20b}, {&(0x7f0000001940)="975e19b47a6f858b923f840223a4d2759cbec1fa4c8d1745a98e4788aacd4f783f73b496aa2cb3d71422dd1ef62e8c47ec5949e8fc599e004542630df8b905a3a56e53734a13e2e180d8d020b650cce10a4b5764180ac230f88cabe02c86b89d00d63b8155372a78947c7e5c476b96ec52b9e98900b84da3f2a3ab2d8b43082440f61af826fa4349985c40e933bce3ec7f8ce1eea2360818630688ad7bce19e728c52d4e348897c1847245ee6843258c5750b0e2bc7b0328864049c2bd7a5accd08e0ea2c8929b5e0fb815a6f6013efc4ba0544804788306f507c549fe4f07f6630aed885156f7f1bf48b6bb0000008000000000da6fd45528db47010a504259e3bc0c6e2e233ebfabf0aaf51d9b2df6f7c810888fa170f3d138d9657d8f3e76089f2c66a5a58dbaaffa57c24aa8476738b3669302d78f1cfc083fc17c589ef730937f61f63c47cd7d12d82f78be7f125a5bfb1f0f73d9d08c91d5754a", 0x15d, 0x3}, {&(0x7f0000001800)="a92cafa2b08e269f783276f02374ba2fb7a77eb3752dc364baf58fb1419586edc481a6898092b2304dd61e6f0d73d8baf00d82cf9209f324cbfc8e6837109a03c4649374c90431f72599c73266c60368bc1d380d134efa326f407b4e4942b00f4edc81943fcbd37caa4c59e5e8ef2b952087c4e97d1b3eaecaf362d01154a4b4a761465faa74e9a9839093bf75c113c8ea74122be0be6ca087e011cbed12bc7c3c77d5c2241a9c20b6856607254ad355462173f11c0008f70009353c232db0aca5d375dc14f07f7c455fe6a91a63cb4ffb7189f162bffab4f4983865eb9c99de11fbb117c6c93ea347c6cfffbdf88ced8bc3723b63cd4231461c7ca7796060a0339c1261006fb03033d87ba9fe58d000188a45384f95b21724215e0f8321c455addabd2d73991fda", 0xffffffffffffff6d, 0x4}, {&(0x7f0000000740)="941730b43baea161559c8f550998e76e17b0219a0667a80e106fdee2e474e0aa441265816adbb995f046134b6980abc1642cb9c8f5f3d32dea4c1f42c3d9108de7e83c7ed13b76c4816d1a17ef3c17f2a4c6041de9383db7bed940db2e87039f6964014beb0e3a440808bc17c74746680e96e70abcf928cbff1875158e09915683e37c59fb49becf580ae34e709bffb00b59901854ade6d0ce510d5270a1d5a36df35bb775373f9610132a6ef26e6c7542b2aed27c69d648dfc785af78975b08807f50669fb0fc3428e2fe1881bc542dc930813329eeb6bc8a3a3d1ed3b1313fb6ec4ce039bbb7972843c538579005511a9c90aa2f66d382c3878aaed402346e08ad7e33cc1607a287f095575256b645a13ea6783ce57bf0d9951044ebb4c49a462cd3feb9fc953456fdc927cae0ce7eab8955c88e6394bf3995b567bfb3948ea2e40489e8ab449f0ff59777a6dce3d3bddf74e75efdc22f62814455994473416b3842827930a4d3a410922a652f4050435c08ac787652426849fed610ed4289b1a7f228f3f0b50bb77ea457033140996ee7ea05077718d8b780cf109da52496728fccd507bdf00b5d26a2be342c1dd9cbf434a47a32b19a62e1a23910bb0008d3516ac379736a15452b68daf77d10df0f7642f36006de8d25a68c2bc8246de35469a8b3aa1a112b77b9f2e59d87265e021aa7426feafc4c1d150846dee11197034aea67c89e73475b7d779731a4943e612d787ac2344e183d8ab5faebc71fbb7698643f3f6f4c41f342522d7cf9c71395789b14790845d8e5654ba5a85f2099522733a222744c84eacfb63d2ca831afcc51aff8ecb9bd9976a54ea1a0d43878ebee94b095ff5e18ccf2d74eed80b28bf28cd349e9223fb44382f3769e45da8463a8dd7388320b42897c956857bcaea6b66b70e71bc71da058d7c0673013be2782aa65bb407d3c9946d197be4cb497c85d76adb50d4474aee49d02d04637cc863ecc3f1fb3b476baa21ef9698056240f9ebb5c27bda23f6a2dbb40f7e389d394c38bcf3d3d1fd6379708f5fdc6c7d4783de581fd6190ebe07c840b6287732a93525ed11d79af800d604883fbb54a565349b11d66d09ee7530ee02df02f8dac15bdb293182bbe6876fb3ba337b740f5e9ecf7cc8e2df62bd67b316125dfad387d00e158d5cf30a06e1cab9da335aeb13a36e2d16308f6f6100b747e8b3f61163a5c4a847c0ff45c458a0cfda0f85719d9b79166d19611f038addc36c302b21bf9b8c68a8d457f5795b10ca9be566dc4850db9716bd71df145d83ee4541ceb4a518bbaf5589360662c96ef4e674413e77c07f692c3b903ad9e1b8a273002c0f602019ff827e6b11819bf77c767ff86880fe24779b89606f7df03a1f50956c3e0d5b791e34f1773adf7e8d11243282422427bae90d6b455f78db7671892a2eb5e460809ba88bb519c48061f433f8ea44cf68887034c502b49e3ef028194b7b6532aa5b47597da3bb32c7e77ba256d3f6cbb8bffa6f41f0a4b8e1d87666c5b2424495294ab76a83f21a38f6d17fead050c3b98a824c8c0cb7dbd8424f27c844746b484204a9a027c3d518d830baf2fd39f7867d5c547b05d0c99cf3f06e86818128f711bd1a541e252e47aff0ab3bcc9c6b07154da03958b573dfafdb2521e770616ac415b94df23a1db148e7b11fd4d9a17a33ab3e11251f9ddd2e491ee3c7c8cd36a9ba628c3181b7990f2d814b1b54be98ed4e9e24925665b9bb2ed66add90aecb8c0ba01eaa249805c98094cc5056997402779ff16351406cea9394257e64ba4ece16ad154f0ef3d5e4f26644739b3bbbdb5bfc8cd2fff81e609ef89775b2b8bc2c7a7b700c7e5ec02e86c02ebdbc6f1e501dc323919a5e0e8be6e9eae41d430475b3de313f541e39612842d33309c612ed4920c07931f9e279acf9e71d7995e9a6ac59d7840d9de060720a7c7db9b9065a1871a39eacf4c32bb733b3cdbe95c2bfbeef00519d407d57377bd295d01fe873ea9ff9b6db8ce15db25ea60f546c692ca29a93435f973e898a0e801cfb13cf97ea4638ad633ad4f9219bb721488f76128b6c2d66e9683e9cf858a4555554364d16d3c39b451c956c7b5dac7ccae04af19622e61a0ba1768457144d3725e17a52a2b921edce721bf41ed26381057f55235800c5f7d62aaf61c117d553f63529b7ea524d5018f0ac8867f29243d3cb55bb6dda57ae549bef8ad70ef0f006a0dd23c803dbdf7a7e98df7f2c2c5cbb17d82c951f4a6e7108eb2fa0297c2d1834fded731f1390b82f94baea527189277a46be95c4d5da3db26bd6bda5e42bece21e59db616c8c124c8e1889cd85d1a064144da386156ec174ec3ece0e17ba997755cd1ef0dfa51a7f18f3bdfd2e14da6539332b4523ebd10473c2ddad2ef6c30de6fb692e975b2f37d98da14252f4783365d4419a7e0c827c1305b41498f118cefcd266f671fe20766c3f0b8eda258e5c75f3677ae1f8c98cbc8617a72a38d7c2058891df7bab9deb5141a978fbcda890b5900be0bb5c0b7fbb03a52ea74d327fa300517925e585b348e870b4df9e212ceee42a7683cf17b20fda09b30de7026cb8a449826cae041e471e6141ec919ec23cd8c3e6bdf067704829744b8c82f62f2a5fbc86829baeddf38ec3c597e0e76703149a986e22949e1487112ec61cc4d345a2ab22a7d5d24c12facf452b96d4991e98d54b6ddaead26b14d8b87b3230beb43210d727bfbcdff0d328b8e224fd9ded099b503023c353e04136913037eafd527263ebce55e5b37e20ccb4caa88cbcb4934530a2a4e90fa85b982dc01cad7e9d8e45e5291b014597ca4977e24786eb8eabc177481f3eaddd93aade14aa3566c050936131bd75aaea7ed4bda67ea540fea8132522db32dc64eb502995e6d17838afd6449e1e96d078dc9f6c4fefccb8922e6c7ee00f4dc4403141150a34f26769f5b7fe01d8ebad2e7b37b62fd8d74d5e4ec73fac785f8a929e22be8902831914ef91e5d47c72736456fbd7dc81f24b428250828e68b64e3fc49699298e16111efd66d7e8771341167c89a372a9d82a9eb37cf2c0fc61c1d6f9f9c0452247b1ccd69ca11ad85973b1da310505265a18eb49415b4598c8a80f90fc94e60a69fb8b6018bef0e853580ecaa3b82a57a231abe84739c60c18418a3bd6a0d0a78aab168ff4b1ccc4e1771822191dff6070b1cc31145b53fa8fed8465d851227bcedca8ad9ca12c629e57918b80d8f2ff1f7ea9eba5b75d02b1f96db81c03b4798c9c3c57d6ba8042031c5a163db31e0e2a474c7a3a5441109aa9e63cf1285d58beb99b0914ee6d1085a9f35bb01b4a8881786ad17099e6cb659833361251ef07aaecc5f02e32db4a53b0dc4c172e7c31a338a920c05d41dfec2d771975a3150f01a54b940b8668141c0f36b07976374aaaf5054963eaa6f039131b202f979a851680ced835e9a0d51ab8d0384be651d3e4849a80bd5aa1825891ad2625bd880b557478a7dfd3f6e476bc26c3569475dd617d00260876e1858667df1ff979c4ef3af7e4470aef1f98483b3c5970f247a5409933ebcb529ca7a74c8be0ea9450302f34e3dd183c1b10da70c0bd1eca861019abd643fdccd4efb67e98d82cb100edec61e10dd7741d32b6301a2a7ce6ac3136312f8188895f6941ab77f233fddfcb8cb7c5926f636f426622742fa4d37fd4343d655c706d0dabbe533dae29d4c57fff51d8fe32a2475c66501717f3c8c094489994e925411e1e16c89c3c65ad155db9dbe88f756e7be8b0650a1675c582e1c793c3b802eb95b5d86c3077d583ab39b214fabd3765c382ad578e42d65f6071d274df8617e262006fad5702f6d4f8d4fd09643c7681c713f5bce8a8fdf24f8a56a7f6d92a5e4cbd32a680cd6c80228bee806a66fde0fdf4d69ce468b37c139d09c9ab6149dbeb816a2f353619b6148f570d7fd09ce63ae62b5926cce5ffcaaa591a8e35385dd4d3b8ea01cd5204c4f00ba51bff02feb52837b5494c804708b31f985a3847ad703574406be0db4d8e36ec5cb11433455e40e059dd8100335e408d48f8d9fdb35dff3ffa984c80c75f3eb0eceaf1fd9cdfabf34feebe772cd3e4ee994d8eb59fb50955d418331ba8425d2084e16b93a583112a70dec9ef83bb3f95064622d3b68f069296920b4ec32e419b529ce8a67ffc2b6fdbb7f093101c3cb21cf66b572e31292ad09da0a4c5571b5ea864fdc8e32cc5b13be96e2163069c1d962a2489c861b3417cd66e4c1301412f923bf25f926268bc7966fa3393cadd80e3d9ce51a4e13717e1cd03f04df13a2dd8a1e15aeab0f63a3a67711c6b99f903f19e3d2b3e688377c88f5c8a7dfb101ec1b25e193f424b9fdfad6851c7d2266d0bcb1465e4843b9016d532b6453633bb03ef55275735b860b099dcd312f2ded010388c76cffd059d6c3ac82550638d756126110608c4387ff0a7b70706e778ea8730e8ced27c861a9c281b7f881ac046df9714f2d2c26b39600e8519c7e9788e400679f4f31ec4cc926302b7bf4f37f75a98a5964308e53906c636eecea7628f00bf1d55a41baa8e9d79e1d558800b8e8b0b390dae8aa77931e891697559afa4e3818a4ed6f1439e4d685f1b36b0b06806259f92f5a112185b934c23def4c8e4f35a4eedf5584ac4fce13c8deedd7cf27ba1013415378e9ea634936360bfd3af0d5eb9d3bceb10a3814d5e4615308702682e14cee2426e3060617d5ec9f841b8159aecbc55ec74e2109d09e88453c0b6c762c90563e95ad8747f98aed9e2400d6665292112d89fe795e6a392f7a259ec4fe0c572a1b6186ec42920b7effacc9803a65e6eeaec7d1281bdf9bbcbf6f31e067633d783fab44b53d8b862783b3a589117deb2630846bb9550d9c2a80ec5c54f5449cf4333ff2eaa236336160fcc70f0348658e44248efc153470e4e0d584f69f2bcaa25401efa6d5be11ea94d7ea4dc09c0c8c2a7d08b8174f439abc27a24865f252fc1f82bc46d1757d2c67655b6be290956120c33b8aa66e21f5210902b71ebf0ceda10b8168cfd744c9a1b8f99f8d6f83f753e525f2c46d968ba7c1e7c040b17ad0082ac5c8cff6eb15ca15e2d2c9ca7ed20a593eb16cead90601b27e3f417fa8f1ebea8ee491ad0adb361e4a48095b46de69b014c95886fd6a0141018bf47b013d20912da4f17030f2cf0b64b7a7d0c03eb252dd0ee10a39ea300199e4a61cf9db1268c5ccfea1fc19df263fee91aec186bcf8adb20969f0d98bbf63e47f63f35f82b68f7457233ecc586dee60ddbcb19bc48d15b596248c3a993853da7014a9f1d2cb24987885a5de5b6f7ef7042c18f26bb6aab2288db692969845e4be10c939b3de1408a068ecc232450ca2b0044183e86b4be276fdf17220e7db05f53bf4c6f07354a8ee145a0c6b4af90da8f41a4ea849f55806ec2dcdca5aa1a9521e4a6ba1cb79437cdb05eb25a10f20d8e49feae4410f9b4ec0aa5721d195452cc3fad8e42bdef8e62f28c9538f02b3e42f5efd76983a5df85a8bf8b3064505591d9d9957529a78138ebc09673b31d77792b7d0ef2bc94179d6d184fb3f32e699f3bfe5649659e426b7f7d96f4c82f39371e158a3618acf9c9d2a4255eb93b61a2205001c6980f4ab93578efe8c95c936127421e98030edde9052b9f1f632ec6d35e6ccfc4a795848a2a38be762b88e40570258b9a3f33f781342654d8c4fe55b42a5579eb06ce83daeb43a453c225662aa36f9bd1e9769153d936cae8f9a01e74cf975c3da56ee19aa5e516ee7f6de4e", 0x1000, 0x200}]) close(r1) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000500)={0x1, 0x5, 0x4, 0x800, {0x0, 0x7530}, {0x3, 0x1, 0x2, 0x7, 0x7, 0x6, "795280d0"}, 0x3, 0x3, @offset=0x9, 0x4}) ptrace$setopts(0x4206, r0, 0x0, 0x0) mq_getsetattr(r5, &(0x7f0000000700)={0x23f00223, 0x5, 0xfffffffffffffffd, 0x0, 0x400, 0x4, 0x79217119, 0x9}, &(0x7f0000001ac0)) [ 367.920139] protocol 88fb is buggy, dev hsr_slave_0 [ 367.925571] protocol 88fb is buggy, dev hsr_slave_1 [ 368.029056] FAULT_INJECTION: forcing a failure. [ 368.029056] name failslab, interval 1, probability 0, space 0, times 0 [ 368.040586] CPU: 0 PID: 17067 Comm: syz-executor.5 Not tainted 4.14.146 #0 [ 368.047622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 368.057119] Call Trace: [ 368.059734] dump_stack+0x138/0x197 [ 368.063395] should_fail.cold+0x10f/0x159 [ 368.067559] should_failslab+0xdb/0x130 [ 368.071657] kmem_cache_alloc_trace+0x2e9/0x790 [ 368.076361] snd_mixer_oss_get_volume1_sw.isra.0+0xce/0x320 [ 368.082100] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 368.087223] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 368.092871] ? avc_ss_reset+0x110/0x110 [ 368.096980] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 368.101665] ? lock_downgrade+0x6e0/0x6e0 [ 368.106047] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 368.111692] ? snd_mixer_oss_proc_read+0x250/0x250 [ 368.116668] ? __might_sleep+0x93/0xb0 [ 368.120576] ? __fget+0x210/0x370 [ 368.124053] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 368.129240] snd_mixer_oss_ioctl+0x47/0x60 [ 368.133578] do_vfs_ioctl+0x7ae/0x1060 [ 368.137480] ? selinux_file_mprotect+0x5d0/0x5d0 [ 368.142247] ? lock_downgrade+0x6e0/0x6e0 [ 368.146408] ? ioctl_preallocate+0x1c0/0x1c0 [ 368.150985] ? __fget+0x237/0x370 [ 368.154470] ? security_file_ioctl+0x89/0xb0 [ 368.158907] SyS_ioctl+0x8f/0xc0 [ 368.162292] ? do_vfs_ioctl+0x1060/0x1060 [ 368.166457] do_syscall_64+0x1e8/0x640 [ 368.170354] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 368.175225] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 368.180516] RIP: 0033:0x459a29 [ 368.183715] RSP: 002b:00007feb90720c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 368.191875] RAX: ffffffffffffffda RBX: 00007feb90720c90 RCX: 0000000000459a29 [ 368.199139] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000007 [ 368.206407] RBP: 000000000075c1c0 R08: 0000000000000000 R09: 0000000000000000 [ 368.213686] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feb907216d4 [ 368.221166] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000008 23:02:51 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x3, 0x1, 0x3}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f00000003c0)='/\x84f6\xc6\x0f\xc7\xd9\xea', 0x110000, 0x0) ioctl$TUNGETDEVNETNS(r4, 0x54e3, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) close(0xffffffffffffffff) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r5, r5, 0x0, 0x800000000024) ioctl$KVM_SET_GUEST_DEBUG(r5, 0x4048ae9b, &(0x7f00000000c0)={0x10000, 0x0, [0x7, 0x0, 0x401, 0x1, 0x6, 0x5d5, 0x7, 0xffffffffffffff45]}) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x1) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r6 = dup(0xffffffffffffffff) r7 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r6, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r7, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r8 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x200382, 0x0) clock_gettime(0x4, &(0x7f0000000380)) ioctl$UFFDIO_REGISTER(r8, 0x80044dff, 0x0) [ 368.320173] protocol 88fb is buggy, dev hsr_slave_0 [ 368.325414] protocol 88fb is buggy, dev hsr_slave_1 23:02:51 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) 23:02:51 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001340)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="b7f2288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$alg(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@op={0x252, 0x117, 0x3, 0xe32c43a74c104ced}], 0xffffffffffffff89}, 0x0) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)=""/4096, 0x1000}], 0x3}, 0x0) write$vhci(r1, &(0x7f0000000080)=@HCI_VENDOR_PKT, 0x2) 23:02:51 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$hfsplus(&(0x7f0000000100)='hfsplus\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = fcntl$dupfd(r2, 0x0, r2) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000000), 0x8) add_key$keyring(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffc) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) sendmsg$TIPC_NL_NET_GET(r5, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={0x0}}, 0x0) fcntl$setstatus(r2, 0x4, 0x80000000002c00) ioctl$VIDIOC_DV_TIMINGS_CAP(0xffffffffffffffff, 0xc0445624, 0x0) ptrace$peekuser(0x3, 0xffffffffffffffff, 0x2c) 23:02:51 executing program 5 (fault-call:21 fault-nth:6): memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) [ 368.707001] hfsplus: unable to find HFS+ superblock 23:02:51 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) ftruncate(0xffffffffffffffff, 0x88001) sendfile(r4, 0xffffffffffffffff, 0x0, 0x800000000024) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x11, 0xfa00, {0x3, &(0x7f00000001c0)={0xffffffffffffffff}, 0x106, 0x97b29881392076f9}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, &(0x7f0000000240)={0x1, 0x10, 0xfa00, {&(0x7f0000000180), r5}}, 0x18) close(r3) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000340)='/dev/zero\x00', 0xa0480, 0x0) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400)='TIPC\x00') r8 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000580)='/dev/hwrng\x00', 0x800, 0x0) sendmsg$TIPC_CMD_SET_NETID(r8, &(0x7f0000000540)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x24, r7, 0x802, 0x70bd26, 0x5dfdbfc, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0x4}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x26000000}, 0x4040040) ftruncate(r6, 0x88001) sendfile(r3, r6, 0x0, 0x800000000024) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000000)=0xa) ioctl$sock_proto_private(r1, 0x89e9, &(0x7f0000000280)="4f7f94b1c1667bae3e347ac515942a838a9cc7abb0e2804c23d80dac6a5b1999e6f301a3156505ca69e2fd1b56cc71bf68396b63d1ed85c0b1bbd7d9c4883bd64d28971b8f1005119de74bde8ddc95c1953fdadb31d5857a8311ed0119f414fc6a1b2bd144b30655cbf32ff80c24028aa304d9f30f56052610de26") write(r2, &(0x7f0000000340), 0x41395527) r9 = socket$inet6(0xa, 0x400000000001, 0x0) close(r9) r10 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r10, 0x88001) sendfile(r9, r10, 0x0, 0x800000000024) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r10, 0x4010ae74, &(0x7f0000000300)={0x800, 0x40, 0x5}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f00000003c0)={0x0, r11+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000), 0x0, 0x0) 23:02:51 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r1, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f0000000280), &(0x7f00000002c0)=0x4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x5103}) ioctl$TUNSETOFFLOAD(r0, 0x400454d4, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0xc06, 0x40000) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={0x0}) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r6, 0x210, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40010}, 0x0) sendmsg$IPVS_CMD_GET_INFO(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x32408}, 0xc, &(0x7f0000000480)={&(0x7f0000000340)={0x114, r6, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x68, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="25492d96659000123e51c8b32a740b7b"}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x10000}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x80}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8001}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_SERVICE={0x10, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x26}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xd613}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x85}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r5, 0xc0105303, &(0x7f0000000240)={0x8d, 0x0, 0xe0}) r7 = socket$inet6(0xa, 0x400000000001, 0x0) close(r7) r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r8, 0x88001) sendfile(r7, r8, 0x0, 0x800000000024) ioctl$EVIOCSCLOCKID(r8, 0x400445a0, &(0x7f0000000500)=0x3) ioctl$DRM_IOCTL_DMA(r2, 0xc0406429, &(0x7f0000000200)={r3, 0x3, &(0x7f00000000c0)=[0x5, 0x401, 0x13], &(0x7f0000000100)=[0x0], 0x40, 0x4, 0x7, &(0x7f0000000180)=[0x3, 0x50d, 0x9, 0x9], &(0x7f00000001c0)=[0x0]}) [ 368.945063] FAULT_INJECTION: forcing a failure. [ 368.945063] name failslab, interval 1, probability 0, space 0, times 0 [ 368.956665] CPU: 0 PID: 17121 Comm: syz-executor.5 Not tainted 4.14.146 #0 [ 368.963709] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 368.973071] Call Trace: [ 368.973092] dump_stack+0x138/0x197 [ 368.973115] should_fail.cold+0x10f/0x159 [ 368.979334] should_failslab+0xdb/0x130 [ 368.987444] kmem_cache_alloc_trace+0x2e9/0x790 [ 368.987467] snd_mixer_oss_get_volume1_sw.isra.0+0x96/0x320 [ 368.998013] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 369.003354] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 369.003369] ? avc_ss_reset+0x110/0x110 [ 369.013168] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 369.017949] ? lock_downgrade+0x6e0/0x6e0 [ 369.017964] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 369.027723] ? snd_mixer_oss_proc_read+0x250/0x250 [ 369.027750] ? __might_sleep+0x93/0xb0 [ 369.036681] ? __fget+0x210/0x370 [ 369.036699] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 369.045150] snd_mixer_oss_ioctl+0x47/0x60 [ 369.045165] do_vfs_ioctl+0x7ae/0x1060 [ 369.053286] ? selinux_file_mprotect+0x5d0/0x5d0 [ 369.053299] ? lock_downgrade+0x6e0/0x6e0 [ 369.062227] ? ioctl_preallocate+0x1c0/0x1c0 [ 369.062240] ? __fget+0x237/0x370 [ 369.070223] ? security_file_ioctl+0x89/0xb0 [ 369.070238] SyS_ioctl+0x8f/0xc0 [ 369.070246] ? do_vfs_ioctl+0x1060/0x1060 [ 369.070263] do_syscall_64+0x1e8/0x640 [ 369.078037] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 369.078057] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 369.096297] RIP: 0033:0x459a29 [ 369.099484] RSP: 002b:00007feb90741c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 369.107186] RAX: ffffffffffffffda RBX: 00007feb90741c90 RCX: 0000000000459a29 [ 369.114451] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000007 [ 369.121803] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 369.129068] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feb907426d4 [ 369.136335] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000008 23:02:52 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) 23:02:52 executing program 2: r0 = socket$inet6(0xa, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e21, 0x401, @empty, 0x3}, 0x1c) dup(0xffffffffffffffff) syz_open_dev$loop(&(0x7f00000004c0)='/dev/loop#\x00', 0x0, 0x100082) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="bf16000000000000b7070000010000004870000000000000bc700000000000009500000000000000e994d48069a5e565038e358a51c3473f1fc0dc2719737219d84dcb29ed71191bb5f4b1093120c866cf3fa9dec46066f11897b781ead6ede4ae175c870d707a34d5a5d2652b7e1d70f0d800e7148554e828e61ecfcbbb523af055c83e5e6e63e7e8a5b325c75ab6dcfcdee80331748841c6a414fcffb54affa3c68b08a7d6e12c11fc8d2f2bb852caebcc1436de59e7f1ec1ea7acc961f8d5d08684ad8fa6f9403904afd98e0dde7b6082556d6e28c1d5000000000000000000"], &(0x7f0000000140)='vS\xfdIG|\x8aL[\xf2\'\x9c\xea\xb1\xc0\xb1\x19\x91\x9d/Q\xd9\xe3T\xce\xdax;\x02%\xc5\x1c\xd5GA\xad[(\xbblZ\x01\x1dF\x92#]%sj\xd0i\xc6C\x1f&\xe2\xc5\xa5z\x7f\xe1 \xfb\xc27\x03\x84\x8e\xef\x82-\xfc$$\xaf\v\xbd\x95\x1e\x0f\xbeVI\xec\r!\f\x86\xf5\xfb[Y\x1e\xd4\xdfc\xb1\xc8\xa2\xc1/5\xffr\x1f\x80@\xb8F\xea\xde\x93\xa1\xcb6\xee\xf2\xce\x95\xf2\xfdxR\x17F\xad\xc1~\xa2\x97=O^o\"\xbb\xa8\x9746'}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={r1, 0xc0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000780)={r2}, 0xc) 23:02:52 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) ioctl$KDGETLED(r5, 0x4b31, &(0x7f00000000c0)) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r6 = dup(0xffffffffffffffff) r7 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r6, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r7, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r8 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r8, 0x80044dff, 0x0) 23:02:52 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r1, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f0000000280), &(0x7f00000002c0)=0x4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x5103}) ioctl$TUNSETOFFLOAD(r0, 0x400454d4, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0xc06, 0x40000) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={0x0}) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r6, 0x210, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40010}, 0x0) sendmsg$IPVS_CMD_GET_INFO(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x32408}, 0xc, &(0x7f0000000480)={&(0x7f0000000340)={0x114, r6, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x68, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="25492d96659000123e51c8b32a740b7b"}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x10000}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x80}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8001}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_SERVICE={0x10, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x26}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xd613}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x85}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r5, 0xc0105303, &(0x7f0000000240)={0x8d, 0x0, 0xe0}) r7 = socket$inet6(0xa, 0x400000000001, 0x0) close(r7) r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r8, 0x88001) sendfile(r7, r8, 0x0, 0x800000000024) ioctl$EVIOCSCLOCKID(r8, 0x400445a0, &(0x7f0000000500)=0x3) ioctl$DRM_IOCTL_DMA(r2, 0xc0406429, &(0x7f0000000200)={r3, 0x3, &(0x7f00000000c0)=[0x5, 0x401, 0x13], &(0x7f0000000100)=[0x0], 0x40, 0x4, 0x7, &(0x7f0000000180)=[0x3, 0x50d, 0x9, 0x9], &(0x7f00000001c0)=[0x0]}) 23:02:52 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r1, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r1, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, &(0x7f0000000280), &(0x7f00000002c0)=0x4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x5103}) ioctl$TUNSETOFFLOAD(r0, 0x400454d4, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0xc06, 0x40000) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={0x0}) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r6, 0x210, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40010}, 0x0) sendmsg$IPVS_CMD_GET_INFO(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x32408}, 0xc, &(0x7f0000000480)={&(0x7f0000000340)={0x114, r6, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x68, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="25492d96659000123e51c8b32a740b7b"}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x10000}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x80}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8001}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_SERVICE={0x10, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x26}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xd613}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x85}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r5, 0xc0105303, &(0x7f0000000240)={0x8d, 0x0, 0xe0}) r7 = socket$inet6(0xa, 0x400000000001, 0x0) close(r7) r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r8, 0x88001) sendfile(r7, r8, 0x0, 0x800000000024) ioctl$EVIOCSCLOCKID(r8, 0x400445a0, &(0x7f0000000500)=0x3) ioctl$DRM_IOCTL_DMA(r2, 0xc0406429, &(0x7f0000000200)={r3, 0x3, &(0x7f00000000c0)=[0x5, 0x401, 0x13], &(0x7f0000000100)=[0x0], 0x40, 0x4, 0x7, &(0x7f0000000180)=[0x3, 0x50d, 0x9, 0x9], &(0x7f00000001c0)=[0x0]}) 23:02:52 executing program 5 (fault-call:21 fault-nth:7): memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:52 executing program 3: r0 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x4009}) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) close(0xffffffffffffffff) socket$kcm(0x2, 0x3, 0x2) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8923, &(0x7f0000000040)='nr0\x01:\xf2.\xa3\'>\xf8]\x81$?\xfa\xbf1UM\xbf\xef\xa9\xac\x03x\xf4D3A}?\x00\x8b\x9c[\xdd\x06\xa4%\xf4\x94\xa8>\xb1\xb1\xa2_&') pivot_root(0x0, 0x0) r5 = semget$private(0x0, 0x3, 0x8) semctl$GETNCNT(r5, 0x0, 0xe, &(0x7f0000000080)=""/5) getegid() r6 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r6, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r6, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) preadv(r6, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/7, 0x7}], 0x1, 0x0) r7 = socket$inet6(0xa, 0x400000000001, 0x0) close(r7) r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r8, 0x88001) sendfile(r7, r8, 0x0, 0x800000000024) setsockopt$sock_timeval(r8, 0x1, 0x14, &(0x7f0000000140)={0x77359400}, 0x10) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) move_pages(0x0, 0x1, &(0x7f0000000380)=[&(0x7f0000ffe000/0x1000)=nil], &(0x7f00000003c0)=[0x6, 0x1f], &(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000980)={{{@in=@broadcast, @in=@remote}}, {{@in=@initdev}, 0x0, @in6=@loopback}}, &(0x7f0000000200)=0xe8) ioctl$VHOST_SET_VRING_ENDIAN(r0, 0x4008af13, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000600)='fuse\x00', 0x60088, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) [ 369.825407] FAULT_INJECTION: forcing a failure. [ 369.825407] name failslab, interval 1, probability 0, space 0, times 0 [ 369.836968] CPU: 0 PID: 17170 Comm: syz-executor.5 Not tainted 4.14.146 #0 [ 369.843994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 369.844005] Call Trace: [ 369.856143] dump_stack+0x138/0x197 [ 369.859808] should_fail.cold+0x10f/0x159 [ 369.863988] should_failslab+0xdb/0x130 [ 369.868048] kmem_cache_alloc_trace+0x2e9/0x790 [ 369.872740] snd_mixer_oss_get_volume1_sw.isra.0+0xce/0x320 [ 369.872754] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 369.872765] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 369.872775] ? avc_ss_reset+0x110/0x110 [ 369.872794] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 369.872806] ? lock_downgrade+0x6e0/0x6e0 [ 369.883900] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 369.883912] ? snd_mixer_oss_proc_read+0x250/0x250 [ 369.883936] ? __might_sleep+0x93/0xb0 [ 369.883947] ? __fget+0x210/0x370 [ 369.920918] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 369.925934] snd_mixer_oss_ioctl+0x47/0x60 [ 369.930170] do_vfs_ioctl+0x7ae/0x1060 [ 369.934056] ? selinux_file_mprotect+0x5d0/0x5d0 [ 369.938853] ? lock_downgrade+0x6e0/0x6e0 [ 369.943169] ? ioctl_preallocate+0x1c0/0x1c0 [ 369.947579] ? __fget+0x237/0x370 [ 369.951049] ? security_file_ioctl+0x89/0xb0 [ 369.955459] SyS_ioctl+0x8f/0xc0 [ 369.959031] ? do_vfs_ioctl+0x1060/0x1060 [ 369.963176] do_syscall_64+0x1e8/0x640 [ 369.967071] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 369.971915] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 369.977102] RIP: 0033:0x459a29 [ 369.980286] RSP: 002b:00007feb90741c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 369.988123] RAX: ffffffffffffffda RBX: 00007feb90741c90 RCX: 0000000000459a29 [ 369.995450] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000007 [ 370.002714] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 370.010053] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feb907426d4 [ 370.017319] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000008 23:02:53 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) 23:02:53 executing program 1: mknod(&(0x7f0000000280)='./bus\x00', 0x495f363e84773cdd, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(r1, 0x0, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x88001) r4 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r4, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r4, &(0x7f0000000180)=@generic={0x11, "00000100000000000c0044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f600010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c65400"}, 0x3f) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000600)={0x0, 0x0}, &(0x7f0000000640)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r7, 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000100)='./bus\x00', 0x9e, 0x6, &(0x7f0000000540)=[{&(0x7f00000002c0)="93323c14c4abdecbf94ebe847aecf45a3cbdfb98e42894d012fb57353204677248f79b29caf2ee8fd9f16ae5db04585c18019f43fdbe927697dca672b88ad727a7ff74f15a8ca176492c1724969ac5e899e8f96e44d17a6882042219a5f3ad3a19292a0133052f7e7abdf93d01", 0x6d, 0x3}, {&(0x7f0000000340)="d5853a3a570622aa06f11abffdee5b279665b52da189ec473882798e7c1cb83d397196e08d5e91af86a98c06f72e184c86d2f6f107c4114f46d42abe4f435439cbe2e3b572d644a5576e3ce0f37657566b070fa8", 0x54, 0x34}, {&(0x7f00000003c0)="5b7580643e5f1bfb1a7ae8868fd49344eb398c7173f2875391d330684a19665c39f2e1a6241cb724d41a0d103d2edd1aeadf3282782422f7086635e9ba6522506d2a54975c3ec0e15bf502a4b06224fee6bdc603d5b2", 0x56, 0xffffffff}, {&(0x7f0000000440)="7b1d19ece2fb694a", 0x8, 0x3}, {&(0x7f0000000480)="ec901c79f404b2565dd504a46f07009f63c4fbe7e759e55c1a8115423fe49cf531943111960ca90f4f5f007d4b7e6e6af633c8ef23abbf53b2660335447c50", 0x3f, 0x9b}, {&(0x7f00000004c0)="63653e93e87394290d8904f04e3ae50558506e754df5a4fe51e243d1409553cebd6f4dbf36d103454f2af8d0827639173822f707d731c269a0219da5c090409a65b92f1da3b86e94bde4c5eeaf76e215", 0x50, 0x600000000}], 0x80000, &(0x7f0000000b00)=ANY=[@ANYBLOB='noload,delalloc,data=journal,nojournal_checksum,journt,bh,dont_hash,dont_appraise,euid>\x00'/101, @ANYRESDEC=r5, @ANYBLOB="9f13f550a800c22374158270ce07000000d7acb7828d456443c1f388d99e72cc96e76780b1f12f9b2791d29c3be9b7ff96fe602a73bc72fd017d26c4feee3a4f001b09ea093c4a661bdac8845e59633d924e9b5f85aa2d3cf763667d6f99963d6aa3", @ANYRESDEC=r7, @ANYBLOB="2c66736e616d653d256d643573756d2c6170707261697365f73d8bc1b2a4f96e746578743d73797361646d5f752c00000000000000000000000000000047024ff3a91293ac9eef3b5a862fea879d17d8685b68578d015738064aec76ffe9cb5a8531563bc635e324b5a56bbc3a628f3266aab4c2861d50b0275cde236514370266d6120f2917c267768072b74ac2c22a013d3a9c4db9f94f703838c73d63558c8543bd51b0d71199a3e901f42e3658edc20c6e6ed8a165a94e4e550913cd92857143999b6f80d69f629d8b0e0e40ee35820ba6ca5c3835dce2c703f42b8100083bb908af10"]) sendfile(r2, r3, 0x0, 0x840000000024) symlinkat(&(0x7f00000001c0)='./bus\x00', r3, &(0x7f0000000200)='./bus\x00') ioctl$SG_SET_COMMAND_Q(0xffffffffffffffff, 0x2271, &(0x7f0000000140)=0x1) lsetxattr$security_capability(&(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='security.capability\x00', &(0x7f0000000180)=@v3, 0x18, 0x0) r8 = getuid() mount$9p_unix(&(0x7f0000000680)='./bus\x00', &(0x7f00000006c0)='./bus\x00', &(0x7f0000000700)='9p\x00', 0x2800, &(0x7f0000000740)={'trans=unix,', {[{@posixacl='posixacl'}, {@privport='privport'}, {@afid={'afid', 0x3d, 0x10d}}], [{@seclabel='seclabel'}, {@fsname={'fsname', 0x3d, 'security.capability\x00'}}, {@appraise='appraise'}, {@appraise_type='appraise_type=imasig'}, {@dont_measure='dont_measure'}, {@uid_lt={'uid<', r8}}]}}) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$rose(0xffffffffffffffff, 0x104, 0x5, &(0x7f0000000240)=0x6, 0x4) execve(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) 23:02:53 executing program 2: perf_event_open(&(0x7f0000000580)={0x1, 0x226, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r2 = gettid() ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3c) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r2, 0x0, 0x0) r3 = getpgid(r2) r4 = syz_open_procfs(r3, 0x0) r5 = socket(0x11, 0x800000003, 0x0) setsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r5, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) ioctl$SIOCRSGCAUSE(r5, 0x89e0, &(0x7f00000000c0)) preadv(r4, 0x0, 0x0, 0x0) recvfrom$x25(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0, 0x0) write$P9_RVERSION(r1, &(0x7f0000000980)=ANY=[@ANYBLOB="1500000065ffff0010000008003950323030300900fc9cd866b42938ab0142624904b40d651a9b3672476a814ac42843aa88e1db60ba47b6bb30407402000000349f062e4624400100000000000000e03a80b9374275d0f7b100237209ffe467ab1296c3c5085a515cf18151210b8615d54f1c7f3e9ef2ec1577c935216a586171a0aca40d531e7d4986fe59ec1406936a1b561565ffefd7652e6c949d9a7f95f42d36d892d4b30cc1fc50434686595553e6f3381cf655df317fe9ca3533e7afb1ced5c006e691b4999cf6c0aae1178e256baacb07e6f80b9f8e6bc4f3b57d528930399f5c7903c06e4298f2d6774ba4d327c8c4c783340d84b8252dc0961fdc1816a67772058c027c491d1761cd867b446e1d09fc35834cb3e8e0ed7bde47964dc091ec1ce2dd7bfa8c430600000000000000ce550d9645db0c58453350fa101f5aae17559fcfd2bd00000000c2621a68a28ccc39235cdf20d22060d3c8f352e341635ee4aab0aad9d953e0a7dd37de2bfc4fc5d81bfa4264c89a612bf74868309f840cc82f1cb476a4eaa8728c3425a50c9ffb680f44aff1e913a7f5b3158696196345a4caebc08e692861bbd2304b31f7c58fe55f668b9420ea754930458873cec2e3869c70cc78c2a06f70c33a4c09e6195262ae96eec759aae838435429bd039f8ffde4c529d7dc83c298a16cd17d01d46e41ebfeef9fc6f935e8f745bd1208d4d5b226eff70000000000000000"], 0x15) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r6, r7, 0x0, 0x800000000024) write$P9_RAUTH(r7, &(0x7f0000000040)={0x14, 0x67, 0x2, {0x1, 0xfffffffd, 0x2}}, 0xfe84) write$P9_RGETATTR(r1, &(0x7f0000000500)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="357766648a5369693d582a6f3d", @ANYRESHEX=r1]) request_key(&(0x7f0000000400)='trusted\x00', 0x0, 0x0, 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0xb) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000280)='/dev/cachefiles\x00', 0x300, 0x0) r8 = gettid() ptrace$setopts(0x4206, r8, 0x0, 0x0) tkill(r8, 0x3c) ptrace$cont(0x18, r8, 0x0, 0x0) ptrace$setregs(0xd, r8, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r8, 0x0, 0x0) getpgid(r8) openat$hwrng(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/hwrng\x00', 0x2000, 0x0) 23:02:53 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r4 = getpid() sched_setattr(r4, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r5, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r7, 0x407, 0x0) write(r7, &(0x7f0000000340), 0x41395527) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r8 = socket$kcm(0xa, 0x1, 0x0) sendmsg(r8, &(0x7f0000000500)={&(0x7f0000000080)=@in6={0xa, 0x0, 0x0, @initdev, 0x7}, 0x80, 0x0}, 0x20000000) syz_open_dev$admmidi(&(0x7f0000000140)='/dev/admmidi#\x00', 0x0, 0x331bc253f2c11733) getpeername$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000240)=0x14) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) dup(0xffffffffffffffff) 23:02:53 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB="14bc420000005d56f5000000000800000000080008000100000008020500ac14341b6396eee4a31e79b9296395a2821b80f32b53a5a066012f35c6d72e451701b861c7ac0da7daeac272987d856c79da4395a8ab"], 0x1}}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video35\x00', 0x2, 0x0) r4 = eventfd2(0xe50, 0x800) dup3(r3, r4, 0x80000) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000002c0)="b8010000000f01c166b8e2000f00d8b9800000c00f3235004000000f304a0fc75f20c44379608d00000100f22e0f01ca67440ff6143f66ba4000b846c95182ef0f01cf400f01df", 0x47}], 0xaaaaaaaaaaaace6, 0x0, 0x0, 0xeb) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000010000/0x1000)=nil}) lgetxattr(0x0, &(0x7f00000000c0)=@known='trusted.overlay.metacopy\x00', 0x0, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, &(0x7f0000000000)={0xffffffffffffc14e, 0x0, 0x6}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) accept$nfc_llcp(r6, &(0x7f0000000240), &(0x7f0000000080)=0x60) 23:02:53 executing program 2: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) fremovexattr(r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/fib_trie\x00') preadv(r1, &(0x7f0000000480), 0x100000000000022c, 0x6c00000000000000) preadv(0xffffffffffffffff, 0x0, 0x0, 0x6c00000000000000) setsockopt$inet6_dccp_buf(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000280), 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x7ff, 0x200) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xe667, 0x7, 0x0, 0xf, 0xf, 0x8, "d3c81882b95d1b6f5a31e4a6e8ca4d063ffaa11ab83dac89702f3bd2dae261de1c2336f320ec2d7258c4b3f02eeceef405a489e46c4c25021fab5c3f376c4097", "63f9060fc5dfacaf413b56d93dedbb444bd25687d620adf4d47c1793343573ba36990cfa069aac8fab19c544e16f24d09e037efbe85897bd23b02f388d77abdc", "ae9b31fcbb45aaa7efaf429cc0eaf029e82de2482eca66b5f7e7bf846b765fc1", [0x81, 0xc7]}) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) r5 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x100, 0x181081) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0xfffffffffffffef8) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x20, 0x0) write$UHID_INPUT2(r6, &(0x7f0000000280)={0xc, 0x7f, "c6975a48a72823e516e91edfe42ca10bb150dfa54f9422fe8d20371ff00fa249678974c290ae0725bb8c3e96d9ecfed003fbb475ef4b3e2540454e0c55d29fee7be59762262876c1de570ee0c084e104b43d7d659efb9d7a8cf5358bb643f07b9410ee4278711f1b788f7d2ab686a80f71630a29be0eec2d4a583abc915f63"}, 0x85) accept$alg(0xffffffffffffffff, 0x0, 0x0) 23:02:53 executing program 5 (fault-call:21 fault-nth:8): memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:53 executing program 1: close(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x800002, 0x0) r0 = socket$kcm(0x29, 0x5, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') setsockopt(r0, 0x0, 0x0, &(0x7f0000000700), 0x0) ioctl$VIDIOC_S_HW_FREQ_SEEK(0xffffffffffffffff, 0x40305652, &(0x7f0000000300)={0x7fffffff, 0x0, 0x1, 0x2, 0x0, 0x10000, 0xfffffffc}) rename(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') socketpair(0x1b3f2b94b3154d, 0x80000, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaffff937aff00"/18, @ANYRES32=0x0], 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000040)={r2, @in6={{0xa, 0x4e22, 0x0, @loopback, 0x46cd}}, 0xe00, 0x0, 0x0, 0x4, 0x100000000}, &(0x7f0000000100)=0x98) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000000280)={r2, 0xebdc}, 0x8) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) sendto$inet(r5, &(0x7f0000000180)="970957d03f821bbe0ca638e29e54255cb888d9175fc62214000e97f4eb2cd54d0f8df16cebd9fa4ebb54d848170c6f25b4bd1ec8eb9d6300460588c24e73a5956ce69a8d6cf56e354db962efe89e4f2d0076ad305d9174e3340d9cb68fdcbe343f9eeaf3078f8069d3a35fb61c8c3911fded560b0d9e222931ca64bd1e29debe390fd0a0aacb9e8d4f620a0843c84b839cba17eae8c8c5e1c4", 0x99, 0x2, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x188001) sendfile(r6, r7, 0x0, 0x800000000024) pwrite64(r6, &(0x7f0000000100)="ea6276bbe085a21bfe040a302127c3158f7d8510b745fdbe", 0x18, 0x14) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) [ 370.944699] FAULT_INJECTION: forcing a failure. [ 370.944699] name failslab, interval 1, probability 0, space 0, times 0 [ 370.956460] CPU: 0 PID: 17218 Comm: syz-executor.5 Not tainted 4.14.146 #0 [ 370.963495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 370.972873] Call Trace: [ 370.975469] dump_stack+0x138/0x197 [ 370.979102] should_fail.cold+0x10f/0x159 [ 370.983388] should_failslab+0xdb/0x130 [ 370.987359] kmem_cache_alloc_trace+0x2e9/0x790 [ 370.992036] snd_mixer_oss_get_volume1_sw.isra.0+0x96/0x320 [ 370.997751] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 371.002849] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 371.008470] ? finish_task_switch+0x178/0x650 [ 371.012957] ? finish_task_switch+0x14d/0x650 [ 371.017446] ? switch_mm_irqs_off+0x2c5/0xec0 [ 371.021937] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 371.026642] ? __schedule+0x7c0/0x1cd0 [ 371.030525] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 371.036145] ? snd_mixer_oss_proc_read+0x250/0x250 [ 371.041322] ? retint_kernel+0x2d/0x2d [ 371.045209] ? trace_hardirqs_on_caller+0x400/0x590 [ 371.050225] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 371.055059] ? retint_kernel+0x2d/0x2d [ 371.058940] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 371.063960] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 371.069029] snd_mixer_oss_ioctl+0x47/0x60 [ 371.073283] do_vfs_ioctl+0x7ae/0x1060 [ 371.077174] ? selinux_file_mprotect+0x5d0/0x5d0 [ 371.081927] ? lock_downgrade+0x6e0/0x6e0 [ 371.086076] ? ioctl_preallocate+0x1c0/0x1c0 [ 371.090485] ? __fget+0x237/0x370 [ 371.093940] ? security_file_ioctl+0x89/0xb0 [ 371.098343] SyS_ioctl+0x8f/0xc0 [ 371.101705] ? do_vfs_ioctl+0x1060/0x1060 [ 371.105887] do_syscall_64+0x1e8/0x640 [ 371.109796] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 371.114656] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 371.119895] RIP: 0033:0x459a29 [ 371.123086] RSP: 002b:00007feb90741c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 371.130786] RAX: ffffffffffffffda RBX: 00007feb90741c90 RCX: 0000000000459a29 [ 371.138113] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000007 [ 371.145375] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 371.152639] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feb907426d4 [ 371.159945] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000008 23:02:54 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:54 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) getsockopt$IP_VS_SO_GET_VERSION(r4, 0x0, 0x480, &(0x7f00000000c0), &(0x7f0000000300)=0x40) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r6 = dup(0xffffffffffffffff) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r6, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r8, 0x0) fchownat(r3, &(0x7f0000000100)='./file1\x00', r8, 0x0, 0x1000) r9 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r9, 0x80044dff, 0x0) 23:02:54 executing program 5 (fault-call:21 fault-nth:9): memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:54 executing program 2: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) fremovexattr(r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/fib_trie\x00') preadv(r1, &(0x7f0000000480), 0x100000000000022c, 0x6c00000000000000) preadv(0xffffffffffffffff, 0x0, 0x0, 0x6c00000000000000) setsockopt$inet6_dccp_buf(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000280), 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x7ff, 0x200) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xe667, 0x7, 0x0, 0xf, 0xf, 0x8, "d3c81882b95d1b6f5a31e4a6e8ca4d063ffaa11ab83dac89702f3bd2dae261de1c2336f320ec2d7258c4b3f02eeceef405a489e46c4c25021fab5c3f376c4097", "63f9060fc5dfacaf413b56d93dedbb444bd25687d620adf4d47c1793343573ba36990cfa069aac8fab19c544e16f24d09e037efbe85897bd23b02f388d77abdc", "ae9b31fcbb45aaa7efaf429cc0eaf029e82de2482eca66b5f7e7bf846b765fc1", [0x81, 0xc7]}) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) r5 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x100, 0x181081) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0xfffffffffffffef8) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x20, 0x0) write$UHID_INPUT2(r6, &(0x7f0000000280)={0xc, 0x7f, "c6975a48a72823e516e91edfe42ca10bb150dfa54f9422fe8d20371ff00fa249678974c290ae0725bb8c3e96d9ecfed003fbb475ef4b3e2540454e0c55d29fee7be59762262876c1de570ee0c084e104b43d7d659efb9d7a8cf5358bb643f07b9410ee4278711f1b788f7d2ab686a80f71630a29be0eec2d4a583abc915f63"}, 0x85) accept$alg(0xffffffffffffffff, 0x0, 0x0) [ 371.964263] FAULT_INJECTION: forcing a failure. [ 371.964263] name failslab, interval 1, probability 0, space 0, times 0 [ 371.975702] CPU: 1 PID: 17259 Comm: syz-executor.5 Not tainted 4.14.146 #0 [ 371.982729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 371.992094] Call Trace: [ 371.994694] dump_stack+0x138/0x197 [ 371.998330] should_fail.cold+0x10f/0x159 [ 372.002489] should_failslab+0xdb/0x130 [ 372.006484] kmem_cache_alloc_trace+0x2e9/0x790 [ 372.011172] snd_mixer_oss_get_volume1_sw.isra.0+0xce/0x320 [ 372.016897] ? speculation_ctrl_update_current+0x50/0x50 [ 372.022395] snd_mixer_oss_get_recsrc1_sw+0xf9/0x1a0 [ 372.027527] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 372.033179] ? finish_task_switch+0x178/0x650 [ 372.037694] snd_mixer_oss_ioctl1+0x12b1/0x1590 [ 372.042383] ? snd_mixer_oss_get_recsrc1_route+0x1b0/0x1b0 [ 372.048029] ? snd_mixer_oss_proc_read+0x250/0x250 [ 372.052985] ? retint_kernel+0x2d/0x2d [ 372.056899] ? trace_hardirqs_on_caller+0x400/0x590 23:02:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0x17db74d2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x400001, 0x0) ioctl$TIOCGSOFTCAR(r2, 0x5419, &(0x7f0000000140)) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000100)) [ 372.061925] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 372.066702] ? retint_kernel+0x2d/0x2d [ 372.070611] ? snd_mixer_oss_ioctl_compat+0x70/0x70 [ 372.075629] snd_mixer_oss_ioctl+0x47/0x60 [ 372.079994] do_vfs_ioctl+0x7ae/0x1060 [ 372.083889] ? selinux_file_mprotect+0x5d0/0x5d0 [ 372.088659] ? lock_downgrade+0x6e0/0x6e0 [ 372.092825] ? ioctl_preallocate+0x1c0/0x1c0 [ 372.097238] ? __fget+0x237/0x370 [ 372.097259] ? security_file_ioctl+0x89/0xb0 [ 372.097275] SyS_ioctl+0x8f/0xc0 [ 372.097284] ? do_vfs_ioctl+0x1060/0x1060 23:02:55 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) [ 372.097297] do_syscall_64+0x1e8/0x640 [ 372.097307] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 372.105160] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 372.105170] RIP: 0033:0x459a29 [ 372.105175] RSP: 002b:00007feb90741c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 372.105187] RAX: ffffffffffffffda RBX: 00007feb90741c90 RCX: 0000000000459a29 [ 372.105193] RDX: 0000000000000000 RSI: 0000000080044dff RDI: 0000000000000007 [ 372.105199] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 372.105204] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feb907426d4 [ 372.105210] R13: 00000000004c46f4 R14: 00000000004d8c08 R15: 0000000000000008 23:02:55 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000380), 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) dup(0xffffffffffffffff) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) r4 = socket(0x11, 0x800000003, 0x0) r5 = syz_open_dev$video(&(0x7f0000000140)='/dev/video#\x00', 0x77ff, 0x0) ioctl$VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f00000004c0)={0x9, @raw_data="f3f7fc89a82d63d3594d313217e07113f426f74913bc7d8ccb7c4e956456dd8b9f07dff25e0db894ed674f85946881bacf830638e448638beebfe2fd7a49e4341c842aeded5cbdb776e945717affb013f3813ef82516e893a71ef5ef93341365d2696272f43c9574f3c296cad841ea850a057ca14c352e0e1a6d91eb00ee613a5e5bbe7fb9ce90830ef2534bf30565aa69f89d0a9cd56072ad92310f1cad6c8e01778d5d4b14fe73f78570df62b91b45137f61b23e2a1453392919a830c89470c73753ee4c5ee93a"}) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r6, r7, 0x0, 0x800000000024) fsetxattr$trusted_overlay_opaque(r6, &(0x7f00000000c0)='trusted.overlay.opaque\x00', &(0x7f0000000100)='y\x00', 0x2, 0x3) setsockopt$packet_buf(r4, 0x107, 0xf, &(0x7f0000000000)="a200005c", 0x4) bind(r4, &(0x7f0000000180)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r8 = dup3(0xffffffffffffffff, r4, 0x80000) ioctl$NBD_SET_SIZE_BLOCKS(r8, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') 23:02:55 executing program 1: close(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x800002, 0x0) r0 = socket$kcm(0x29, 0x5, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') setsockopt(r0, 0x0, 0x0, &(0x7f0000000700), 0x0) ioctl$VIDIOC_S_HW_FREQ_SEEK(0xffffffffffffffff, 0x40305652, &(0x7f0000000300)={0x7fffffff, 0x0, 0x1, 0x2, 0x0, 0x10000, 0xfffffffc}) rename(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') socketpair(0x1b3f2b94b3154d, 0x80000, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaffff937aff00"/18, @ANYRES32=0x0], 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000040)={r2, @in6={{0xa, 0x4e22, 0x0, @loopback, 0x46cd}}, 0xe00, 0x0, 0x0, 0x4, 0x100000000}, &(0x7f0000000100)=0x98) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000000280)={r2, 0xebdc}, 0x8) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) sendto$inet(r5, &(0x7f0000000180)="970957d03f821bbe0ca638e29e54255cb888d9175fc62214000e97f4eb2cd54d0f8df16cebd9fa4ebb54d848170c6f25b4bd1ec8eb9d6300460588c24e73a5956ce69a8d6cf56e354db962efe89e4f2d0076ad305d9174e3340d9cb68fdcbe343f9eeaf3078f8069d3a35fb61c8c3911fded560b0d9e222931ca64bd1e29debe390fd0a0aacb9e8d4f620a0843c84b839cba17eae8c8c5e1c4", 0x99, 0x2, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x188001) sendfile(r6, r7, 0x0, 0x800000000024) pwrite64(r6, &(0x7f0000000100)="ea6276bbe085a21bfe040a302127c3158f7d8510b745fdbe", 0x18, 0x14) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) 23:02:55 executing program 5 (fault-call:21 fault-nth:10): memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:55 executing program 2: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) fremovexattr(r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/fib_trie\x00') preadv(r1, &(0x7f0000000480), 0x100000000000022c, 0x6c00000000000000) preadv(0xffffffffffffffff, 0x0, 0x0, 0x6c00000000000000) setsockopt$inet6_dccp_buf(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000280), 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x7ff, 0x200) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xe667, 0x7, 0x0, 0xf, 0xf, 0x8, "d3c81882b95d1b6f5a31e4a6e8ca4d063ffaa11ab83dac89702f3bd2dae261de1c2336f320ec2d7258c4b3f02eeceef405a489e46c4c25021fab5c3f376c4097", "63f9060fc5dfacaf413b56d93dedbb444bd25687d620adf4d47c1793343573ba36990cfa069aac8fab19c544e16f24d09e037efbe85897bd23b02f388d77abdc", "ae9b31fcbb45aaa7efaf429cc0eaf029e82de2482eca66b5f7e7bf846b765fc1", [0x81, 0xc7]}) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) r5 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x100, 0x181081) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0xfffffffffffffef8) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x20, 0x0) write$UHID_INPUT2(r6, &(0x7f0000000280)={0xc, 0x7f, "c6975a48a72823e516e91edfe42ca10bb150dfa54f9422fe8d20371ff00fa249678974c290ae0725bb8c3e96d9ecfed003fbb475ef4b3e2540454e0c55d29fee7be59762262876c1de570ee0c084e104b43d7d659efb9d7a8cf5358bb643f07b9410ee4278711f1b788f7d2ab686a80f71630a29be0eec2d4a583abc915f63"}, 0x85) accept$alg(0xffffffffffffffff, 0x0, 0x0) 23:02:55 executing program 3: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) getsockopt$IP_VS_SO_GET_VERSION(r4, 0x0, 0x480, &(0x7f00000000c0), &(0x7f0000000300)=0x40) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r6 = dup(0xffffffffffffffff) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r6, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r8, 0x0) fchownat(r3, &(0x7f0000000100)='./file1\x00', r8, 0x0, 0x1000) r9 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r9, 0x80044dff, 0x0) 23:02:56 executing program 2: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x100001c9, 0x0) fremovexattr(r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='net/fib_trie\x00') preadv(r1, &(0x7f0000000480), 0x100000000000022c, 0x6c00000000000000) preadv(0xffffffffffffffff, 0x0, 0x0, 0x6c00000000000000) setsockopt$inet6_dccp_buf(0xffffffffffffffff, 0x21, 0x0, &(0x7f0000000280), 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x7ff, 0x200) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xe667, 0x7, 0x0, 0xf, 0xf, 0x8, "d3c81882b95d1b6f5a31e4a6e8ca4d063ffaa11ab83dac89702f3bd2dae261de1c2336f320ec2d7258c4b3f02eeceef405a489e46c4c25021fab5c3f376c4097", "63f9060fc5dfacaf413b56d93dedbb444bd25687d620adf4d47c1793343573ba36990cfa069aac8fab19c544e16f24d09e037efbe85897bd23b02f388d77abdc", "ae9b31fcbb45aaa7efaf429cc0eaf029e82de2482eca66b5f7e7bf846b765fc1", [0x81, 0xc7]}) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x88001) sendfile(r3, r4, 0x0, 0x800000000024) r5 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x100, 0x181081) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0xfffffffffffffef8) r6 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x20, 0x0) write$UHID_INPUT2(r6, &(0x7f0000000280)={0xc, 0x7f, "c6975a48a72823e516e91edfe42ca10bb150dfa54f9422fe8d20371ff00fa249678974c290ae0725bb8c3e96d9ecfed003fbb475ef4b3e2540454e0c55d29fee7be59762262876c1de570ee0c084e104b43d7d659efb9d7a8cf5358bb643f07b9410ee4278711f1b788f7d2ab686a80f71630a29be0eec2d4a583abc915f63"}, 0x85) accept$alg(0xffffffffffffffff, 0x0, 0x0) 23:02:56 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 23:02:56 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x80006, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000080)={'U+', 0x902}, 0x28, 0x4e68d8399f7c8a7a) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0xc000) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x2) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000640)='/dev/btrfs-control\x00', 0x214000, 0x0) umount2(&(0x7f00000006c0)='./file0\x00', 0x2) ioctl$SG_GET_SCSI_ID(r3, 0x2276, &(0x7f0000000680)) connect(r0, &(0x7f00000005c0)=@isdn={0x22, 0x3, 0x3, 0x0, 0x4}, 0x80) ioctl$ASHMEM_SET_SIZE(r2, 0x40087703, 0x10000) write$uinput_user_dev(r0, &(0x7f0000000700)={'\ayz0\x05\xf0\x00\x00\x00\x80\xff\xff\xff\v\x00\x00\xfe\xff\xff\xff\x00\x00\x00\x00\x05\xc0\x00\x00\x05\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a, 0x0, 0x0, 0x4ed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xa565], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400]}, 0x45c) 23:02:56 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) ioctl$VIDIOC_G_FREQUENCY(r5, 0xc02c5638, &(0x7f00000000c0)={0x8, 0x4, 0x400}) r6 = dup(0xffffffffffffffff) r7 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r6, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r7, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r8 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r8, 0x80044dff, 0x0) 23:02:56 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f00000000c0)={0x1, 0x0, [0x40000080]}) 23:02:56 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x21000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r4 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r4, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:56 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() ptrace$getregs(0xffffffffffffffff, r0, 0x0, &(0x7f00000005c0)=""/22) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) 23:02:56 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) socket$inet6(0xa, 0x2da37ffc2aa303fb, 0x1) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) geteuid() ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:56 executing program 1: io_setup(0x3, &(0x7f0000000100)=0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) io_submit(r0, 0x2, &(0x7f00000005c0)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0, 0x12f}]) 23:02:56 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x10, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r1 = epoll_create1(0x0) ioctl$VFIO_IOMMU_UNMAP_DMA(r0, 0x3b72, &(0x7f0000000080)={0x20, 0x2, 0x0, 0x8, 0x9c}) fcntl$lock(r1, 0x7, &(0x7f0000000100)={0x1}) tkill(0x0, 0x0) sched_getaffinity(0x0, 0x8, &(0x7f0000000040)) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r0, r2) 23:02:56 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x4ffe0, 0x0) 23:02:57 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [0x40000101]}) 23:02:57 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) fchown(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, &(0x7f00000004c0)) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f00000002c0)={0x40, {{0x2, 0x0, @rand_addr=0x80}}}, 0x88) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040, 0x0) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, 0x0) ioctl$DRM_IOCTL_INFO_BUFS(0xffffffffffffffff, 0xc0106418, 0x0) 23:02:57 executing program 2: unshare(0x2a020400) mq_open(&(0x7f00000000c0)='md5e\xb6L\xea\x90`\xb6\xda\xe8\x9a\x9dt~\\\xb1\xdba\xe6\xc7(mi\x99\x88Q\x92y\xf3\x1b@\x00\x00\x00\xea\xf5\a\r\x00\x00\x00', 0x6e93ebbbcc0884f4, 0x0, 0x0) select(0x427, &(0x7f00000001c0), 0x0, &(0x7f0000000240)={0x9}, &(0x7f0000000280)) 23:02:57 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [0x40000094]}) 23:02:57 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(gcm_base(ctr(aes-aesni),ghash-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000012c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000005900)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0xe7030000, &(0x7f0000000140)=[{&(0x7f0000001480)=""/4096, 0xfffffdd7}], 0x1, 0x0, 0x2000000}, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) getdents(0xffffffffffffffff, &(0x7f00000002c0)=""/4096, 0x1000) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0xbcda34450b800b7a, 0x40000000000a132, 0xffffffffffffffff, 0x0) 23:02:57 executing program 1: r0 = socket(0xa, 0x802, 0x88) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x4) recvmmsg(r1, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) writev(r1, &(0x7f0000fb1000)=[{&(0x7f0000000180)="480000001400197f09004b0101048c590a88ffffff010001000000000028213ee20600d4ff5bffff00c7e5ed5e00000000000000000000eaf60d18125d4b18857a9eace3dbe8b12c", 0x48}], 0x1) 23:02:57 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x40000000015, 0x805, 0x0) getsockopt(r0, 0x114, 0x5, 0x0, &(0x7f000033bffc)) [ 374.523029] audit: type=1400 audit(1569884577.500:87): avc: denied { map } for pid=17382 comm="syz-executor.3" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=62782 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:hugetlbfs_t:s0 tclass=file permissive=1 23:02:57 executing program 1: io_setup(0x3, &(0x7f0000000100)=0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) io_submit(r0, 0x2, &(0x7f00000005c0)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x8, 0x0, r1, 0x0}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0, 0x0, 0x3}]) 23:02:57 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) getpid() sched_setattr(0xffffffffffffffff, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x3}, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000100)}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x8) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f00000000c0)={0x9803, 0x1, 0x1, 0x1, 0x4}) r3 = dup(0xffffffffffffffff) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r5, 0x29, 0xd3, &(0x7f0000000380)={{0xa, 0x4e24, 0x10001, @loopback, 0x5cbc}, {0xa, 0x4e20, 0x7771, @remote, 0x95}, 0x7, [0x8, 0x7, 0xffffffff, 0x5, 0xfffffffb, 0x4, 0xfffffffc, 0x1]}, 0x5c) r6 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r3, 0xab07, 0x0) symlink(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r6, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r7, 0x80044dff, 0x0) 23:02:57 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x90b, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control\x00', 0x200, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000440)={0x7, {{0xa, 0x4e24, 0x4, @local, 0xff}}}, 0x88) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000100)="840fcf9d2764db40", 0x2) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f00000002c0)={'filter\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() creat(&(0x7f0000000400)='./file0\x00', 0x0) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000040)={r6, @in6={{0xa, 0x4a22, 0x3, @loopback, 0x46d1}}, 0x0, 0x0, 0x0, 0x40004, 0x100000000}, &(0x7f0000000100)=0x98) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r5, 0x84, 0x6d, &(0x7f0000000500)={r6, 0xc0, "003237f1f24698191973528faa1718837f2108036f34ae8e6f7942b8a9c8eeaaf9705520c26748f43ac00733c08e263477874531bab1115a4ee80ed9d829193a7a4b383432d66deee49686e4d176685efd8ca857f2bd3b7844efcba788fcd6c80b174401d72d2fc4288adcb3ec49e34f83fd2d0964c78c2eef4edfb342a1c53d09cd1c473a532b82dade8b5d6a16047f9c17bea5c9eebf13846cf4f64a72285ff49c403eee51ac4f361505d22c682ce56bbeefd0c63d483852a23f25b6da7016"}, &(0x7f0000000140)=0xc8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f00000001c0)={r7, 0x8, 0x4}, &(0x7f0000000340)=0x8) ioctl$UFFDIO_REGISTER(r5, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:57 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r1 = epoll_create1(0x0) ioctl$VFIO_IOMMU_UNMAP_DMA(r0, 0x3b72, 0x0) fcntl$lock(r1, 0x7, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r0, r2) 23:02:57 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x4ffe0, 0x0) 23:02:57 executing program 3: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000180)={@local, @dev, [], {@ipv6={0x86dd, {0x0, 0x6, "83d98e", 0x10, 0x11, 0x0, @remote, @ipv4={[], [], @multicast1}, {[], @icmpv6=@ni}}}}}, 0x0) 23:02:57 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="00dca50d5e0bcfe47bf070") r1 = socket$unix(0x1, 0x1, 0x0) getsockopt$sock_cred(r1, 0x1, 0xe, &(0x7f0000001480), &(0x7f0000000180)=0xc) 23:02:57 executing program 2: clone(0x80000700, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84) sched_yield() connect$inet6(r0, &(0x7f00008c0000)={0xa, 0x0, 0x0, @loopback}, 0x1c) 23:02:57 executing program 1: r0 = open(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x1000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000280)) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x0, 0x2, 0x600, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x400, 0x0, 0x25, "07a30cd41929926a9335701c068b17b9fc07cd039f5a47009833063800"}}) ioctl$VIDIOC_ENUMAUDIO(0xffffffffffffffff, 0xc0345641, &(0x7f0000000040)={0x10000, "88515e9b670b950bc956faa2ac850361462533d0b5bfd0f99f9d69e862dde73f", 0x1}) r2 = semget$private(0x0, 0x1, 0x80) semctl$SEM_INFO(r2, 0x1, 0x13, &(0x7f0000000140)=""/100) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) rt_sigaction(0xb, 0x0, &(0x7f00000003c0)={0x0, {}, 0x0, &(0x7f0000000380)="c481b1551026400ff3ba0345d39bf2d8eef04021a70000000066400f295fe8c4e1c72a0ac4617c5cd6c461f877c421c171d67bc4c250f30cb8"}, 0x8, &(0x7f0000000400)) r4 = memfd_create(&(0x7f0000000140)='\xab\x05\xae\xa8\x17\xe4\x93\xf4\xe4a\xa2(\t\x00\x81\xafu', 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={r3, r0, 0x15323cc979f0c46b, 0x1}, 0x10) r5 = dup(r4) execveat(r5, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, &(0x7f00000004c0)=r5) openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ashmem\x00', 0xcdeb05afe3b668f4, 0x0) r6 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r7 = memfd_create(&(0x7f0000000140)='\xab\x05\xae\xa8\x17\xe4\x93\xf4\xe4a\xa2(\t\x00\x81\xafu', 0x0) inotify_add_watch(r6, &(0x7f0000000540)='./file0\x00', 0x8) r8 = dup(r7) execveat(r8, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r8, 0x4040534e, &(0x7f0000000440)={0x228, @tick=0x2, 0x0, {0x8, 0x1}, 0x1, 0x5, 0x1f}) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000000580)='trusted.overlay.redirect\x00', &(0x7f00000005c0)='./file0\x00', 0x8, 0x2) r9 = memfd_create(&(0x7f0000000140)='\xab\x05\xae\xa8\x17\xe4\x93\xf4\xe4a\xa2(\t\x00\x81\xafu', 0x0) r10 = dup(r9) execveat(r10, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r10, 0x84, 0x13, &(0x7f0000000600)={0x0, 0x1}, &(0x7f0000000640)=0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r6, 0x84, 0x6, &(0x7f0000000680)={r11, @in6={{0xa, 0x1, 0x6, @dev={0xfe, 0x80, [], 0x21}, 0x3}}}, &(0x7f0000000740)=0x84) ioctl$RTC_PLL_SET(0xffffffffffffffff, 0x40207012, &(0x7f0000000100)={0x3, 0x4, 0x7fff, 0x6cd2ae13, 0x9, 0x1, 0xa4}) 23:02:57 executing program 3: semget$private(0x0, 0x0, 0x261) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) close(r0) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x30c) io_setup(0x3, &(0x7f00000001c0)=0x0) io_submit(r2, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x2, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x12f}]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000180)=0xc) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000040)) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='mounts\x00') read$eventfd(r3, &(0x7f0000000080), 0xff97) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000140)={0x0, 0x1, 0x0, 0x1000, &(0x7f0000017000/0x1000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000018000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r5, r6, &(0x7f0000017000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfde4) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r5, 0x660c) connect$inet6(r3, &(0x7f0000005980)={0xa, 0x4e24, 0x0, @mcast1, 0x1}, 0x1c) sendmmsg$alg(r3, &(0x7f0000008400)=[{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000140)="488daea7f1d993e14e6d209a83f3d4e28eb75869", 0x14}, {&(0x7f00000002c0)}, {&(0x7f0000000380)="542abda5d8cd802ccb40016017d3db89570becc6266133f4679604206489b85ea5528ab0025aa67c934b6fe8b5e9e184ec8762e6be6d7a8c195c39d5892cbcb9236f5989357988357fff992b9417b7bd09e58688e961", 0x56}, {&(0x7f00000085c0)="5b1332ee1d875a50eb0e66fc108ec0133120387bb8eb5e6645bfc5348eb6831d1f9b060ad1aae12cdf6ff7653bd6fb5ae11550b371cbee21c7ae7b5ce375385e9d66e10ba9ff1268ea04300ab329374a336cd9ffe1f1a1d1cec2f2317eac81ad2fd524155ef2efeaea07b3ab35f62805937a09c85a5782727a89197bdcc98e7c2b036dc608520752634484fc428a66cda80c540d7b9a13a50b5086c3b0e435abfd0e02b11d017b0e0d6983ec2034af87ec", 0xb1}, {&(0x7f0000000540)="0b7de480f775c3a42899827c7deab9a3e619da87e23ff35882dfac79eaf50dad7e4ec7b2c895ca5c470a72a47163c84e562bc584020ac1aacd7dbddfbc496961203ccc1b8c17c679717008e85e", 0x4d}], 0x5, &(0x7f0000000700)=[@op={0x18, 0x117, 0x3, 0x3}, @iv={0x18, 0x117, 0x2, 0x4, "4139f9e8"}, @assoc={0x18, 0x117, 0x4, 0x10001}], 0x48, 0x48081}, {0x0, 0x0, &(0x7f0000001940)=[{0x0}, {&(0x7f0000001780)}, {&(0x7f0000001840)="864e344b343597614d0d458dfa3267dc03b9a58d57ab0fa343f4bc5129e114728400814b8814658d44937eb939269180958a36fef4867f5dcf6b8a7259311ece66aec332a86a232b2aead78eccf81c0d563f11ca68342d08", 0x58}, {0x0}], 0x4, 0x0, 0x0, 0x20000041}, {0x0, 0x0, &(0x7f0000003dc0)=[{0x0}, {&(0x7f0000001bc0)}, {&(0x7f0000003bc0)="dde65c03cbd597d98cecda6c660451a01bd02c5c095886a54c49b90ab144bcaba3", 0x21}, {&(0x7f0000003d40)="2c03b4e2548376bf33557b400422bb19efa2915995", 0x15}, {0x0}], 0x5, &(0x7f00000019c0)=ANY=[@ANYBLOB="180000000000000017010000040000000400000000000000880000000000000017010000020000006e0000001643b7c11a38bc2e2ef4c4540eecb21e38fa871f9d9801ce99264f69cdef27906eab50f1056dfd60ef9beb9cd5eee54849aafac5c9d0f2559e459b2a93075660b8a6ccefddfbe0bb30689e1d5989b4d2284efcd1b79f927f2bc99176d19fa02e3e092c5c1b889d90aaf14693afce000000000000480000000000000017010000020000003000000043bd81ea5822d1f4378e082da3e2e9b79540c924a76cbea24861c834fada242cad7206e08f5cd5c6705fce16473b4ffa00000000180000000000000017010000040000000000000000000000d45cb9a03aff81037b97abb03404b9e277980e399b5e18a8a32d43181dea9b22c00a"], 0x122, 0x4000}, {0x0, 0x0, &(0x7f0000005440)=[{&(0x7f0000005000)="6cb344120d74f90ac15afaeb6144f8658cd161109164b8b8ac41e05e908538d81bbd0a185487a73844372e45f1405359003db4dc16ef4b4c384ea654db865419ef9f2b9c2ca37e904cbda81428169367930258dc4ac568eff9b9a41102", 0x5d}, {&(0x7f0000005180)}, {&(0x7f0000005280)}, {&(0x7f0000005340)="3664bdcdde375b18198c9a017e5e5fbac90c037e111426c00706d58d710700000000", 0x22}, {&(0x7f00000053c0)}, {&(0x7f0000005400)}], 0x6, &(0x7f00000054c0)}, {0x0, 0x0, &(0x7f0000005900)=[{&(0x7f0000005580)="46d6a0763e45179b59973c9d391ef0b86facbe3457feee02d5ff181485bd36392caad58d6373e2383a1436765c54f4460dbac870c78d56241c0dca8e44b47b32d2504571121d4debeeb50eb4d192c29fa7bbfde63788cd7aec0807df4d62db1cb4d5074c18b6f056aad052213b9b6d35e6bd859ceeeaab1a1ed71fc336f7", 0x7e}, {0x0}, {0x0}, {&(0x7f0000005880)="4631f4c7f5bf78962d3523baffe402d4653823d5c1bf", 0x16}, {&(0x7f00000058c0)="ee430214a4ef9155d85fec8b42b4251c4bca60f196481b59f12049b90020d7e90b063633c7b12a3855", 0x29}], 0x5, 0x0, 0x0, 0x40802}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40c0088}], 0x6, 0x14024140) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5419, 0x0) r7 = creat(&(0x7f0000000040)='./bus\x00', 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)=ANY=[@ANYRES16, @ANYBLOB], 0x2}, 0x1, 0x0, 0x0, 0x4000}, 0x800) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0xfffffffffffffee8, 0x11) semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000780)=[0x5]) semctl$SEM_STAT(0x0, 0x2, 0x12, &(0x7f00000016c0)=""/233) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f0000000340)=0x1000) [ 374.902157] sock: process `syz-executor.1' is using obsolete getsockopt SO_BSDCOMPAT 23:02:58 executing program 1: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RWALK(r0, &(0x7f00000003c0)=ANY=[@ANYRES64], 0x8) perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:02:58 executing program 1: 23:02:58 executing program 1: 23:02:58 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) write(0xffffffffffffffff, &(0x7f0000000000), 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 23:02:58 executing program 3: r0 = socket(0x40000000015, 0x805, 0x0) getsockopt(r0, 0x114, 0x5, 0x0, &(0x7f000033bffc)=0x4) 23:02:58 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x28800, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r4 = dup(0xffffffffffffffff) r5 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r5, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r6, 0x80044dff, 0x0) 23:02:58 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x4ffe0, 0x0) 23:02:58 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [0x40000092]}) 23:02:58 executing program 3: openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffdffffffffff, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x9fc, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0), 0x106, 0x8}}, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x1) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000d80), 0x4) unshare(0x40000000) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000140)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4a8, 0x350, 0x1a0, 0x0, 0x350, 0x1a0, 0x410, 0x410, 0x410, 0x410, 0x410, 0x6, &(0x7f0000000000), {[{{@uncond, 0x0, 0x98, 0xe0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4, 'ip6gre0\x00', 0x9}}}, {{@ip={@empty, @remote, 0xffffff00, 0xffffff00, 'syzkaller0\x00', 'veth1_to_hsr\x00', {0x1fe}, {0xff}, 0x33, 0x1, 0x2}, 0x0, 0x98, 0xc0}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x2}}}, {{@uncond, 0x0, 0xc0, 0xf0, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x8}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x32b6, 0x7000, @empty, 0x4e21}}}, {{@ip={@empty, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xff000000, 0xffffff00, 'gretap0\x00', 'vxcan1\x00', {0x101}, {}, 0x0, 0x1, 0x6c}, 0x0, 0x98, 0xc0}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x3, 0xef}}}, {{@ip={@empty, @loopback, 0x7fffffff, 0xff000000, 'tunl0\x00', 'hwsim0\x00', {}, {}, 0x84, 0xacaf43df70f9f169, 0x9e7303e32ee2e607}, 0x0, 0x98, 0xc0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x508) 23:02:58 executing program 2: 23:02:58 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) setsockopt$inet_buf(r1, 0x0, 0x10, 0xffffffffffffffff, 0x0) memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r3, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) write(r5, &(0x7f0000000340), 0x41395527) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x400000000001, 0x0) close(r6) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x88001) sendfile(r6, r7, 0x0, 0x800000000024) r8 = syz_open_dev$vcsa(&(0x7f0000000300)='/dev/vcsa#\x00', 0x80000001, 0x20000) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000340)={{{@in=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000ac0)=0xe8) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000000c0)={'ip6gre0\x00', r9}) bind(0xffffffffffffffff, &(0x7f0000000180)=@xdp={0x2c, 0x0, r9, 0x11}, 0x80) sendmmsg$inet6(r6, &(0x7f0000002840)=[{{&(0x7f00000000c0)={0xa, 0x4e20, 0xeae, @dev={0xfe, 0x80, [], 0x18}, 0x1}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000440)="0b7031978b70692ae19b50a6506dfa2b30cc33b90a7cb6459353ed8c10d56de8bd6ff48dff58627edf62b557680ea3c580b8568210a9fb6b6a01dc86e29e44b1c6e3dea09d6cdbad03e1030b525e50f6788c496b311aa335246e5d065b709211266c86ad3a161ad4877615637781a755af27f9893910743ee74d0e3c24513bcba25c922a2178f5b3c2059dc4ea116a596f6b1b2b32b1d95af5dfe815461cd2bd20854ef3d53cb4811048622ecef9472b853556763e08e421395635b6da317d3eda55f71397a57708a3371b5b5f59dafcf311c3191d1d850f7efab6a680c05e8f892c02d9950b73d4afd6268b56e046bdad41e1fcde903cba50f9552f38b326fa9309d1be6541f55e5744f717da9a263b24a6377dfe09198c6dc0482138240fa7b137c60872c98504cc7e9c999b5d7704029a40d81cf2c1ffd44466c5b558af09cac33f84f2af87c5edd593e376d8f5a629cf317010b813e27cc0bf6f69187c146705d4333d9f2600f6b48e28845915060a16bb108ebbcfff5e19a77e245633d0992e8464b2fc99ea6ccf630c4128d05df47f7bc0f06542c93839b753f1829b9333c33fab961ed25c10c44e0e82a6384035cb8cdfc854597b1037dbdcbc6ea3a574f3310fbe848c92b38f8c42797c5003e1743dce50946e591cfbcf3b387f05a8c4ead713a661d833593e0daa7b30a8cc89318c4589fd300545030369e379dc032e46912952731c1a65fb1440d91b6dfabb4cea45d238e8ab6ca3f726bb548dff3e713d49d3bef5b3a215c27d88c8dd9ed4906f7d50956aff8541963c4e33890d33944d28e554a7d515eb9365ea060d43f7f5da7e6b3cd2bd750b6b2519c9b201175b66bce17ae3f47dcc6710dd6343ade19abfdeaff3e4b953e4409ffdf242d375ffa3ba69f139af611470108dc81cb389efb1940eae6803ec495646aa86d99741d320192ccc1246ab3b450ab1417813207d2e70c53954f6ca6dcbaa7f15b85eacbb79c7f5e328e0f2259b525d63c353cc6d7d6b1f32c274dfc2ccb094b547f35f749f5e474647315fbac0ba4da3d97514e01509c57fbcce12415354c64eedc851d82462813d7e404ea832d1622aa4613984bdd032379455719bb1ef71565a474fb25f82ea49408be387ff568096518111018b5a6759ce73ad59bb433de75866cbd6690488c46a1ad5acccec1d95f0364e15902cb8220ff8ce6a1bcc181100a04cc9b440bf619a29016c2246c03f05d6a84fd865c6fa0750b5c5ee9f34ec0af4e5a7a332a835f7b037ef7ddcfc75f6456eb5d7bfad2af00df4c8da26693cd1e676c974a344967356d97f2ccc1ea02d0366734430d140ae8f076babaf222e56e018f4b06b10eb394aaa58964f04951bc37468cc0782c5e287fa9aa4bfa991345c8251d22f68b91d2f4443ce0ed965133c73da358fc389107f6b160db13ce8370d38538cab2797dccc926150d6fbff8e2293deb7ecb7dab98e782984ee4006d018556b947b54bec948e5fdde2b6bc2593bbc8d81b01659a35d86b3c338d6863e156be81531bc3f8c28b2bb043773e6b3e197581bf302b8c9af1dd916b066f9991e7de03ee29fd53c74f3e3abf4e8850bbbed370e8678a70d07cdf993de9b4d3f4348e598ab24bcaeaa6578437767118bdf845425f4c712347df2ce2ccc0f858229d9bcddbd14550006f9882dc42c767fc9dc5147dfdf1653e86144a54696d1a2445fcc3025abb4352b5b6e7b881265db377bd8d25f5ff5a58d2eebf89342476890c2182235f8bc75449c6baa3187c545bd4b33e5e0ded1bc09789a897995b3fc540f93f4615bd6cfbbbbb121bff3b5fb578a67c351e57b8da63a5d0cd0ebb35e3bde0ca5adcfdfbbacb4137ce251035a9d86d2d6b4ad1732a80ab2ae72e0b3b5b8af5bebc8f65d8b0217476d11dbaffb52f680f1dab1780d9f690510cb8561ae04babcba9d3180f8185750ab79da0b5ad2a33ab07019342bad0fa5d31c4a42cd5b6e4cbaf9d0b833f18fcc4f1374ecce5045d33fff05f2305b0321bb815ebf7856b6ee59adb8322d0a2abfba4961ffbcd13e69e896df234dce70145446d52d17cc929091064179405555848a65869ba74a933732f720b205ebf14a0daf741d5ac1df1e0a7b9457a6dc7cacc7f409388cd6469ad8d05fe9ca690c7691136e59acbc86bfd6297651279589a567a81ac2b662c853c4c5a20a66d726666043ed4995144b3bd3d43d1fc638ffd0ad10650777d3a3aa142773b267b54658d32573865fdcee58023f6dca4776ecd9c187d8f3ef2893e4ebaf5207ddf61924f8aaf912bc34a5822c19718e45a001badc0bca138442e271a97178ea0f7141dc3eeb7fab24af3e37b5052fe37c11abeed03edfa47d8ae8effdd0537315b9a453042599b2023a395a05fc3f921ae21708582f6711a10faed2e25b6682e14be3406f2042fb1e39b27d4c886c1c9841b21b093ccce1e80404a11709ae4e800d4ee86225b3c6dff0302ce356b3ce5c6a6335c175c000fddf150413d28dc9d598aaa878d77a8b6265922458ec255fefc3f13a3bbe8aee22890dcd9fb640ca3a88da2eecfd7abc06152ff8796f7ad736c145a1ee73a9c98011ec1e9a33c9e2acf523f864ef57cd9739ebc6df0de4e8f60420f08a5aebb943ab10d339e01029d4bf117653563ad448ffbc8746478622c299a73ae3ec5ff46a479c69d41295ff3580fd0d8ac8bf294f624f871f78513396c484bebe90eeda48aa8215ec631d628c87c45961b1f2945d2ce5d4b8f42ede762d011164e0d59505f8bb2a34b7744c3184e827d3dd9116165bcc696f13dc5f9a399b8eb94a2c9ccec27463ee66bc97c9a8e68538547e993c5751be9be7c2e1400fda9dfcd712821725c3702ce848e42a608b1fb61f343856b3ce6eb2cb04bbd3ff5865f1dad7365da1cf7bba3710732e60d8458111eba2bab51a9fd4e02f801f900d6494729922079a4d61ef9a227fc3270b52506391038a5f30f7992f8a70bf28a2ebec6d28e3a4ded4c3963ef6ae51027bb204f8b49875c96be7fdb03238bf5d65781f6d19f1371153804de851ecf9e9ff077dd136f509b5826f3e12315c373450ab1defcf36fcf20c63af922bb9e9dc1c57e332164eb636038454592e64d9786185e139a5e2bdf011d1830bfb0cd48f52f9bc5df392c9aa7ae744a645baed333ec5339ef11558f8cd75dae7feecd0dc15da7939f5504c0cfa29691d4939a87596b7c417f8fc2324464e8eee5bd89be462dec3968914bd507fc86c6b7b63c64168e44e1e30d6480585b0ca184de606b740c78634d6f570101f1c032653a8b4e17ce2814df2d4a6bf5731a8832fb08e6d786f8a4838791237c731b8a3687fea265ccdc711648ee39f6443c927f960086ad11bc367f98b4937022cafbc9ee672433db6708fe7d72182970a9d3e7a6cc0998b5176992a20076709ccf0c8c087ae3e8aee7a279ab606f5d41da307f5dd525b2cb59b75bd6770e7b8eb71937a21bd0acda7b2cfeb5af9c70a3c6464830224eaeeb4dc1b0eeee17a7857180a2dbda57cca36e61b525dd965144ff9daa57a3aea40c88ef2c74077a780edee2c1b95b0559ad36b68133dfacf21e68d877fd5c16ccef769b6ac552809f8ff42bdcdd1059cf6c7be982b8f0c787bb47fe1b8ace8af693cc1e0344632146ef4c3a678e81fa245fa11b2d0a4b8e4730d83c0be1d519b67b53600e72e2bf87df3196b646fc0680b75469ccb4f9ed5a7f31a008793df764513ecfc49ba41b10e160fcee2cc5f60d0c3f69a9e572c19b3bc64bf30cd464b88bec85c31a28c3b216cebcdbe9afccefe20c30fbc31bb54c9f966124883afba91db520b2a251637ec6d4d2d77b406f5471922c359614544ab4f2a6841cc2438bdd29f6667602464ae08ed969d425f8a630e21f60c46ff35fbc54069f627a7a58347071c115b125cd552612b37ddaf8b965eb85e28c332840b307f19e50472cdad7e0582b6ca74fd53753fbbec584e22f2af310e986a463ada7c0a3ec9a2615896b224b12af43a8760bf5bc49ba5df26749ddab2f58c3f008a49dcc19349c4347dbf3307031db0b20edc2bccf96693e7532bcd2efc0b5372470ce2754300542247ce0bd0b188a01e9e145e95644ed5485a94311dd392bfc661d82f5db5e983a02856f7cc900e674b35b6e3b868e4aec32d0a0bba30d861e46dcaf01a7d4d07753d8969fc88ce698286819ccf9232aa0b8759ecb6990dc57b7bb695468e801fd7100a811c4ea29947715b0bc94eb40f61ef2e61863e88e3bc6f4b4667035edcebdbd9a74b1614ad0902eb8e01f0a4663193fe6fa2d31751e779785a56088938dc4031d375c599abeb707cc3fa3aa30f3f74604df1dcb0917f3ab8dac3be10433dd6cfcb3ffd7ae4bf91f28637fb6e1e2b8e7cce770f045a4ed65a9a013fd69020ef028fa1f26d34c0ed7875f757439f5e08e8284745fdecd2989b63aba2bad362dfbce2798425144c718ac9af46499d4aea0667365fbe001bd31df517424cfd3e841c74656405a62ebb247fa845d48cc99a3a09c77048f2db59b876a1d6b9801578630bf2e95bd1ded78735558a3db512eb8426344c27a31175a082246271a9ef1e74553671dbbfd3918a857813eee1ef9a06a41f737bbc4c04d51b3c9695ff9820b78a9329cbc405295a180502002cdb0c9fe9637dd169760268fed6859f5ff70de60a9ac7ea4f3d54c6a6d20b0f7e7ff663f42cd70bde573a9be505c65fdbcc1114c6b45100153f87274f77061e9ba64bf8c5d885fcafe085d25c7d5fa213a2739699dfd321602fa13785d1deee61267ea760b86525f23ff06d915bfcc9104cdc0e6adf11b9fb4048d8575004f1ddc61210cb7be4cb5fefc97cc89252a7a133fd0fb7912b994561da2ee291bc227371db5ece6af1a405307797e612f109090989ce420ce521fa00b78585700869a1d341459207fe3dce18eab9fd7955de60fce1f655d7bdec454225d436e67237b904844f9128c831a120acc1e73a61968e0a4691d3342ddac7f103e88e842044582ca22c71bb6c8aaf32d01975965209766a64759c7232e653eff89f3890092fabe650fa9ca3a88d65caf4ea0d34532ae78f89777f43cf70534fb2466434b9d5c1cbfa739b043d35bc848bcd8f53d5e309777ff343dbec3206b1cb13d34d22c5d4a7a0e2386cf72409d9a7fb8e8e5a17caa258521d2651111062bcb467ccfe0b0985ac29ff468fa23836f9229c1560472eb395dd4fc8f5c98af1e24fb4c40170d32fb0cb86c79686e81cbb742f22674d4262736b00c1d82564f3a9ec8e3d56906811f1b115870ad2f4939c1b30282bdccb819023bf162d128940a2b46944c3f2294a02482db595be0718601bec78336f763e20f8b5f62e6f5f5c442c692d0fee6029454f59437d20b520aa7989643da15ad08fae1f5b173d6887ba066effd4081c61ee8baae999d6f7c9907ac39b02b21fca5aa6300e7f6760f65479622022351a81952e96f2be8bbd5825ce82fbc9b86de1828506c4cf023ae5dea4d3915302be16166857c1ad55a9081acaea58ed81bce28daa7c005646625da04ece999dd996c0054d7ff4322f684afda2b92d2cdad81b9973de5147a4e2bf5d489aa234fced79ac5ab6d5c5a5a910c33ecd1367151346c549aa59e9f6b5895440460e10c974c10ad42366e6ca6555603b478a0767dd44205c90274006133c6bf46b341908a2dd915b9fa3e28d0252bc6a47bbeb64262659bada594edb1fe24743aca99aa6e0529cef63a69a34a0d6f42b3f5b3719f7eaf8875c3f6577216d", 0x1000}, {&(0x7f0000001440)="92cddf749b1521b51d98e5555341b77fc4de3404fe58446367d5df181d9ec66135d3bcb6a31aeccff93f20870db83cb4c4b6b13f60136863c4cd857dc040b352a33f22e5100df440724e7f350aff543a259bca6c238bb3da89a70145a1a7535bf38798680ddc2a4e248dbb105647ad8221c38468203884904e65867f1b9062d67303eda5d28e35781b8604286e8ded9b70853e736c6df036a208cb577523968bf0d83cbcb328feb6a17ef2d05d84e2cea025db6bcc1327fb7577f72d2209c708469510ec896e1fa220ca793c0c5f070acc7c48bc38bbe124956c6d7ee4a2702e482cbf94d6f1e08170df", 0xea}, {&(0x7f0000001540)="57766514f6dd0954bd9db03bccfe2749c3826995ec9f2be99b0e0e6612590bbe89d759156f986005bfd538e3302225f708aafb42b7077f074686f9f925ddf878388a3f94a449fad79ccfe2fd699e7dcc3a2169c4b217da84b06dace0e483a6283aca17904499f275be2c4f57afb707ef106d540f2db72b5aaf369c745f9fcad51c6bee5ea6a663c3b30d39cd8beeb265d0aacda556dd06fe4fce774eda22dea4e9135d9f2c71ce275895f9481ec1e90712607eef7244548ad5c4b1e3f8b1d4713f0eee7971951e4a5ea4ff0de8e04f70ab537c6c7abb9b701992", 0xda}, {&(0x7f0000001640)="df412bc4c2f534206d2b86fd4d70eac5ad399a55f9aa3ec969c2689371b7ea3a157d41237083955e3f055a209b3a6a6695c04d1b9d8475de6a9e1329e1039706325388850b0c70fcc9e34b452c354f6c259676b2f50b731d1176f2615e781b703275e1624f66e7a7dd2dd9c120e048d545c03fbbe534d93b859c97c600767c31097571f7797da0dda901d30b0cac125806f04c58245de56fb9350897744ae83d050b48a7", 0xfffffffffffffce8}, {&(0x7f0000000100)="4432b6849e129d725378bd699b7da0c11a5d4a7daf830778ee12fc6ba1856e8456953e1967b29344d358e21f583bb69dc111", 0x32}, {&(0x7f0000000140)="990848c753cce95c4d8619b9de67e03db04e59e43d537cc59b0176", 0x1b}], 0x6}}, {{&(0x7f00000001c0)={0xa, 0x4e21, 0xffffff00, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x101}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000001700)="ed1bc687f16a307c3cd62f58c914bfb5928aa1d8af605cd11bf32d59d73db85c37f24530ea3ea9514937b13b24567a8e34545c4f8d51a280e953526ae74d00c8a831f57ebcc288bbda4a31d485f3e588ee171752909892a63bb41eb94391bf7fcd1f17b621fa2ab744da5a34773c437b595338f4600f694008939de11972bf6c63c47a23b139cc7dd0bef4ddcf577a0a62fc13f3a3d3e939c339fc0a980bc3504bf1f6f4db12450b1434e64d928070176cdf368d0b49209c311aee87149277c779801de96fccfa37b48640096bf0b8ffcf42dd56b05cb4d1e5391716da24aef9af1370e7b3f9a81d759d5608ae7b", 0xee}], 0x1, &(0x7f0000001800)=[@rthdr={{0x58, 0x29, 0x39, {0x75, 0x8, 0x3, 0xff, 0x0, [@initdev={0xfe, 0x88, [], 0x1, 0x0}, @local, @dev={0xfe, 0x80, [], 0x15}, @empty]}}}, @tclass={{0x14}}, @dstopts={{0xc8, 0x29, 0x37, {0x89, 0x15, [], [@generic={0x1, 0x142, "edba50445852fb5ad05f191f45c17210ac70509fdad212ad014287ef29fa8bf17e43dda28b6f2efa05303a87d626f6d1ac96d5baf4aef7553f1b3bb53a97d8955658033b370e4275cfe2d94301d00b332453d8ca1769dfe402da76702f2457ddf4c21f5256"}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x1}, @pad1, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @hao={0xc9, 0x10, @ipv4={[], [], @broadcast}}, @ra={0x5, 0x2, 0x7f}, @ra={0x5, 0x2, 0xff01}, @hao={0xc9, 0x10, @remote}]}}}, @hopopts={{0x38, 0x29, 0x36, {0x14, 0x3, [], [@padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0xe79}, @hao={0xc9, 0x10, @initdev={0xfe, 0x88, [], 0x1, 0x0}}]}}}, @dstopts_2292={{0xf0, 0x29, 0x4, {0x67, 0x1a, [], [@generic={0x9, 0x87, "b121209b88fc73ebcc093257fd85da84c1517bad1f9abbdcb0045c4263924ac406c965b13e3aac94ebdbff9ce5ad1ed044c6cc0dec469b42c0b0fa25da051f55a2edb3553de23851662bc508d1c000c8c8ca78595977c7c8ad9ca6b74a25c085a709eae832f812c4daefacf8ac0a2f47854b25f3e4e822cd08942892b29d76ca2c316695a451f5"}, @hao={0xc9, 0x10, @loopback}, @calipso={0x7, 0x18, {0xffffffff, 0x4, 0x1, 0x2, [0x4, 0xfffffffffffffff9]}}, @ra={0x5, 0x2, 0x400}, @hao={0xc9, 0x10, @rand_addr="2841ced6536c92a501e07122068a0cce"}, @jumbo={0xc2, 0x4, 0x93a}]}}}, @pktinfo={{0x24, 0x29, 0x32, {@dev={0xfe, 0x80, [], 0x28}, r9}}}, @dstopts={{0x20, 0x29, 0x37, {0x62, 0x0, [], [@jumbo={0xc2, 0x4, 0x2020}]}}}, @dstopts_2292={{0x30, 0x29, 0x4, {0x2, 0x2, [], [@hao={0xc9, 0x10, @dev={0xfe, 0x80, [], 0x16}}, @ra={0x5, 0x2, 0x9}]}}}, @rthdr={{0x78, 0x29, 0x39, {0x94f24fbaf963ab3, 0xc, 0x0, 0x3, 0x0, [@remote, @mcast1, @mcast1, @mcast1, @empty, @loopback]}}}], 0x350}}, {{0x0, 0x0, &(0x7f0000001e80)=[{&(0x7f0000001b80)="cd5f197f6e7533f3c6c903b0131c6325c92be3f9784ca5273f456259a3298d02c12eca791d5a92fa638a865ff471f4a78e8d5a8ed385b436c9a6574a8e8594be159fcb8d088b539df4e3819d311d42bced304454f791fb2a82a02ec8f7597e03f846398bda865e6a9495786407040e1cee3036679d57553f6992939506564d76c457d0cd14bb4ea88360463a13992719c8fd8e44f300649c9290aae77b45f3732e59dc8b61c96e3386f7c592fbf6274cd339ebf08235e7b8962b010cc00d9d5b775736a2eb92bc8918f0a94d27dd7afa6eb78805c987d4f1ac232af29ee959126fb2ff3006b1e307ef402982bed06f99af0d919f1bfe", 0xf6}, {&(0x7f0000001c80)="00000000800000003ea3ed6b846e9650bc1288e00d7a9a7ccb030e9a964f3ae1024f04ddc07bd0982e7fb44af6f62d2f11672323684359fc2c0f2a682419ad8499c0be9812264325df7c9dc52e95837087780530131c6727a45cd891", 0x5c}, {&(0x7f0000001d00)="dfd39cc356cfe48c14e500e30a7e856e5b419b32e419e7910d917aec11a2b018dc5918684842c773287c230b150cf8496375c9a37e634bf08628e455426916fc414a7c9d6161bc72086066d13895a6443c367c59948f6f9d956813498e732eb01fca080c21ced3cebeaf4d74c57be3", 0x6f}, {&(0x7f0000001d80)="96fb06969e1cf5a867dcd26d8aa3f90ac137c9223c69a3ae35c4455f383905866ca839737dad5a54c70ba914fea8322820427ac356194d22df2489b366e9f53a85f8cead0a3bddf51c4d22ed32807b5bce809652eb0f0fc056bebbabb22740615a5cbf17f9071fddea5544476f57ed838f0add41ce624d5c470bab1ec90089e45ee9417b9d8973842df2de68e0b4648173bfa8d109eac64023cb4dc51d6f38e383afdfb9f5aeb8f7df7830b0a5c5b3bd9b3f5c721ba8c0d70b9846a39c14a362b80cd93ce95600820bf691ca42c2efbabf57291322619051b6ece196070bdfc3e7adbba41da9a24cb55d6333c028e56bff73b3129367e3cef4edcfedddc2", 0xfe}], 0x4, &(0x7f0000001ec0)=[@dstopts_2292={{0x70, 0x29, 0x4, {0x3a, 0xa}}}, @rthdrdstopts={{0x18, 0x29, 0x37, {0x3c}}}, @rthdr={{0x88, 0x29, 0x39, {0x6, 0xe, 0x1, 0x5, 0x0, [@empty, @local, @ipv4={[], [], @loopback}, @loopback, @empty, @mcast2, @mcast2]}}}, @hopopts={{0x1f, 0x29, 0x36, {0x0, 0x0, [], [@padn={0x1, 0x2, [0x0, 0x0]}, @pad1]}}}], 0x130}}, {{&(0x7f0000002000)={0xa, 0x4e24, 0x7, @dev={0xfe, 0x80, [], 0x19}, 0x5}, 0x1c, &(0x7f0000002380)=[{&(0x7f0000002040)="1acc923486c8167199764dff3171770a53cc226c86b5c94ebe619c00ff7188e7606f5b8a8ddc37ac296f26ded4d61be0bfa7a0cb18d4d00674bc605121ad63207624a2f27d3af4dcd125264db34967c0f06b457a49", 0x55}, {&(0x7f00000020c0)="47168a05e6de7b863d7d9f30328fa22fbfdbe9a11b6a819ee38d9aa4a0f95eba058f8006ba1b5d0077", 0x29}, {&(0x7f0000002100)="143f21012cf7c4641ec264ab12009e45938b581bb8e5ad1d575781dda5368e644565cc032abe6cee3801460903775cc97c14197f6e9d02c86850a804dceb0d70ced9a1add9dd3d79e0faaaf24edba487fd2bfaf06a756a827055325c72199a7af008fc5c0b7e7fc8a2e5b7138d6cc3c684bc8229b70504cf8187b9598011316528a04e0284176fab1d6065d423c7d7ce117ce4649486a9cd7a8d40f7a0a6b7327c460b", 0xa3}, {&(0x7f00000021c0)="13c44060cbe4a6786963a96bc78cf071de7ecb576625bd00750219741cdbb2928660da050b4d62f1c12b650167e6bb3905dbb235bc2669c2752f418a29b8770d34f93ec9612b66f7724de9296e1b607080ae55d805c0fb56a842657805f601a92c94aa1cd469d9b43b", 0x69}, {&(0x7f0000002240)="4b1792f63a8653d982bcd42523ffd5e44145fd4eecb9fc1a3f2f984a543706911a2a665e7f95d3a400babc160ac4ad4a08074f5c7bc50d0080b7140cd7d06ec4f08c79f4988a14e88e4745a2e808fbc3a177878b8b7786b09a072e64559fe122fa2622b57a4a9252549f00ba546fcdba9dabfdcf4d8a6f7941d69222215bb861b3b05cf6836cc014a7aadb8ecf5a612514ec4472fdf5", 0x96}, {&(0x7f0000002300)="3655b1f311f9130c2bcf9a06720eabb4c52bc0a2d21dc779b79317c03d16e15db40109dbf372f86f80e574baac41b65a251af42548f3", 0x36}, {&(0x7f0000002340)}], 0x7, &(0x7f0000002400)=ANY=[@ANYBLOB="14000000000000002900000008000000b80400000000000058000000000000002900000039000000080801fa000000008b864e558470b9c4689b22c017357e79ff0200001a0000000000000000000001ff010000000000000000000000000001fe80000000000000000000000000001d1400000000000000290000000b0000000000056000000000b00000000000000029000000360000001a120000000000000286c7a9c1da0550ff9aff5542e44757baabbe0b050e96d06335e16b01f809edb0eb0f8fc51c833e58b64d7893a148e3e77c9353de5a5c35a8e3cf078d403dbcc89b05ae2625e48ea3b24cd95b57165d84d083e73a0b480098b6da177d1e53fd83c1a092f035590f8c8d9a7063666b07f6868016cd855c157f61aef56d4a71fba94fef2be419f67017a94e0502000501060000000000000000000014000000000000002900000008000000040000000000000014000000000000002900000043000000d100ffff00000000140000000000000029000000430000000300000000000000280000000000000029000000390000002b02000700000000fe8800"/424], 0x1a8}}, {{&(0x7f00000025c0)={0xa, 0x4e21, 0x4, @empty, 0x9}, 0x1c, &(0x7f0000002780)=[{&(0x7f0000002600)="adea9677c5dd9e3b343410300b39c3d5524eff9f3c4fa70cbacf", 0x1a}, {&(0x7f0000002640)="4295f6238ce202349c49e1f62e7b85968f82929cf9a406751f8564b035c5214b85fe557305153e3aef9a1f23c30207b7c2640d52b5d5daac441b55825ba75712bec4ab8fcf3568c76be2bd61d599dca948eea4fe0e37", 0x56}, {&(0x7f00000026c0)="f3cf2c20d88d83632477564d93186d2122311b8cee8a68c4c6a6b65bcf922a997000b425e688812525844bf5b34c986f88129027d39d0aed267c1ee579290da58f0c06131c92cc2499f6fbab65bffc855d54e12c4aee000b2257bb06a6cd00e78e2866477158ea1bc0e1ebb452660cbc4c245dd9c4257a84fc1452fac47591a9bbb7be4e1b627e589fe6fa48fbd617ddd742", 0x92}], 0x3, &(0x7f00000027c0)=[@dontfrag={{0x14, 0x29, 0x3e, 0x1f}}, @rthdrdstopts={{0x28, 0x29, 0x37, {0x33, 0x1, [], [@jumbo={0xc2, 0x4, 0x4f}, @jumbo={0xc2, 0x4, 0x401}, @padn={0x1, 0x1}]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x3f}}], 0x58}}], 0x5, 0x10000000) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:02:58 executing program 2: 23:02:59 executing program 2: 23:02:59 executing program 1: [ 376.109336] IPVS: ftp: loaded support on port[0] = 21 23:02:59 executing program 1: 23:02:59 executing program 2: 23:02:59 executing program 1: 23:02:59 executing program 2: [ 376.559251] IPVS: ftp: loaded support on port[0] = 21 23:02:59 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) 23:02:59 executing program 1: 23:02:59 executing program 4: open(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x88001) sendfile(r4, r5, 0x0, 0x800000000024) renameat(r3, &(0x7f00000000c0)='./file0\x00', r5, &(0x7f0000000100)='./file0\x00') sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x5, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x3c) mkdir(0x0, 0x0) r6 = dup(0xffffffffffffffff) r7 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r6, 0xab07, 0x0) symlink(&(0x7f0000000140)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', &(0x7f00000002c0)='./file0\x00') geteuid() fchownat(r7, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) ioctl$RNDADDTOENTCNT(r6, 0x40045201, &(0x7f00000001c0)=0xfffffffa) r8 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r8, 0x80044dff, 0x0) 23:02:59 executing program 3: openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffdffffffffff, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x9fc, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0), 0x106, 0x8}}, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x1) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000d80), 0x4) unshare(0x40000000) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000140)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4a8, 0x350, 0x1a0, 0x0, 0x350, 0x1a0, 0x410, 0x410, 0x410, 0x410, 0x410, 0x6, &(0x7f0000000000), {[{{@uncond, 0x0, 0x98, 0xe0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4, 'ip6gre0\x00', 0x9}}}, {{@ip={@empty, @remote, 0xffffff00, 0xffffff00, 'syzkaller0\x00', 'veth1_to_hsr\x00', {0x1fe}, {0xff}, 0x33, 0x1, 0x2}, 0x0, 0x98, 0xc0}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x2}}}, {{@uncond, 0x0, 0xc0, 0xf0, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x8}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x32b6, 0x7000, @empty, 0x4e21}}}, {{@ip={@empty, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xff000000, 0xffffff00, 'gretap0\x00', 'vxcan1\x00', {0x101}, {}, 0x0, 0x1, 0x6c}, 0x0, 0x98, 0xc0}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x3, 0xef}}}, {{@ip={@empty, @loopback, 0x7fffffff, 0xff000000, 'tunl0\x00', 'hwsim0\x00', {}, {}, 0x84, 0xacaf43df70f9f169, 0x9e7303e32ee2e607}, 0x0, 0x98, 0xc0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x508) 23:02:59 executing program 2: 23:02:59 executing program 5: memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x0) dup(0xffffffffffffffff) r2 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000007f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) geteuid() fchownat(r2, &(0x7f0000000300)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000400)='./file0\x00', 0x0) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) ioctl$UFFDIO_REGISTER(r3, 0x80044dff, 0x0) unlink(&(0x7f0000000040)='./file0\x00') syz_init_net_socket$rose(0xb, 0x5, 0x0) 23:02:59 executing program 1: 23:02:59 executing program 2: 23:02:59 executing program 1: [ 376.810363] ================================================================== [ 376.817889] BUG: KASAN: use-after-free in tw_timer_handler+0x124/0x150 [ 376.824556] Read of size 8 at addr ffff88805eb18378 by task syz-executor.4/17548 [ 376.832068] [ 376.833682] CPU: 1 PID: 17548 Comm: syz-executor.4 Not tainted 4.14.146 #0 [ 376.840673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 376.850016] Call Trace: [ 376.852585] [ 376.854729] dump_stack+0x138/0x197 [ 376.858345] ? tw_timer_handler+0x124/0x150 [ 376.862652] print_address_description.cold+0x7c/0x1dc [ 376.867932] ? tw_timer_handler+0x124/0x150 [ 376.872237] kasan_report.cold+0xa9/0x2af [ 376.876369] __asan_report_load8_noabort+0x14/0x20 [ 376.881279] tw_timer_handler+0x124/0x150 [ 376.885425] call_timer_fn+0x161/0x670 [ 376.889295] ? inet_twsk_kill+0x480/0x480 [ 376.893440] ? __next_timer_interrupt+0x140/0x140 [ 376.898266] ? trace_hardirqs_on_caller+0x19b/0x590 [ 376.903268] run_timer_softirq+0x5b4/0x1570 [ 376.907572] ? inet_twsk_kill+0x480/0x480 [ 376.911731] ? add_timer+0xae0/0xae0 [ 376.915452] ? __lock_is_held+0xb6/0x140 [ 376.919523] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 376.924987] __do_softirq+0x244/0x9a0 [ 376.928796] ? sched_clock+0x2e/0x50 [ 376.932531] irq_exit+0x160/0x1b0 [ 376.935994] smp_apic_timer_interrupt+0x146/0x5e0 [ 376.940843] apic_timer_interrupt+0x96/0xa0 [ 376.945165] [ 376.947410] RIP: 0010:_raw_spin_unlock_irqrestore+0x95/0xe0 [ 376.953115] RSP: 0018:ffff8880a04bfac0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 [ 376.960834] RAX: 1ffffffff0ee2a81 RBX: 0000000000000282 RCX: 1ffff11010764d14 [ 376.968101] RDX: dffffc0000000000 RSI: ffff888083b26880 RDI: 0000000000000282 [ 376.975425] RBP: ffff8880a04bfad0 R08: ffff888083b26000 R09: ffff888083b268a0 [ 376.982696] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888091a1ca80 [ 376.989961] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 [ 376.997246] __wake_up_common_lock+0xe3/0x160 [ 377.001738] ? __wake_up_common+0x5a0/0x5a0 [ 377.006066] ? save_trace+0x290/0x290 [ 377.009856] ? kasan_check_read+0x11/0x20 [ 377.014000] ? __lock_is_held+0xb6/0x140 [ 377.018089] __wake_up+0xe/0x10 [ 377.021357] wakeup_pipe_writers+0x59/0x90 [ 377.025584] splice_from_pipe_next.part.0+0x1ba/0x290 [ 377.030766] __splice_from_pipe+0xf9/0x780 [ 377.034988] ? iter_to_pipe+0x4e0/0x4e0 [ 377.038960] vmsplice_to_user+0x197/0x1c0 [ 377.043100] ? __splice_from_pipe+0x780/0x780 [ 377.047588] ? __fget+0x210/0x370 [ 377.051036] ? find_held_lock+0x35/0x130 [ 377.055114] ? lock_downgrade+0x651/0x6e0 [ 377.059279] ? __fget+0x237/0x370 [ 377.062736] ? __fget_light+0x172/0x1f0 [ 377.066724] SyS_vmsplice+0x131/0x160 [ 377.070513] ? default_file_splice_write+0x80/0x80 [ 377.075440] do_syscall_64+0x1e8/0x640 [ 377.079314] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 377.084152] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 377.089336] RIP: 0033:0x459a29 [ 377.092520] RSP: 002b:00007fd8fdaa6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 377.100244] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459a29 [ 377.107508] RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000003 [ 377.114763] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 377.122024] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8fdaa76d4 [ 377.129294] R13: 00000000004c9274 R14: 00000000004e06c0 R15: 00000000ffffffff [ 377.136590] [ 377.138205] The buggy address belongs to the page: [ 377.143139] page:ffffea00017ac600 count:0 mapcount:-127 mapping: (null) index:0xffff88805eb18180 [ 377.152887] flags: 0x1fffc0000000000() [ 377.156765] raw: 01fffc0000000000 0000000000000000 ffff88805eb18180 00000000ffffff80 [ 377.164633] raw: ffffea0001547320 ffffea00016b1720 0000000000000002 0000000000000000 [ 377.172533] page dumped because: kasan: bad access detected [ 377.178230] [ 377.179859] Memory state around the buggy address: [ 377.184869] ffff88805eb18200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 377.192209] ffff88805eb18280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 377.199658] >ffff88805eb18300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 377.207006] ^ [ 377.214275] ffff88805eb18380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 377.221645] ffff88805eb18400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 377.228990] ================================================================== [ 377.236333] Disabling lock debugging due to kernel taint [ 377.241839] Kernel panic - not syncing: panic_on_warn set ... [ 377.241839] [ 377.249194] CPU: 1 PID: 17548 Comm: syz-executor.4 Tainted: G B 4.14.146 #0 [ 377.257414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 377.266770] Call Trace: [ 377.269334] [ 377.271482] dump_stack+0x138/0x197 [ 377.275105] ? tw_timer_handler+0x124/0x150 [ 377.279405] panic+0x1f2/0x426 [ 377.282597] ? add_taint.cold+0x16/0x16 [ 377.286556] kasan_end_report+0x47/0x4f [ 377.290515] kasan_report.cold+0x130/0x2af [ 377.294737] __asan_report_load8_noabort+0x14/0x20 [ 377.299644] tw_timer_handler+0x124/0x150 [ 377.303878] call_timer_fn+0x161/0x670 [ 377.307749] ? inet_twsk_kill+0x480/0x480 [ 377.311878] ? __next_timer_interrupt+0x140/0x140 [ 377.316717] ? trace_hardirqs_on_caller+0x19b/0x590 [ 377.321717] run_timer_softirq+0x5b4/0x1570 [ 377.326036] ? inet_twsk_kill+0x480/0x480 [ 377.330173] ? add_timer+0xae0/0xae0 [ 377.333876] ? __lock_is_held+0xb6/0x140 [ 377.337918] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 377.343360] __do_softirq+0x244/0x9a0 [ 377.347142] ? sched_clock+0x2e/0x50 [ 377.350849] irq_exit+0x160/0x1b0 [ 377.354288] smp_apic_timer_interrupt+0x146/0x5e0 [ 377.359124] apic_timer_interrupt+0x96/0xa0 [ 377.363424] [ 377.365644] RIP: 0010:_raw_spin_unlock_irqrestore+0x95/0xe0 [ 377.371333] RSP: 0018:ffff8880a04bfac0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 [ 377.379037] RAX: 1ffffffff0ee2a81 RBX: 0000000000000282 RCX: 1ffff11010764d14 [ 377.386288] RDX: dffffc0000000000 RSI: ffff888083b26880 RDI: 0000000000000282 [ 377.393555] RBP: ffff8880a04bfad0 R08: ffff888083b26000 R09: ffff888083b268a0 [ 377.400814] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888091a1ca80 [ 377.408071] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 [ 377.415350] __wake_up_common_lock+0xe3/0x160 [ 377.419828] ? __wake_up_common+0x5a0/0x5a0 [ 377.424143] ? save_trace+0x290/0x290 [ 377.427939] ? kasan_check_read+0x11/0x20 [ 377.432070] ? __lock_is_held+0xb6/0x140 [ 377.436115] __wake_up+0xe/0x10 [ 377.439376] wakeup_pipe_writers+0x59/0x90 [ 377.443621] splice_from_pipe_next.part.0+0x1ba/0x290 [ 377.448792] __splice_from_pipe+0xf9/0x780 [ 377.453008] ? iter_to_pipe+0x4e0/0x4e0 [ 377.456991] vmsplice_to_user+0x197/0x1c0 [ 377.461127] ? __splice_from_pipe+0x780/0x780 [ 377.465608] ? __fget+0x210/0x370 [ 377.469047] ? find_held_lock+0x35/0x130 [ 377.473115] ? lock_downgrade+0x651/0x6e0 [ 377.477268] ? __fget+0x237/0x370 [ 377.480726] ? __fget_light+0x172/0x1f0 [ 377.484713] SyS_vmsplice+0x131/0x160 [ 377.488511] ? default_file_splice_write+0x80/0x80 [ 377.493440] do_syscall_64+0x1e8/0x640 [ 377.497306] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 377.502140] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 377.507319] RIP: 0033:0x459a29 [ 377.510491] RSP: 002b:00007fd8fdaa6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 377.516853] kobject: 'loop0' (ffff8880a49d6960): kobject_uevent_env [ 377.518189] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459a29 [ 377.518194] RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000003 [ 377.518198] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 377.518205] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8fdaa76d4 [ 377.538494] kobject: 'loop0' (ffff8880a49d6960): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 377.539121] R13: 00000000004c9274 R14: 00000000004e06c0 R15: 00000000ffffffff [ 377.547758] Kernel Offset: disabled [ 377.575291] Rebooting in 86400 seconds..